Added flag to allow ignoring signature check on package_index.json

cmaglie · cmaglie · commit 0e471bc49cbe · 2016-02-01T16:54:02.000Z
diff --git a/arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java b/arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java
@@ -78,7 +78,7 @@ public ContributionsIndexer(File preferencesFolder, Platform platform, Signature
 
   public void parseIndex() throws Exception {
     File defaultIndexFile = getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME);
-    if (!signatureVerifier.isSigned(defaultIndexFile)) {
+    if (!PreferencesData.getBoolean("allow_insecure_packages") && !signatureVerifier.isSigned(defaultIndexFile)) {
       throw new SignatureVerificationFailedException(Constants.DEFAULT_INDEX_FILE_NAME);
     }
     index = parseIndex(defaultIndexFile);
diff --git a/build/shared/lib/preferences.txt b/build/shared/lib/preferences.txt
@@ -269,3 +269,10 @@ serial.debug_rate=9600
 
 # default chosen language (none for none)
 editor.languages.current = 
+
+# Debugging/Development Preferences
+# ---------------------------------
+
+# Disable signature check on packages_index.json, use only for
+# development/debugging purposes. Do not enable in production.
+#allow_insecure_packages=true

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ public ContributionsIndexer(File preferencesFolder, Platform platform, Signature`
`78`	`78`
`79`	`79`	`public void parseIndex() throws Exception {`
`80`	`80`	`File defaultIndexFile = getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME);`
`81`		`- if (!signatureVerifier.isSigned(defaultIndexFile)) {`
	`81`	`+ if (!PreferencesData.getBoolean("allow_insecure_packages") && !signatureVerifier.isSigned(defaultIndexFile)) {`
`82`	`82`	`throw new SignatureVerificationFailedException(Constants.DEFAULT_INDEX_FILE_NAME);`
`83`	`83`	`}`
`84`	`84`	`index = parseIndex(defaultIndexFile);`