https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35837
--- Comment #17 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 206271 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206271&action=edit Bug 35837: Add a verified, restriction-aware install path for plugin-store plugins Adds Koha::Plugins::Store (queries the plugin-store's public discovery API by kpz_url or digest for a plugin's origin repo and certification level) and Koha::Plugins::Install (a single validate-then-install routine other code paths can share). Install.pm enforces, in order: * the existing plugins_restricted org-allowlist, exactly as the legacy plugins-upload.pl path already did -- closing a gap where the plugin-store path didn't apply the same restriction * PluginStoreMinimumLevel (new system preference): rejects a version below the site's chosen certification tier, when the plugin-store recognises it * Ed25519 signature verification against the store's public key (koha-conf.xml's new plugin_store_public_key_file), confirming the .kpz hasn't been altered since the store inspected it. An unsigned file (no plugin-store record at all -- a private/in-house plugin, or one published before the store supported signing) is rejected unless the caller explicitly confirms, via a new plugins_allow_unsigned koha-conf.xml flag plus a per-install confirm_unsigned flag Nothing calls this yet -- see the following commits for the REST API and UI that do. No standalone test plan: this is a library layer with no UI of its own. See `prove t/Koha/Plugins/Install.t t/Koha/Plugins/Store.t` for unit coverage, and the plugin manager UI test plan two commits over for end-to-end verification. Co-Authored-By: Claude Sonnet 5 <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
