#21: Add signature validation during installations [partial]

public/electron.js

@@ -16,6 +16,7 @@ require.extensions['.sh'] = function (module, filename) {
   module.exports = fs.readFileSync(filename, 'utf8');
 };
 const detectScript = require('./detect_linux.sh');
+const installScript = require('./update_linux.sh');
 const publicKey =
   '-----BEGIN PUBLIC KEY-----\n' +
   'MIIEIjANBgkqhkiG9w0BAQEFAAOCBA8AMIIECgKCBAEKfZmq5mMAtD4kSt2Gc/5J\n' +
@@ -718,53 +719,63 @@ ipcMain.on(Constants.IPC_Install_Upgrade, (event, data) => {
     }
   };
 
-  if (os.platform() === 'win32') {
-    const executeInstall = () => {
-      helpers
-      .executeAsync(data.Source)
-      .then(() => {
-        cleanupFiles();
-        closeApplication();
-      })
-      .catch(error => {
-        cleanupFiles();
-        standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
-          Source: data.Source,
-        }, error);
-      });
-    };
-    if (hasSignature) {
-      helpers
-      .verifySignature(data.Source, tempSig, tempPub)
-      .then(() => {
-        executeInstall();
-      })
-      .catch(() => {
-        cleanupFiles();
-        standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
-          Source: data.Source,
-        }, 'Failed to verify installation package signature');
-      });
-    } else { // TODO Check Sha256
-      executeInstall();
+  let command;
+  let args;
+  const platform = os.platform();
+  if (platform === 'win32') {
+    command = data.Source;
+  } else if (platform === 'darwin') {
+    command = 'open';
+    args = ['-a', 'Finder', data.Source];
+  } else if (platform === 'linux') {
+    try {
+      const execPath = path.join(os.tmpdir(), 'install_linux.sh');
+      fs.writeFileSync(execPath, installScript);
+      fs.chmodSync(execPath, '750');
+      command = execPath;
+      args = [data.Source];
+    } catch (e) {
+      cleanupFiles();
+      standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
+        Source: data.Source,
+      }, e);
     }
-  } else if (data.Source.toLocaleLowerCase().endsWith('.dmg')) {
+  } else {
+    cleanupFiles();
+    standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
+      Source: data.Source,
+    }, Error('Platform not supported: ' + os.platform()));
+  }
+
+  if (command) {
     const executeInstall = () => {
       helpers
-      .executeAsync('open', ['-a', 'Finder', data.Source])
-      .then(() => {
-        cleanupFiles();
-        closeApplication();
-      })
-      .catch(error => {
-        cleanupFiles();
-        standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
-          Source: data.Source,
-        }, error);
-      });
+        .executeAsync(command, args)
+        .then(() => {
+          cleanupFiles();
+          closeApplication();
+        })
+        .catch(error => {
+          cleanupFiles();
+          standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
+            Source: data.Source,
+          }, error);
+        });
     };
 
-    if (hasHash) {
+    if (hasSignature) {
+      helpers
+        .verifySignature(data.Source, tempSig, tempPub)
+        .then(() => {
+          executeInstall();
+        })
+        .catch(() => {
+          cleanupFiles();
+          standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
+            Source: data.Source,
+          }, 'Failed to verify installation package signature');
+        });
+    } else if (hasHash) {
       helpers
         .verifyHash(data.Source, data.Sha256)
         .then(()=> {
@@ -779,22 +790,6 @@ ipcMain.on(Constants.IPC_Install_Upgrade, (event, data) => {
     } else {
       executeInstall();
     }
-  } else if (data.Source.toLocaleLowerCase().endsWith('.appimage')) {
-    cleanupFiles();
-    standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
-      Source: data.Source,
-    }, Error('Not implemented upgrade: ' + data.Source));
-    // TODO Generate and execute script with delay
-    /*helpers
-      .executeAsync(data.Source)
-      .then(() => {
-        closeApplication();
-      })
-      .catch(error => {
-        standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {
-          Source: data.Source,
-        }, error);
-      });*/
   } else {
     cleanupFiles();
     standardIPCReply(event, Constants.IPC_Install_Upgrade_Reply, {

public/update_linux.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+sleep 5
+chmod +x "$1"
+"$1"&
+
+sleep 1
+rm -f "$0"