Skip to content

Add extension signature verification service#162285

Merged
sandy081 merged 5 commits into
microsoft:mainfrom
dtivel:dtivel/verify-packages
Oct 18, 2022
Merged

Add extension signature verification service#162285
sandy081 merged 5 commits into
microsoft:mainfrom
dtivel:dtivel/verify-packages

Conversation

@dtivel

@dtivel dtivel commented Sep 28, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

Progress on #162284.

This change adds a new service (IExtensionSignatureVerificationService) which will verify signed extensions installed from Visual Studio Marketplace. Unsigned extensions will skip verification. The actual signature verification engine is not included in this PR. Verification is behind a feature flag, which is disabled by default.

This change also modifies existing install/update telemetry to include:

  • isSigned: a boolean value indicating whether or not the extension is signed
  • wasVerified: a boolean value indicating whether or not signature verification succeeded
  • errorcodeDetails: a string value indicating the signature verification error, if available

CC @isidorn, @joaomoreno, @sandy081

@sandy081 sandy081 assigned sandy081 and unassigned joyceerhl Sep 29, 2022
@sandy081
sandy081 self-requested a review September 29, 2022 07:08
@sandy081 sandy081 added this to the October 2022 milestone Sep 29, 2022
@sandy081 sandy081 added the extensions Issues concerning extensions label Oct 4, 2022
@sandy081

sandy081 commented Oct 11, 2022

Copy link
Copy Markdown
Member

@dtivel Went through the PR and updated with following changes

  • Moved extension signing verification to ExtensionsDownloader. This is needed because of the following scenario: When VS Code desktop client is connected to a remote server (WSL, SSH, Remote Containers, Codespaces), there is an option to download extensions locally that users can enable while installing extensions. When this option is enabled, extensions are downloaded locally (on the client side) and downloaded VSIXs are streamed to the remote side to install. We have to verify the signature of downloaded VSIXs during this scenario. To support this, I exposed download API on IExtensionManagementService that will download and verify the VSIX. Please refer to following code that uses this:

https://github.com/dtivel/vscode/blob/3b491952fa1096fce02dca5f27b157cbca2f5726/src/vs/workbench/services/extensionManagement/electron-sandbox/remoteExtensionManagementService.ts#L120

  • In addition, did some clean ups and updated/fixed the unit tests according to the above change.

Can you please test if the feature is working with new changes? Once confirmed, I will merge changes to main.

sandy081
sandy081 previously approved these changes Oct 11, 2022
View reviewed changes
@dtivel

dtivel commented Oct 14, 2022

Copy link
Copy Markdown
Member Author

@sandy081, I pushed 1 commit for a bug I found. Otherwise, the latest changes look good. Thanks so much for your review and for putting the PR in good shape.

@sandy081
sandy081 merged commit 845f524 into microsoft:main Oct 18, 2022
@dtivel
dtivel deleted the dtivel/verify-packages branch October 18, 2022 23:17
@github-actions github-actions Bot locked and limited conversation to collaborators Dec 2, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lramos15 lramos15 lramos15 approved these changes
@sandy081 sandy081 sandy081 approved these changes

Assignees

@sandy081 sandy081

Labels

extensions Issues concerning extensions

Projects

None yet

Milestone

October 2022

Development

Successfully merging this pull request may close these issues.

5 participants

@dtivel @sandy081 @lramos15 @joyceerhl @vscodenpa