You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1471 lines
50 KiB

Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
10 years ago
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
10 years ago
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2015, ownCloud, Inc.
  4. *
  5. * @author Bjoern Schiessle <bjoern@schiessle.org>
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Daniel Kesselberg <mail@danielkesselberg.de>
  8. * @author Joas Schilling <coding@schilljs.com>
  9. * @author Kyle Fazzari <kyrofa@ubuntu.com>
  10. * @author Lukas Reschke <lukas@statuscode.ch>
  11. * @author Michael Weimann <mail@michael-weimann.eu>
  12. * @author Morris Jobke <hey@morrisjobke.de>
  13. * @author Robin Appelman <robin@icewind.nl>
  14. * @author Robin McCorkell <robin@mccorkell.me.uk>
  15. * @author Roeland Jago Douma <roeland@famdouma.nl>
  16. * @author Sylvia van Os <sylvia@hackerchick.me>
  17. * @author Thomas Müller <thomas.mueller@tmit.eu>
  18. * @author Timo Förster <tfoerster@webfoersterei.de>
  19. *
  20. * @license AGPL-3.0
  21. *
  22. * This code is free software: you can redistribute it and/or modify
  23. * it under the terms of the GNU Affero General Public License, version 3,
  24. * as published by the Free Software Foundation.
  25. *
  26. * This program is distributed in the hope that it will be useful,
  27. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  28. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  29. * GNU Affero General Public License for more details.
  30. *
  31. * You should have received a copy of the GNU Affero General Public License, version 3,
  32. * along with this program. If not, see <http://www.gnu.org/licenses/>
  33. *
  34. */
  35. namespace OCA\Settings\Tests\Controller;
  36. use OC;
  37. use OC\DB\Connection;
  38. use OC\IntegrityCheck\Checker;
  39. use OC\MemoryInfo;
  40. use OC\Security\SecureRandom;
  41. use OCA\Settings\Controller\CheckSetupController;
  42. use OCP\AppFramework\Http;
  43. use OCP\AppFramework\Http\DataDisplayResponse;
  44. use OCP\AppFramework\Http\DataResponse;
  45. use OCP\AppFramework\Http\RedirectResponse;
  46. use OCP\Http\Client\IClientService;
  47. use OCP\IConfig;
  48. use OCP\IDateTimeFormatter;
  49. use OCP\IL10N;
  50. use OCP\ILogger;
  51. use OCP\IRequest;
  52. use OCP\IURLGenerator;
  53. use OCP\Lock\ILockingProvider;
  54. use PHPUnit\Framework\MockObject\MockObject;
  55. use Psr\Http\Message\ResponseInterface;
  56. use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  57. use Test\TestCase;
  58. /**
  59. * Class CheckSetupControllerTest
  60. *
  61. * @backupStaticAttributes
  62. * @package Tests\Settings\Controller
  63. */
  64. class CheckSetupControllerTest extends TestCase {
  65. /** @var CheckSetupController | \PHPUnit_Framework_MockObject_MockObject */
  66. private $checkSetupController;
  67. /** @var IRequest | \PHPUnit_Framework_MockObject_MockObject */
  68. private $request;
  69. /** @var IConfig | \PHPUnit_Framework_MockObject_MockObject */
  70. private $config;
  71. /** @var IClientService | \PHPUnit_Framework_MockObject_MockObject*/
  72. private $clientService;
  73. /** @var IURLGenerator | \PHPUnit_Framework_MockObject_MockObject */
  74. private $urlGenerator;
  75. /** @var IL10N | \PHPUnit_Framework_MockObject_MockObject */
  76. private $l10n;
  77. /** @var ILogger */
  78. private $logger;
  79. /** @var Checker|\PHPUnit_Framework_MockObject_MockObject */
  80. private $checker;
  81. /** @var EventDispatcherInterface|\PHPUnit_Framework_MockObject_MockObject */
  82. private $dispatcher;
  83. /** @var Connection|\PHPUnit_Framework_MockObject_MockObject */
  84. private $db;
  85. /** @var ILockingProvider|\PHPUnit_Framework_MockObject_MockObject */
  86. private $lockingProvider;
  87. /** @var IDateTimeFormatter|\PHPUnit_Framework_MockObject_MockObject */
  88. private $dateTimeFormatter;
  89. /** @var MemoryInfo|MockObject */
  90. private $memoryInfo;
  91. /** @var SecureRandom|\PHPUnit_Framework_MockObject_MockObject */
  92. private $secureRandom;
  93. /**
  94. * Holds a list of directories created during tests.
  95. *
  96. * @var array
  97. */
  98. private $dirsToRemove = [];
  99. protected function setUp(): void {
  100. parent::setUp();
  101. $this->request = $this->getMockBuilder(IRequest::class)
  102. ->disableOriginalConstructor()->getMock();
  103. $this->config = $this->getMockBuilder(IConfig::class)
  104. ->disableOriginalConstructor()->getMock();
  105. $this->clientService = $this->getMockBuilder(IClientService::class)
  106. ->disableOriginalConstructor()->getMock();
  107. $this->urlGenerator = $this->getMockBuilder(IURLGenerator::class)
  108. ->disableOriginalConstructor()->getMock();
  109. $this->l10n = $this->getMockBuilder(IL10N::class)
  110. ->disableOriginalConstructor()->getMock();
  111. $this->l10n->expects($this->any())
  112. ->method('t')
  113. ->willReturnCallback(function ($message, array $replace) {
  114. return vsprintf($message, $replace);
  115. });
  116. $this->dispatcher = $this->getMockBuilder(EventDispatcherInterface::class)
  117. ->disableOriginalConstructor()->getMock();
  118. $this->checker = $this->getMockBuilder('\OC\IntegrityCheck\Checker')
  119. ->disableOriginalConstructor()->getMock();
  120. $this->logger = $this->getMockBuilder(ILogger::class)->getMock();
  121. $this->db = $this->getMockBuilder(Connection::class)
  122. ->disableOriginalConstructor()->getMock();
  123. $this->lockingProvider = $this->getMockBuilder(ILockingProvider::class)->getMock();
  124. $this->dateTimeFormatter = $this->getMockBuilder(IDateTimeFormatter::class)->getMock();
  125. $this->memoryInfo = $this->getMockBuilder(MemoryInfo::class)
  126. ->setMethods(['isMemoryLimitSufficient',])
  127. ->getMock();
  128. $this->secureRandom = $this->getMockBuilder(SecureRandom::class)->getMock();
  129. $this->checkSetupController = $this->getMockBuilder(CheckSetupController::class)
  130. ->setConstructorArgs([
  131. 'settings',
  132. $this->request,
  133. $this->config,
  134. $this->clientService,
  135. $this->urlGenerator,
  136. $this->l10n,
  137. $this->checker,
  138. $this->logger,
  139. $this->dispatcher,
  140. $this->db,
  141. $this->lockingProvider,
  142. $this->dateTimeFormatter,
  143. $this->memoryInfo,
  144. $this->secureRandom,
  145. ])
  146. ->setMethods([
  147. 'isReadOnlyConfig',
  148. 'hasValidTransactionIsolationLevel',
  149. 'hasFileinfoInstalled',
  150. 'hasWorkingFileLocking',
  151. 'getLastCronInfo',
  152. 'getSuggestedOverwriteCliURL',
  153. 'getCurlVersion',
  154. 'isPhpOutdated',
  155. 'isOpcacheProperlySetup',
  156. 'hasFreeTypeSupport',
  157. 'hasMissingIndexes',
  158. 'isSqliteUsed',
  159. 'isPHPMailerUsed',
  160. 'hasOpcacheLoaded',
  161. 'getAppDirsWithDifferentOwner',
  162. 'hasRecommendedPHPModules',
  163. 'hasBigIntConversionPendingColumns',
  164. 'isMysqlUsedWithoutUTF8MB4',
  165. 'isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed',
  166. ])->getMock();
  167. }
  168. /**
  169. * Removes directories created during tests.
  170. *
  171. * @after
  172. * @return void
  173. */
  174. public function removeTestDirectories() {
  175. foreach ($this->dirsToRemove as $dirToRemove) {
  176. rmdir($dirToRemove);
  177. }
  178. $this->dirsToRemove = [];
  179. }
  180. public function testIsInternetConnectionWorkingDisabledViaConfig() {
  181. $this->config->expects($this->once())
  182. ->method('getSystemValue')
  183. ->with('has_internet_connection', true)
  184. ->willReturn(false);
  185. $this->assertFalse(
  186. self::invokePrivate(
  187. $this->checkSetupController,
  188. 'hasInternetConnectivityProblems'
  189. )
  190. );
  191. }
  192. public function testIsInternetConnectionWorkingCorrectly() {
  193. $this->config->expects($this->at(0))
  194. ->method('getSystemValue')
  195. ->with('has_internet_connection', true)
  196. ->willReturn(true);
  197. $this->config->expects($this->at(1))
  198. ->method('getSystemValue')
  199. ->with('connectivity_check_domains', ['www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org'])
  200. ->willReturn(['www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org']);
  201. $client = $this->getMockBuilder('\OCP\Http\Client\IClient')
  202. ->disableOriginalConstructor()->getMock();
  203. $client->expects($this->any())
  204. ->method('get');
  205. $this->clientService->expects($this->once())
  206. ->method('newClient')
  207. ->willReturn($client);
  208. $this->assertFalse(
  209. self::invokePrivate(
  210. $this->checkSetupController,
  211. 'hasInternetConnectivityProblems'
  212. )
  213. );
  214. }
  215. public function testIsInternetConnectionFail() {
  216. $this->config->expects($this->at(0))
  217. ->method('getSystemValue')
  218. ->with('has_internet_connection', true)
  219. ->willReturn(true);
  220. $this->config->expects($this->at(1))
  221. ->method('getSystemValue')
  222. ->with('connectivity_check_domains', ['www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org'])
  223. ->willReturn(['www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org']);
  224. $client = $this->getMockBuilder('\OCP\Http\Client\IClient')
  225. ->disableOriginalConstructor()->getMock();
  226. $client->expects($this->any())
  227. ->method('get')
  228. ->will($this->throwException(new \Exception()));
  229. $this->clientService->expects($this->exactly(4))
  230. ->method('newClient')
  231. ->willReturn($client);
  232. $this->assertTrue(
  233. self::invokePrivate(
  234. $this->checkSetupController,
  235. 'hasInternetConnectivityProblems'
  236. )
  237. );
  238. }
  239. public function testIsMemcacheConfiguredFalse() {
  240. $this->config->expects($this->once())
  241. ->method('getSystemValue')
  242. ->with('memcache.local', null)
  243. ->willReturn(null);
  244. $this->assertFalse(
  245. self::invokePrivate(
  246. $this->checkSetupController,
  247. 'isMemcacheConfigured'
  248. )
  249. );
  250. }
  251. public function testIsMemcacheConfiguredTrue() {
  252. $this->config->expects($this->once())
  253. ->method('getSystemValue')
  254. ->with('memcache.local', null)
  255. ->willReturn('SomeProvider');
  256. $this->assertTrue(
  257. self::invokePrivate(
  258. $this->checkSetupController,
  259. 'isMemcacheConfigured'
  260. )
  261. );
  262. }
  263. public function testIsPhpSupportedFalse() {
  264. $this->checkSetupController
  265. ->expects($this->once())
  266. ->method('isPhpOutdated')
  267. ->willReturn(true);
  268. $this->assertEquals(
  269. ['eol' => true, 'version' => PHP_VERSION],
  270. self::invokePrivate($this->checkSetupController, 'isPhpSupported')
  271. );
  272. }
  273. public function testIsPhpSupportedTrue() {
  274. $this->checkSetupController
  275. ->expects($this->exactly(2))
  276. ->method('isPhpOutdated')
  277. ->willReturn(false);
  278. $this->assertEquals(
  279. ['eol' => false, 'version' => PHP_VERSION],
  280. self::invokePrivate($this->checkSetupController, 'isPhpSupported')
  281. );
  282. $this->assertEquals(
  283. ['eol' => false, 'version' => PHP_VERSION],
  284. self::invokePrivate($this->checkSetupController, 'isPhpSupported')
  285. );
  286. }
  287. /**
  288. * @dataProvider dataForwardedForHeadersWorking
  289. *
  290. * @param array $trustedProxies
  291. * @param string $remoteAddrNotForwarded
  292. * @param string $remoteAddr
  293. * @param bool $result
  294. */
  295. public function testForwardedForHeadersWorking(array $trustedProxies, string $remoteAddrNotForwarded, string $remoteAddr, bool $result) {
  296. $this->config->expects($this->once())
  297. ->method('getSystemValue')
  298. ->with('trusted_proxies', [])
  299. ->willReturn($trustedProxies);
  300. $this->request->expects($this->atLeastOnce())
  301. ->method('getHeader')
  302. ->willReturnMap([
  303. ['REMOTE_ADDR', $remoteAddrNotForwarded],
  304. ['X-Forwarded-Host', '']
  305. ]);
  306. $this->request->expects($this->any())
  307. ->method('getRemoteAddress')
  308. ->willReturn($remoteAddr);
  309. $this->assertEquals(
  310. $result,
  311. self::invokePrivate($this->checkSetupController, 'forwardedForHeadersWorking')
  312. );
  313. }
  314. public function dataForwardedForHeadersWorking() {
  315. return [
  316. // description => trusted proxies, getHeader('REMOTE_ADDR'), getRemoteAddr, expected result
  317. 'no trusted proxies' => [[], '2.2.2.2', '2.2.2.2', true],
  318. 'trusted proxy, remote addr not trusted proxy' => [['1.1.1.1'], '2.2.2.2', '2.2.2.2', true],
  319. 'trusted proxy, remote addr is trusted proxy, x-forwarded-for working' => [['1.1.1.1'], '1.1.1.1', '2.2.2.2', true],
  320. 'trusted proxy, remote addr is trusted proxy, x-forwarded-for not set' => [['1.1.1.1'], '1.1.1.1', '1.1.1.1', false],
  321. ];
  322. }
  323. public function testForwardedHostPresentButTrustedProxiesEmpty() {
  324. $this->config->expects($this->once())
  325. ->method('getSystemValue')
  326. ->with('trusted_proxies', [])
  327. ->willReturn([]);
  328. $this->request->expects($this->atLeastOnce())
  329. ->method('getHeader')
  330. ->willReturnMap([
  331. ['REMOTE_ADDR', '1.1.1.1'],
  332. ['X-Forwarded-Host', 'nextcloud.test']
  333. ]);
  334. $this->request->expects($this->any())
  335. ->method('getRemoteAddress')
  336. ->willReturn('1.1.1.1');
  337. $this->assertEquals(
  338. false,
  339. self::invokePrivate($this->checkSetupController, 'forwardedForHeadersWorking')
  340. );
  341. }
  342. public function testCheck() {
  343. $this->config->expects($this->at(0))
  344. ->method('getAppValue')
  345. ->with('core', 'cronErrors')
  346. ->willReturn('');
  347. $this->config->expects($this->at(2))
  348. ->method('getSystemValue')
  349. ->with('connectivity_check_domains', ['www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org'])
  350. ->willReturn(['www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org']);
  351. $this->config->expects($this->at(3))
  352. ->method('getSystemValue')
  353. ->with('memcache.local', null)
  354. ->willReturn('SomeProvider');
  355. $this->config->expects($this->at(4))
  356. ->method('getSystemValue')
  357. ->with('has_internet_connection', true)
  358. ->willReturn(true);
  359. $this->config->expects($this->at(5))
  360. ->method('getSystemValue')
  361. ->with('appstoreenabled', true)
  362. ->willReturn(false);
  363. $this->request->expects($this->atLeastOnce())
  364. ->method('getHeader')
  365. ->willReturnMap([
  366. ['REMOTE_ADDR', '4.3.2.1'],
  367. ['X-Forwarded-Host', '']
  368. ]);
  369. $client = $this->getMockBuilder('\OCP\Http\Client\IClient')
  370. ->disableOriginalConstructor()->getMock();
  371. $client->expects($this->at(0))
  372. ->method('get')
  373. ->with('http://www.nextcloud.com/', [])
  374. ->will($this->throwException(new \Exception()));
  375. $client->expects($this->at(1))
  376. ->method('get')
  377. ->with('http://www.startpage.com/', [])
  378. ->will($this->throwException(new \Exception()));
  379. $client->expects($this->at(2))
  380. ->method('get')
  381. ->with('http://www.eff.org/', [])
  382. ->will($this->throwException(new \Exception()));
  383. $client->expects($this->at(3))
  384. ->method('get')
  385. ->with('http://www.edri.org/', [])
  386. ->will($this->throwException(new \Exception()));
  387. $this->clientService->expects($this->exactly(4))
  388. ->method('newClient')
  389. ->willReturn($client);
  390. $this->checkSetupController
  391. ->expects($this->once())
  392. ->method('isPhpOutdated')
  393. ->willReturn(true);
  394. $this->checkSetupController
  395. ->expects($this->once())
  396. ->method('isOpcacheProperlySetup')
  397. ->willReturn(false);
  398. $this->checkSetupController
  399. ->method('hasFreeTypeSupport')
  400. ->willReturn(false);
  401. $this->checkSetupController
  402. ->method('hasMissingIndexes')
  403. ->willReturn([]);
  404. $this->checkSetupController
  405. ->method('isSqliteUsed')
  406. ->willReturn(false);
  407. $this->checkSetupController
  408. ->expects($this->once())
  409. ->method('isReadOnlyConfig')
  410. ->willReturn(false);
  411. $this->checkSetupController
  412. ->expects($this->once())
  413. ->method('hasValidTransactionIsolationLevel')
  414. ->willReturn(true);
  415. $this->checkSetupController
  416. ->expects($this->once())
  417. ->method('hasFileinfoInstalled')
  418. ->willReturn(true);
  419. $this->checkSetupController
  420. ->expects($this->once())
  421. ->method('hasOpcacheLoaded')
  422. ->willReturn(true);
  423. $this->checkSetupController
  424. ->expects($this->once())
  425. ->method('hasWorkingFileLocking')
  426. ->willReturn(true);
  427. $this->checkSetupController
  428. ->expects($this->once())
  429. ->method('getSuggestedOverwriteCliURL')
  430. ->willReturn('');
  431. $this->checkSetupController
  432. ->expects($this->once())
  433. ->method('getLastCronInfo')
  434. ->willReturn([
  435. 'diffInSeconds' => 123,
  436. 'relativeTime' => '2 hours ago',
  437. 'backgroundJobsUrl' => 'https://example.org',
  438. ]);
  439. $this->checkSetupController
  440. ->expects($this->once())
  441. ->method('isPHPMailerUsed')
  442. ->willReturn(false);
  443. $this->checker
  444. ->expects($this->once())
  445. ->method('hasPassedCheck')
  446. ->willReturn(true);
  447. $this->memoryInfo
  448. ->method('isMemoryLimitSufficient')
  449. ->willReturn(true);
  450. $this->checkSetupController
  451. ->expects($this->once())
  452. ->method('getAppDirsWithDifferentOwner')
  453. ->willReturn([]);
  454. $this->checkSetupController
  455. ->expects($this->once())
  456. ->method('hasRecommendedPHPModules')
  457. ->willReturn([]);
  458. $this->checkSetupController
  459. ->expects($this->once())
  460. ->method('hasBigIntConversionPendingColumns')
  461. ->willReturn([]);
  462. $this->checkSetupController
  463. ->expects($this->once())
  464. ->method('isMysqlUsedWithoutUTF8MB4')
  465. ->willReturn(false);
  466. $this->checkSetupController
  467. ->expects($this->once())
  468. ->method('isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed')
  469. ->willReturn(true);
  470. $this->urlGenerator->method('linkToDocs')
  471. ->willReturnCallback(function (string $key): string {
  472. if ($key === 'admin-performance') {
  473. return 'http://docs.example.org/server/go.php?to=admin-performance';
  474. }
  475. if ($key === 'admin-security') {
  476. return 'https://docs.example.org/server/8.1/admin_manual/configuration_server/hardening.html';
  477. }
  478. if ($key === 'admin-reverse-proxy') {
  479. return 'reverse-proxy-doc-link';
  480. }
  481. if ($key === 'admin-code-integrity') {
  482. return 'http://docs.example.org/server/go.php?to=admin-code-integrity';
  483. }
  484. if ($key === 'admin-php-opcache') {
  485. return 'http://docs.example.org/server/go.php?to=admin-php-opcache';
  486. }
  487. if ($key === 'admin-db-conversion') {
  488. return 'http://docs.example.org/server/go.php?to=admin-db-conversion';
  489. }
  490. return '';
  491. });
  492. $this->urlGenerator->method('getAbsoluteURL')
  493. ->willReturnCallback(function (string $url): string {
  494. if ($url === 'index.php/settings/admin') {
  495. return 'https://server/index.php/settings/admin';
  496. }
  497. if ($url === 'index.php') {
  498. return 'https://server/index.php';
  499. }
  500. return '';
  501. });
  502. $expected = new DataResponse(
  503. [
  504. 'isGetenvServerWorking' => true,
  505. 'isReadOnlyConfig' => false,
  506. 'hasValidTransactionIsolationLevel' => true,
  507. 'hasFileinfoInstalled' => true,
  508. 'hasWorkingFileLocking' => true,
  509. 'suggestedOverwriteCliURL' => '',
  510. 'cronInfo' => [
  511. 'diffInSeconds' => 123,
  512. 'relativeTime' => '2 hours ago',
  513. 'backgroundJobsUrl' => 'https://example.org',
  514. ],
  515. 'cronErrors' => [],
  516. 'serverHasInternetConnectionProblems' => true,
  517. 'isMemcacheConfigured' => true,
  518. 'memcacheDocs' => 'http://docs.example.org/server/go.php?to=admin-performance',
  519. 'isRandomnessSecure' => self::invokePrivate($this->checkSetupController, 'isRandomnessSecure'),
  520. 'securityDocs' => 'https://docs.example.org/server/8.1/admin_manual/configuration_server/hardening.html',
  521. 'isUsedTlsLibOutdated' => '',
  522. 'phpSupported' => [
  523. 'eol' => true,
  524. 'version' => PHP_VERSION
  525. ],
  526. 'forwardedForHeadersWorking' => true,
  527. 'reverseProxyDocs' => 'reverse-proxy-doc-link',
  528. 'isCorrectMemcachedPHPModuleInstalled' => true,
  529. 'hasPassedCodeIntegrityCheck' => true,
  530. 'codeIntegrityCheckerDocumentation' => 'http://docs.example.org/server/go.php?to=admin-code-integrity',
  531. 'isOpcacheProperlySetup' => false,
  532. 'hasOpcacheLoaded' => true,
  533. 'phpOpcacheDocumentation' => 'http://docs.example.org/server/go.php?to=admin-php-opcache',
  534. 'isSettimelimitAvailable' => true,
  535. 'hasFreeTypeSupport' => false,
  536. 'isSqliteUsed' => false,
  537. 'databaseConversionDocumentation' => 'http://docs.example.org/server/go.php?to=admin-db-conversion',
  538. 'missingIndexes' => [],
  539. 'missingColumns' => [],
  540. 'isPHPMailerUsed' => false,
  541. 'mailSettingsDocumentation' => 'https://server/index.php/settings/admin',
  542. 'isMemoryLimitSufficient' => true,
  543. 'appDirsWithDifferentOwner' => [],
  544. 'recommendedPHPModules' => [],
  545. 'pendingBigIntConversionColumns' => [],
  546. 'isMysqlUsedWithoutUTF8MB4' => false,
  547. 'isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed' => true,
  548. 'reverseProxyGeneratedURL' => 'https://server/index.php',
  549. ]
  550. );
  551. $this->assertEquals($expected, $this->checkSetupController->check());
  552. }
  553. public function testIsPHPMailerUsed() {
  554. $checkSetupController = $this->getMockBuilder(CheckSetupController::class)
  555. ->setConstructorArgs([
  556. 'settings',
  557. $this->request,
  558. $this->config,
  559. $this->clientService,
  560. $this->urlGenerator,
  561. $this->l10n,
  562. $this->checker,
  563. $this->logger,
  564. $this->dispatcher,
  565. $this->db,
  566. $this->lockingProvider,
  567. $this->dateTimeFormatter,
  568. $this->memoryInfo,
  569. $this->secureRandom,
  570. ])
  571. ->setMethods(null)->getMock();
  572. $this->config->expects($this->at(0))
  573. ->method('getSystemValue')
  574. ->with('mail_smtpmode', 'smtp')
  575. ->willReturn('php');
  576. $this->config->expects($this->at(1))
  577. ->method('getSystemValue')
  578. ->with('mail_smtpmode', 'smtp')
  579. ->willReturn('not-php');
  580. $this->assertTrue($this->invokePrivate($checkSetupController, 'isPHPMailerUsed'));
  581. $this->assertFalse($this->invokePrivate($checkSetupController, 'isPHPMailerUsed'));
  582. }
  583. public function testGetCurlVersion() {
  584. $checkSetupController = $this->getMockBuilder(CheckSetupController::class)
  585. ->setConstructorArgs([
  586. 'settings',
  587. $this->request,
  588. $this->config,
  589. $this->clientService,
  590. $this->urlGenerator,
  591. $this->l10n,
  592. $this->checker,
  593. $this->logger,
  594. $this->dispatcher,
  595. $this->db,
  596. $this->lockingProvider,
  597. $this->dateTimeFormatter,
  598. $this->memoryInfo,
  599. $this->secureRandom,
  600. ])
  601. ->setMethods(null)->getMock();
  602. $this->assertArrayHasKey('ssl_version', $this->invokePrivate($checkSetupController, 'getCurlVersion'));
  603. }
  604. public function testIsUsedTlsLibOutdatedWithAnotherLibrary() {
  605. $this->config->expects($this->any())
  606. ->method('getSystemValue')
  607. ->willReturn(true);
  608. $this->checkSetupController
  609. ->expects($this->once())
  610. ->method('getCurlVersion')
  611. ->willReturn(['ssl_version' => 'SSLlib']);
  612. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  613. }
  614. public function testIsUsedTlsLibOutdatedWithMisbehavingCurl() {
  615. $this->config->expects($this->any())
  616. ->method('getSystemValue')
  617. ->willReturn(true);
  618. $this->checkSetupController
  619. ->expects($this->once())
  620. ->method('getCurlVersion')
  621. ->willReturn([]);
  622. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  623. }
  624. public function testIsUsedTlsLibOutdatedWithOlderOpenSsl() {
  625. $this->config->expects($this->any())
  626. ->method('getSystemValue')
  627. ->willReturn(true);
  628. $this->checkSetupController
  629. ->expects($this->once())
  630. ->method('getCurlVersion')
  631. ->willReturn(['ssl_version' => 'OpenSSL/1.0.1c']);
  632. $this->assertSame('cURL is using an outdated OpenSSL version (OpenSSL/1.0.1c). Please update your operating system or features such as installing and updating apps via the app store or Federated Cloud Sharing will not work reliably.', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  633. }
  634. public function testIsUsedTlsLibOutdatedWithOlderOpenSslAndWithoutAppstore() {
  635. $this->config
  636. ->expects($this->at(0))
  637. ->method('getSystemValue')
  638. ->with('has_internet_connection', true)
  639. ->willReturn(true);
  640. $this->checkSetupController
  641. ->expects($this->once())
  642. ->method('getCurlVersion')
  643. ->willReturn(['ssl_version' => 'OpenSSL/1.0.1c']);
  644. $this->assertSame('cURL is using an outdated OpenSSL version (OpenSSL/1.0.1c). Please update your operating system or features such as Federated Cloud Sharing will not work reliably.', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  645. }
  646. public function testIsUsedTlsLibOutdatedWithOlderOpenSsl1() {
  647. $this->config->expects($this->any())
  648. ->method('getSystemValue')
  649. ->willReturn(true);
  650. $this->checkSetupController
  651. ->expects($this->once())
  652. ->method('getCurlVersion')
  653. ->willReturn(['ssl_version' => 'OpenSSL/1.0.2a']);
  654. $this->assertSame('cURL is using an outdated OpenSSL version (OpenSSL/1.0.2a). Please update your operating system or features such as installing and updating apps via the app store or Federated Cloud Sharing will not work reliably.', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  655. }
  656. public function testIsUsedTlsLibOutdatedWithMatchingOpenSslVersion() {
  657. $this->config->expects($this->any())
  658. ->method('getSystemValue')
  659. ->willReturn(true);
  660. $this->checkSetupController
  661. ->expects($this->once())
  662. ->method('getCurlVersion')
  663. ->willReturn(['ssl_version' => 'OpenSSL/1.0.1d']);
  664. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  665. }
  666. public function testIsUsedTlsLibOutdatedWithMatchingOpenSslVersion1() {
  667. $this->config->expects($this->any())
  668. ->method('getSystemValue')
  669. ->willReturn(true);
  670. $this->checkSetupController
  671. ->expects($this->once())
  672. ->method('getCurlVersion')
  673. ->willReturn(['ssl_version' => 'OpenSSL/1.0.2b']);
  674. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  675. }
  676. /**
  677. * Setups a temp directory and some subdirectories.
  678. * Then calls the 'getAppDirsWithDifferentOwner' method.
  679. * The result is expected to be empty since
  680. * there are no directories with different owners than the current user.
  681. *
  682. * @return void
  683. */
  684. public function testAppDirectoryOwnersOk() {
  685. $tempDir = tempnam(sys_get_temp_dir(), 'apps') . 'dir';
  686. mkdir($tempDir);
  687. mkdir($tempDir . DIRECTORY_SEPARATOR . 'app1');
  688. mkdir($tempDir . DIRECTORY_SEPARATOR . 'app2');
  689. $this->dirsToRemove[] = $tempDir . DIRECTORY_SEPARATOR . 'app1';
  690. $this->dirsToRemove[] = $tempDir . DIRECTORY_SEPARATOR . 'app2';
  691. $this->dirsToRemove[] = $tempDir;
  692. OC::$APPSROOTS = [
  693. [
  694. 'path' => $tempDir,
  695. 'url' => '/apps',
  696. 'writable' => true,
  697. ],
  698. ];
  699. $this->assertSame(
  700. [],
  701. $this->invokePrivate($this->checkSetupController, 'getAppDirsWithDifferentOwner')
  702. );
  703. }
  704. /**
  705. * Calls the check for a none existing app root that is marked as not writable.
  706. * It's expected that no error happens since the check shouldn't apply.
  707. *
  708. * @return void
  709. */
  710. public function testAppDirectoryOwnersNotWritable() {
  711. $tempDir = tempnam(sys_get_temp_dir(), 'apps') . 'dir';
  712. OC::$APPSROOTS = [
  713. [
  714. 'path' => $tempDir,
  715. 'url' => '/apps',
  716. 'writable' => false,
  717. ],
  718. ];
  719. $this->assertSame(
  720. [],
  721. $this->invokePrivate($this->checkSetupController, 'getAppDirsWithDifferentOwner')
  722. );
  723. }
  724. public function testIsBuggyNss400() {
  725. $this->config->expects($this->any())
  726. ->method('getSystemValue')
  727. ->willReturn(true);
  728. $this->checkSetupController
  729. ->expects($this->once())
  730. ->method('getCurlVersion')
  731. ->willReturn(['ssl_version' => 'NSS/1.0.2b']);
  732. $client = $this->getMockBuilder('\OCP\Http\Client\IClient')
  733. ->disableOriginalConstructor()->getMock();
  734. $exception = $this->getMockBuilder('\GuzzleHttp\Exception\ClientException')
  735. ->disableOriginalConstructor()->getMock();
  736. $response = $this->getMockBuilder(ResponseInterface::class)
  737. ->disableOriginalConstructor()->getMock();
  738. $response->expects($this->once())
  739. ->method('getStatusCode')
  740. ->willReturn(400);
  741. $exception->expects($this->once())
  742. ->method('getResponse')
  743. ->willReturn($response);
  744. $client->expects($this->at(0))
  745. ->method('get')
  746. ->with('https://nextcloud.com/', [])
  747. ->will($this->throwException($exception));
  748. $this->clientService->expects($this->once())
  749. ->method('newClient')
  750. ->willReturn($client);
  751. $this->assertSame('cURL is using an outdated NSS version (NSS/1.0.2b). Please update your operating system or features such as installing and updating apps via the app store or Federated Cloud Sharing will not work reliably.', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  752. }
  753. public function testIsBuggyNss200() {
  754. $this->config->expects($this->any())
  755. ->method('getSystemValue')
  756. ->willReturn(true);
  757. $this->checkSetupController
  758. ->expects($this->once())
  759. ->method('getCurlVersion')
  760. ->willReturn(['ssl_version' => 'NSS/1.0.2b']);
  761. $client = $this->getMockBuilder('\OCP\Http\Client\IClient')
  762. ->disableOriginalConstructor()->getMock();
  763. $exception = $this->getMockBuilder('\GuzzleHttp\Exception\ClientException')
  764. ->disableOriginalConstructor()->getMock();
  765. $response = $this->getMockBuilder(ResponseInterface::class)
  766. ->disableOriginalConstructor()->getMock();
  767. $response->expects($this->once())
  768. ->method('getStatusCode')
  769. ->willReturn(200);
  770. $exception->expects($this->once())
  771. ->method('getResponse')
  772. ->willReturn($response);
  773. $client->expects($this->at(0))
  774. ->method('get')
  775. ->with('https://nextcloud.com/', [])
  776. ->will($this->throwException($exception));
  777. $this->clientService->expects($this->once())
  778. ->method('newClient')
  779. ->willReturn($client);
  780. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  781. }
  782. public function testIsUsedTlsLibOutdatedWithInternetDisabled() {
  783. $this->config
  784. ->expects($this->at(0))
  785. ->method('getSystemValue')
  786. ->with('has_internet_connection', true)
  787. ->willReturn(false);
  788. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  789. }
  790. public function testIsUsedTlsLibOutdatedWithAppstoreDisabledAndServerToServerSharingEnabled() {
  791. $this->config
  792. ->expects($this->at(0))
  793. ->method('getSystemValue')
  794. ->with('has_internet_connection', true)
  795. ->willReturn(true);
  796. $this->config
  797. ->expects($this->at(1))
  798. ->method('getSystemValue')
  799. ->with('appstoreenabled', true)
  800. ->willReturn(false);
  801. $this->config
  802. ->expects($this->at(2))
  803. ->method('getAppValue')
  804. ->with('files_sharing', 'outgoing_server2server_share_enabled', 'yes')
  805. ->willReturn('no');
  806. $this->config
  807. ->expects($this->at(3))
  808. ->method('getAppValue')
  809. ->with('files_sharing', 'incoming_server2server_share_enabled', 'yes')
  810. ->willReturn('yes');
  811. $this->checkSetupController
  812. ->expects($this->once())
  813. ->method('getCurlVersion')
  814. ->willReturn([]);
  815. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  816. }
  817. public function testIsUsedTlsLibOutdatedWithAppstoreDisabledAndServerToServerSharingDisabled() {
  818. $this->config
  819. ->expects($this->at(0))
  820. ->method('getSystemValue')
  821. ->with('has_internet_connection', true)
  822. ->willReturn(true);
  823. $this->config
  824. ->expects($this->at(1))
  825. ->method('getSystemValue')
  826. ->with('appstoreenabled', true)
  827. ->willReturn(false);
  828. $this->config
  829. ->expects($this->at(2))
  830. ->method('getAppValue')
  831. ->with('files_sharing', 'outgoing_server2server_share_enabled', 'yes')
  832. ->willReturn('no');
  833. $this->config
  834. ->expects($this->at(3))
  835. ->method('getAppValue')
  836. ->with('files_sharing', 'incoming_server2server_share_enabled', 'yes')
  837. ->willReturn('no');
  838. $this->checkSetupController
  839. ->expects($this->never())
  840. ->method('getCurlVersion')
  841. ->willReturn([]);
  842. $this->assertSame('', $this->invokePrivate($this->checkSetupController, 'isUsedTlsLibOutdated'));
  843. }
  844. public function testRescanFailedIntegrityCheck() {
  845. $this->checker
  846. ->expects($this->once())
  847. ->method('runInstanceVerification');
  848. $this->urlGenerator
  849. ->expects($this->once())
  850. ->method('linkToRoute')
  851. ->with('settings.AdminSettings.index')
  852. ->willReturn('/admin');
  853. $expected = new RedirectResponse('/admin');
  854. $this->assertEquals($expected, $this->checkSetupController->rescanFailedIntegrityCheck());
  855. }
  856. public function testGetFailedIntegrityCheckDisabled() {
  857. $this->checker
  858. ->expects($this->once())
  859. ->method('isCodeCheckEnforced')
  860. ->willReturn(false);
  861. $expected = new DataDisplayResponse('Integrity checker has been disabled. Integrity cannot be verified.');
  862. $this->assertEquals($expected, $this->checkSetupController->getFailedIntegrityCheckFiles());
  863. }
  864. public function testGetFailedIntegrityCheckFilesWithNoErrorsFound() {
  865. $this->checker
  866. ->expects($this->once())
  867. ->method('isCodeCheckEnforced')
  868. ->willReturn(true);
  869. $this->checker
  870. ->expects($this->once())
  871. ->method('getResults')
  872. ->willReturn([]);
  873. $expected = new DataDisplayResponse(
  874. 'No errors have been found.',
  875. Http::STATUS_OK,
  876. [
  877. 'Content-Type' => 'text/plain',
  878. ]
  879. );
  880. $this->assertEquals($expected, $this->checkSetupController->getFailedIntegrityCheckFiles());
  881. }
  882. public function testGetFailedIntegrityCheckFilesWithSomeErrorsFound() {
  883. $this->checker
  884. ->expects($this->once())
  885. ->method('isCodeCheckEnforced')
  886. ->willReturn(true);
  887. $this->checker
  888. ->expects($this->once())
  889. ->method('getResults')
  890. ->willReturn([ 'core' => [ 'EXTRA_FILE' => ['/testfile' => []], 'INVALID_HASH' => [ '/.idea/workspace.xml' => [ 'expected' => 'f1c5e2630d784bc9cb02d5a28f55d6f24d06dae2a0fee685f3c2521b050955d9d452769f61454c9ddfa9c308146ade10546cfa829794448eaffbc9a04a29d216', 'current' => 'ce08bf30bcbb879a18b49239a9bec6b8702f52452f88a9d32142cad8d2494d5735e6bfa0d8642b2762c62ca5be49f9bf4ec231d4a230559d4f3e2c471d3ea094', ], '/lib/private/integritycheck/checker.php' => [ 'expected' => 'c5a03bacae8dedf8b239997901ba1fffd2fe51271d13a00cc4b34b09cca5176397a89fc27381cbb1f72855fa18b69b6f87d7d5685c3b45aee373b09be54742ea', 'current' => '88a3a92c11db91dec1ac3be0e1c87f862c95ba6ffaaaa3f2c3b8f682187c66f07af3a3b557a868342ef4a271218fe1c1e300c478e6c156c5955ed53c40d06585', ], '/settings/controller/checksetupcontroller.php' => [ 'expected' => '3e1de26ce93c7bfe0ede7c19cb6c93cadc010340225b375607a7178812e9de163179b0dc33809f451e01f491d93f6f5aaca7929685d21594cccf8bda732327c4', 'current' => '09563164f9904a837f9ca0b5f626db56c838e5098e0ccc1d8b935f68fa03a25c5ec6f6b2d9e44a868e8b85764dafd1605522b4af8db0ae269d73432e9a01e63a', ], ], ], 'bookmarks' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'dav' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'encryption' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'external' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'federation' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_antivirus' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_drop' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_external' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_pdfviewer' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_sharing' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_trashbin' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_versions' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'files_videoviewer' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'firstrunwizard' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'gitsmart' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'logreader' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature could not get verified.', ], ], 'password_policy' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => 'Signature data not found.', ], ], 'provisioning_api' => [ 'EXCEPTION' => [ 'class' => 'OC\\IntegrityCheck\\Exceptions\\InvalidSignatureException', 'message' => '
  891. $expected = new DataDisplayResponse(
  892. 'Technical information
  893. =====================
  894. The following list covers which files have failed the integrity check. Please read
  895. the previous linked documentation to learn more about the errors and how to fix
  896. them.
  897. Results
  898. =======
  899. - core
  900. - EXTRA_FILE
  901. - /testfile
  902. - INVALID_HASH
  903. - /.idea/workspace.xml
  904. - /lib/private/integritycheck/checker.php
  905. - /settings/controller/checksetupcontroller.php
  906. - bookmarks
  907. - EXCEPTION
  908. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  909. - Signature data not found.
  910. - dav
  911. - EXCEPTION
  912. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  913. - Signature data not found.
  914. - encryption
  915. - EXCEPTION
  916. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  917. - Signature data not found.
  918. - external
  919. - EXCEPTION
  920. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  921. - Signature data not found.
  922. - federation
  923. - EXCEPTION
  924. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  925. - Signature data not found.
  926. - files
  927. - EXCEPTION
  928. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  929. - Signature data not found.
  930. - files_antivirus
  931. - EXCEPTION
  932. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  933. - Signature data not found.
  934. - files_drop
  935. - EXCEPTION
  936. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  937. - Signature data not found.
  938. - files_external
  939. - EXCEPTION
  940. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  941. - Signature data not found.
  942. - files_pdfviewer
  943. - EXCEPTION
  944. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  945. - Signature data not found.
  946. - files_sharing
  947. - EXCEPTION
  948. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  949. - Signature data not found.
  950. - files_trashbin
  951. - EXCEPTION
  952. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  953. - Signature data not found.
  954. - files_versions
  955. - EXCEPTION
  956. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  957. - Signature data not found.
  958. - files_videoviewer
  959. - EXCEPTION
  960. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  961. - Signature data not found.
  962. - firstrunwizard
  963. - EXCEPTION
  964. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  965. - Signature data not found.
  966. - gitsmart
  967. - EXCEPTION
  968. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  969. - Signature data not found.
  970. - logreader
  971. - EXCEPTION
  972. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  973. - Signature could not get verified.
  974. - password_policy
  975. - EXCEPTION
  976. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  977. - Signature data not found.
  978. - provisioning_api
  979. - EXCEPTION
  980. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  981. - Signature data not found.
  982. - sketch
  983. - EXCEPTION
  984. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  985. - Signature data not found.
  986. - threatblock
  987. - EXCEPTION
  988. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  989. - Signature data not found.
  990. - two_factor_auth
  991. - EXCEPTION
  992. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  993. - Signature data not found.
  994. - user_ldap
  995. - EXCEPTION
  996. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  997. - Signature data not found.
  998. - user_shibboleth
  999. - EXCEPTION
  1000. - OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1001. - Signature data not found.
  1002. Raw output
  1003. ==========
  1004. Array
  1005. (
  1006. [core] => Array
  1007. (
  1008. [EXTRA_FILE] => Array
  1009. (
  1010. [/testfile] => Array
  1011. (
  1012. )
  1013. )
  1014. [INVALID_HASH] => Array
  1015. (
  1016. [/.idea/workspace.xml] => Array
  1017. (
  1018. [expected] => f1c5e2630d784bc9cb02d5a28f55d6f24d06dae2a0fee685f3c2521b050955d9d452769f61454c9ddfa9c308146ade10546cfa829794448eaffbc9a04a29d216
  1019. [current] => ce08bf30bcbb879a18b49239a9bec6b8702f52452f88a9d32142cad8d2494d5735e6bfa0d8642b2762c62ca5be49f9bf4ec231d4a230559d4f3e2c471d3ea094
  1020. )
  1021. [/lib/private/integritycheck/checker.php] => Array
  1022. (
  1023. [expected] => c5a03bacae8dedf8b239997901ba1fffd2fe51271d13a00cc4b34b09cca5176397a89fc27381cbb1f72855fa18b69b6f87d7d5685c3b45aee373b09be54742ea
  1024. [current] => 88a3a92c11db91dec1ac3be0e1c87f862c95ba6ffaaaa3f2c3b8f682187c66f07af3a3b557a868342ef4a271218fe1c1e300c478e6c156c5955ed53c40d06585
  1025. )
  1026. [/settings/controller/checksetupcontroller.php] => Array
  1027. (
  1028. [expected] => 3e1de26ce93c7bfe0ede7c19cb6c93cadc010340225b375607a7178812e9de163179b0dc33809f451e01f491d93f6f5aaca7929685d21594cccf8bda732327c4
  1029. [current] => 09563164f9904a837f9ca0b5f626db56c838e5098e0ccc1d8b935f68fa03a25c5ec6f6b2d9e44a868e8b85764dafd1605522b4af8db0ae269d73432e9a01e63a
  1030. )
  1031. )
  1032. )
  1033. [bookmarks] => Array
  1034. (
  1035. [EXCEPTION] => Array
  1036. (
  1037. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1038. [message] => Signature data not found.
  1039. )
  1040. )
  1041. [dav] => Array
  1042. (
  1043. [EXCEPTION] => Array
  1044. (
  1045. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1046. [message] => Signature data not found.
  1047. )
  1048. )
  1049. [encryption] => Array
  1050. (
  1051. [EXCEPTION] => Array
  1052. (
  1053. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1054. [message] => Signature data not found.
  1055. )
  1056. )
  1057. [external] => Array
  1058. (
  1059. [EXCEPTION] => Array
  1060. (
  1061. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1062. [message] => Signature data not found.
  1063. )
  1064. )
  1065. [federation] => Array
  1066. (
  1067. [EXCEPTION] => Array
  1068. (
  1069. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1070. [message] => Signature data not found.
  1071. )
  1072. )
  1073. [files] => Array
  1074. (
  1075. [EXCEPTION] => Array
  1076. (
  1077. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1078. [message] => Signature data not found.
  1079. )
  1080. )
  1081. [files_antivirus] => Array
  1082. (
  1083. [EXCEPTION] => Array
  1084. (
  1085. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1086. [message] => Signature data not found.
  1087. )
  1088. )
  1089. [files_drop] => Array
  1090. (
  1091. [EXCEPTION] => Array
  1092. (
  1093. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1094. [message] => Signature data not found.
  1095. )
  1096. )
  1097. [files_external] => Array
  1098. (
  1099. [EXCEPTION] => Array
  1100. (
  1101. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1102. [message] => Signature data not found.
  1103. )
  1104. )
  1105. [files_pdfviewer] => Array
  1106. (
  1107. [EXCEPTION] => Array
  1108. (
  1109. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1110. [message] => Signature data not found.
  1111. )
  1112. )
  1113. [files_sharing] => Array
  1114. (
  1115. [EXCEPTION] => Array
  1116. (
  1117. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1118. [message] => Signature data not found.
  1119. )
  1120. )
  1121. [files_trashbin] => Array
  1122. (
  1123. [EXCEPTION] => Array
  1124. (
  1125. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1126. [message] => Signature data not found.
  1127. )
  1128. )
  1129. [files_versions] => Array
  1130. (
  1131. [EXCEPTION] => Array
  1132. (
  1133. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1134. [message] => Signature data not found.
  1135. )
  1136. )
  1137. [files_videoviewer] => Array
  1138. (
  1139. [EXCEPTION] => Array
  1140. (
  1141. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1142. [message] => Signature data not found.
  1143. )
  1144. )
  1145. [firstrunwizard] => Array
  1146. (
  1147. [EXCEPTION] => Array
  1148. (
  1149. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1150. [message] => Signature data not found.
  1151. )
  1152. )
  1153. [gitsmart] => Array
  1154. (
  1155. [EXCEPTION] => Array
  1156. (
  1157. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1158. [message] => Signature data not found.
  1159. )
  1160. )
  1161. [logreader] => Array
  1162. (
  1163. [EXCEPTION] => Array
  1164. (
  1165. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1166. [message] => Signature could not get verified.
  1167. )
  1168. )
  1169. [password_policy] => Array
  1170. (
  1171. [EXCEPTION] => Array
  1172. (
  1173. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1174. [message] => Signature data not found.
  1175. )
  1176. )
  1177. [provisioning_api] => Array
  1178. (
  1179. [EXCEPTION] => Array
  1180. (
  1181. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1182. [message] => Signature data not found.
  1183. )
  1184. )
  1185. [sketch] => Array
  1186. (
  1187. [EXCEPTION] => Array
  1188. (
  1189. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1190. [message] => Signature data not found.
  1191. )
  1192. )
  1193. [threatblock] => Array
  1194. (
  1195. [EXCEPTION] => Array
  1196. (
  1197. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1198. [message] => Signature data not found.
  1199. )
  1200. )
  1201. [two_factor_auth] => Array
  1202. (
  1203. [EXCEPTION] => Array
  1204. (
  1205. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1206. [message] => Signature data not found.
  1207. )
  1208. )
  1209. [user_ldap] => Array
  1210. (
  1211. [EXCEPTION] => Array
  1212. (
  1213. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1214. [message] => Signature data not found.
  1215. )
  1216. )
  1217. [user_shibboleth] => Array
  1218. (
  1219. [EXCEPTION] => Array
  1220. (
  1221. [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
  1222. [message] => Signature data not found.
  1223. )
  1224. )
  1225. )
  1226. ',
  1227. Http::STATUS_OK,
  1228. [
  1229. 'Content-Type' => 'text/plain',
  1230. ]
  1231. );
  1232. $this->assertEquals($expected, $this->checkSetupController->getFailedIntegrityCheckFiles());
  1233. }
  1234. public function dataForIsMysqlUsedWithoutUTF8MB4() {
  1235. return [
  1236. ['sqlite', false, false],
  1237. ['sqlite', true, false],
  1238. ['postgres', false, false],
  1239. ['postgres', true, false],
  1240. ['oci', false, false],
  1241. ['oci', true, false],
  1242. ['mysql', false, true],
  1243. ['mysql', true, false],
  1244. ];
  1245. }
  1246. /**
  1247. * @dataProvider dataForIsMysqlUsedWithoutUTF8MB4
  1248. */
  1249. public function testIsMysqlUsedWithoutUTF8MB4(string $db, bool $useUTF8MB4, bool $expected) {
  1250. $this->config->method('getSystemValue')
  1251. ->willReturnCallback(function ($key, $default) use ($db, $useUTF8MB4) {
  1252. if ($key === 'dbtype') {
  1253. return $db;
  1254. }
  1255. if ($key === 'mysql.utf8mb4') {
  1256. return $useUTF8MB4;
  1257. }
  1258. return $default;
  1259. });
  1260. $checkSetupController = new CheckSetupController(
  1261. 'settings',
  1262. $this->request,
  1263. $this->config,
  1264. $this->clientService,
  1265. $this->urlGenerator,
  1266. $this->l10n,
  1267. $this->checker,
  1268. $this->logger,
  1269. $this->dispatcher,
  1270. $this->db,
  1271. $this->lockingProvider,
  1272. $this->dateTimeFormatter,
  1273. $this->memoryInfo,
  1274. $this->secureRandom
  1275. );
  1276. $this->assertSame($expected, $this->invokePrivate($checkSetupController, 'isMysqlUsedWithoutUTF8MB4'));
  1277. }
  1278. public function dataForIsEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed() {
  1279. return [
  1280. ['singlebucket', 'OC\\Files\\ObjectStore\\Swift', true],
  1281. ['multibucket', 'OC\\Files\\ObjectStore\\Swift', true],
  1282. ['singlebucket', 'OC\\Files\\ObjectStore\\Custom', true],
  1283. ['multibucket', 'OC\Files\\ObjectStore\\Custom', true],
  1284. ['singlebucket', 'OC\Files\ObjectStore\Swift', true],
  1285. ['multibucket', 'OC\Files\ObjectStore\Swift', true],
  1286. ['singlebucket', 'OC\Files\ObjectStore\Custom', true],
  1287. ['multibucket', 'OC\Files\ObjectStore\Custom', true],
  1288. ];
  1289. }
  1290. /**
  1291. * @dataProvider dataForIsEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed
  1292. */
  1293. public function testIsEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed(string $mode, string $className, bool $expected) {
  1294. $this->config->method('getSystemValue')
  1295. ->willReturnCallback(function ($key, $default) use ($mode, $className) {
  1296. if ($key === 'objectstore' && $mode === 'singlebucket') {
  1297. return ['class' => $className];
  1298. }
  1299. if ($key === 'objectstore_multibucket' && $mode === 'multibucket') {
  1300. return ['class' => $className];
  1301. }
  1302. return $default;
  1303. });
  1304. $checkSetupController = new CheckSetupController(
  1305. 'settings',
  1306. $this->request,
  1307. $this->config,
  1308. $this->clientService,
  1309. $this->urlGenerator,
  1310. $this->l10n,
  1311. $this->checker,
  1312. $this->logger,
  1313. $this->dispatcher,
  1314. $this->db,
  1315. $this->lockingProvider,
  1316. $this->dateTimeFormatter,
  1317. $this->memoryInfo,
  1318. $this->secureRandom
  1319. );
  1320. $this->assertSame($expected, $this->invokePrivate($checkSetupController, 'isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed'));
  1321. }
  1322. }