1534659 - Fix cose signature manifests and filtering

Status: RESOLVED FIXED

(Cloud Services :: Operations: Autograph, defect)

Description

[Greg G]

As pointed out on #amo on IRC and https://github.com/mozilla/addons/issues/950#issuecomment-472030477 autograph is:

• including hashes of COSE signature files in cose.manifest
• doesn't filter out COSE signature files from the provided XPI
• including duplicate hashes of COSE signature files

probably other stuff too.

Filing as a security bug since it might allow an XPI to provide a different COSE manifest and deliver unvalidated files to a browser that only validates COSE signatures.

COSE signing from AMO is off at the moment.

Comment 1

[Greg G]

:m_and_m and :dreams this impacts the lockbox addon (added to autograph in bug 1530398). bug 1534483 potentially does too

Comment 2

[Matthew Miller [:m_and_m]]

thanks for the head's up :g-k. We just got our CI environment all set up and signing; haven't distributed anything.

From reading up, it appears there's no action Lockbox needs to take so far?

Comment 3

[Greg G]

(In reply to Matthew Miller [:m_and_m] from comment #2)

thanks for the head's up :g-k. We just got our CI environment all set up and signing; haven't distributed anything.

From reading up, it appears there's no action Lockbox needs to take so far?

Yep. If you need to get a release out, I can drop the COSE signature from the signing options for the lockbox addon. Otherwise if you can hold off signing the addon until we get this fixed that'd be good.

CC'd you and :dreams on the other bug, but assuming you aren't submitting crazy zip files we should be good there.

Comment 4

[Greg G]

blocks https://github.com/mozilla/addons/issues/950 (gah edited)

Comment 5

[Greg G]

Dropping sec flag since Fx treats the duplicate/mismatched entries as a corrupt addon per the AMO issue.

WIP fix PR at: https://github.com/mozilla-services/autograph/pull/251

Comment 6

[Greg G]

Fix is deployed:

$ zipinfo -1 plaudit-0.1.19-an+fx.zip| grep META-INF/
META-INF/cose.manifest
META-INF/cose.sig
META-INF/manifest.mf
META-INF/mozilla.sf
META-INF/mozilla.rsa
$ rm test-signed.xpi; curl -F "input=@plaudit-0.1.19-an+fx.zip" -o test-signed.xpi -H "Authorization: $LOCKBOX_PROD_TOKEN" https://edge.prod.autograph.services.mozaws.net/sign
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  493k    0  246k  100  247k  32586  32682  0:00:07  0:00:07 --:--:-- 64293
$ unzip test-signed.xpi 'META-INF/*'
Archive:  test-signed.xpi
  inflating: META-INF/cose.manifest  
  inflating: META-INF/cose.sig       
  inflating: META-INF/manifest.mf    
  inflating: META-INF/mozilla.sf     
  inflating: META-INF/mozilla.rsa 
$ grep -i cose META-INF/manifest.mf  # one entry for each cose file in PK7 manifest
Name: META-INF/cose.manifest
Name: META-INF/cose.sig
$ grep -i cose META-INF/cose.manifest # does not contain info about cose.sig or a hash of itself
$