|
|
@ -27,7 +27,10 @@ |
|
|
|
;; Cakelisp |
|
|
|
"FileUtilities.cake" "CHelpers.cake" |
|
|
|
;; GameLib |
|
|
|
"Introspection.cake" "DynamicArray.cake" "Curl.cake" "Cryptography.cake") |
|
|
|
"Introspection.cake" "DynamicArray.cake" "Curl.cake" "Cryptography.cake" "Compression.cake" |
|
|
|
"FileSystem.cake") |
|
|
|
|
|
|
|
(c-import &with-decls "<stddef.h>") |
|
|
|
|
|
|
|
(def-introspect-struct auto-update-download |
|
|
|
operating-system ([] 32 char) |
|
|
@ -82,16 +85,19 @@ |
|
|
|
(defun auto-update-download-and-verify-signature (curl (* CURL) |
|
|
|
url (* (const char)) |
|
|
|
public-key (* (unsigned char)) |
|
|
|
verified-payload-out (* (* (unsigned char))) |
|
|
|
verified-payload-out-size (* (unsigned (long long))) |
|
|
|
&return bool) |
|
|
|
(set (deref verified-payload-out-size) 0) |
|
|
|
(var result-buffer (* char) null) |
|
|
|
(unless (curl-download-into-dynarray curl url (addr result-buffer)) |
|
|
|
(dynarray-free result-buffer) |
|
|
|
(return false)) |
|
|
|
|
|
|
|
;; This will contain the extra bytes from the signature, which is wasted, but minimal |
|
|
|
(var-cast-to verified-payload (* (unsigned char)) (malloc (dynarray-length result-buffer))) |
|
|
|
(var verified-payload-length (unsigned (long long))) |
|
|
|
(unless (= 0 (crypto_sign_open verified-payload (addr verified-payload-length) |
|
|
|
(set (deref verified-payload-out) |
|
|
|
(type-cast (malloc (dynarray-length result-buffer)) (* (unsigned char)))) |
|
|
|
(unless (= 0 (crypto_sign_open (deref verified-payload-out) verified-payload-out-size |
|
|
|
(type-cast result-buffer (* (const (unsigned char)))) |
|
|
|
(dynarray-length result-buffer) |
|
|
|
public-key)) |
|
|
@ -99,8 +105,8 @@ |
|
|
|
appropriately. It will not be used. Either someone messed up, your public key is out of date, or an |
|
|
|
attempt at compromising security occurred and was thwarted by this protection.\n") |
|
|
|
(dynarray-free result-buffer) |
|
|
|
(free (deref verified-payload-out)) |
|
|
|
(return false)) |
|
|
|
(free verified-payload) |
|
|
|
(dynarray-free result-buffer) |
|
|
|
(return true)) |
|
|
|
|
|
|
@ -111,6 +117,9 @@ |
|
|
|
;; These will need to be changed if you want this to work for you! |
|
|
|
;; Use CryptographyCLI.cake utility to generate your own keys and signed files. You can set up |
|
|
|
;; the .cakedata serving however you want, so long as Curl can download it. |
|
|
|
;; Creating an auto-update file: |
|
|
|
;; zip test.zip TestSerialize.cakedata TestDictionarySerialize.cakedata |
|
|
|
;; ./cryptography-cli create-signed-file test.zip ~/website/updates/Product/Product_Linux-x64.auto-update |
|
|
|
(var macoy-public-key ([] crypto_sign_PUBLICKEYBYTES (unsigned char)) |
|
|
|
(array 0x44 0xb2 0x64 0xe2 0x1b 0x8f 0x1e 0x23 0xc2 0x45 0xfc 0x74 0xa8 0x3c 0x4a 0xe2 0xcd |
|
|
|
0xf6 0x89 0x17 0xbf 0x69 0xf8 0x16 0xb0 0x61 0xc5 0xd5 0xff 0x56 0xae 0xdb)) |
|
|
@ -151,13 +160,30 @@ |
|
|
|
(fprintf stderr "The current platform should download %s\n" |
|
|
|
(? platform-update-url platform-update-url "unknown platform"))) |
|
|
|
|
|
|
|
(unless (auto-update-download-and-verify-signature curl platform-update-url macoy-public-key) |
|
|
|
(var verified-payload (* (unsigned char)) null) |
|
|
|
(var verified-payload-size (unsigned (long long)) 0) |
|
|
|
(unless (auto-update-download-and-verify-signature curl platform-update-url macoy-public-key |
|
|
|
(addr verified-payload) |
|
|
|
(addr verified-payload-size)) |
|
|
|
(free-introspect-struct-fields auto-update-metadata--metadata (addr update-metadata) free) |
|
|
|
(curl_easy_cleanup curl) |
|
|
|
(curl_global_cleanup) |
|
|
|
(return 1)) |
|
|
|
|
|
|
|
(free-introspect-struct-fields auto-update-metadata--metadata (addr update-metadata) free) |
|
|
|
(curl_easy_cleanup curl) |
|
|
|
(curl_global_cleanup) |
|
|
|
|
|
|
|
(var output-directory ([] 1024 char) (array 0)) |
|
|
|
(sprintf output-directory "v%d" (field update-metadata latest-version)) |
|
|
|
(unless (make-directory output-directory) |
|
|
|
(free-introspect-struct-fields auto-update-metadata--metadata (addr update-metadata) free) |
|
|
|
(return 1)) |
|
|
|
(unless (decompress-zip-from-memory-to-files |
|
|
|
verified-payload (type-cast verified-payload-size size_t) |
|
|
|
output-directory) |
|
|
|
(free verified-payload) |
|
|
|
(free-introspect-struct-fields auto-update-metadata--metadata (addr update-metadata) free) |
|
|
|
(return 1)) |
|
|
|
(free verified-payload) |
|
|
|
|
|
|
|
(free-introspect-struct-fields auto-update-metadata--metadata (addr update-metadata) free) |
|
|
|
(return 0)))) |
|
|
|