Skip to content

Conversation

@bruvzg
Copy link
Member

@bruvzg bruvzg commented Nov 4, 2025

Since there are persistent issue with downloading templates from GitHub (see #108952) users might be tempted to download templates from unverified sources. It's good to have a way to verify that templates were not modified and safe to use in the editor itself (it's highly unlikely most user will do it manually, even if hashes for files are provided).

  • This PR adds support for file hashes and signature verification during templates install.

Export templates can be signed by running the following commands in the template folder before zipping it, using RSA key:

sha256sum -b * > .manifest
openssl dgst -sign path/to/private_key.pem -sha256 -out .signature -binary .manifest

Built-in public key(s) for the custom build can be added to editor/export/keys/, it's also possible to add custom keys in runtime, using export/template_trusted_public_keys editor setting.

Unsigned templates can still be installed with an additional warning dialog:

Click me Screenshot 2025-11-04 at 11 27 31

Templates with hash errors, invalid signature or missing/extra files are rejected:

Click me Screenshot 2025-11-04 at 11 27 55

TODO:

  • Update build scripts to sign templates.
  • Update key.

Note: key in this PR is intended for testing only and correspond to the following private key:

Click me
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCYDWNUXLayOrtA
zfpi9UwKHEbz2d+Mb3/i0tAjynuqqqebrwzoMzif/jSbCZEJ649Uk0uq/EOAqxoA
DzvSqhaF2D0RvElSPBy+zKmRyyvbBAkXwf5x1FT8C1Iwg6A7z66ggCXSfYD+oDHT
nS7cPjsZJpZY7VbRzBEIzth5NioYPWDJMUTBuR+BFYjPbLmDW5Mm8QhfzUMlBPWA
PiKaIXwGH5E0f3uT1g9OMfix3q+t7PXpBo7DJT7JSxQp3LW8iKgHBYMLMfrUN3fz
2UwpQp5+kHZ0ASJCH6JQP3VO85QjjbOoTmdVpmAZZHYz1W3MMYujCuTbedPoTe5c
+Xvemva8yX9FyJGSM8EDiJCPaX4ds9KUm9jPZHnTf9aCTkA5L6pK4WU2iyAXRNJf
baOAvkUFSjVHCHAJZWv+on4ubqw4K7RFTBqFeo8O9GOaFk4L9BaChVuAT85BKb55
JP8hOZyWPUGaaWsxOubiOgVSwpCc92EFyk07eHl3q63f89BkDh9vgZjOh43lDwxS
Vaa8+qlV5PUWZhKRJb5GTvybH9hjOPOD4g8Jxrn8zeL79xdAuGanHuuQekKIdS05
wAgtFE5Ka3ETWa6GLGuj6sICj1WFJIksh8z7C8qHV7cPbNPS5Rv5eJFca/nAEcWj
QlyXbnUxZ50lz7YomvbIoz3B2JhyFwIDAQABAoICAAr2/DC7NtmHbrVvpRy5v7AC
9gLjtUE1US2UMjpCgcR+5fNOHkooV28CL9z2RaVHfWCF9rDv3BZNQGS8tH2ukk04
mL7MqyTo/NGthJTk59a1Zcp2zNh8jVxXnKeu9kEZ6ufcFd4l+sVh2/X8ocJ0ImLf
63uiMd6TLq9J60ZiZ4qz8mTPzruBlAoE+Yarun0Ef4oRW588+BiVUPbchDZFL+Jp
KFl2z/yLNTNYWyzIeDa8ncceF/FuoCZ36Y5TQi/EUwmeliKaihH/pgDJrLpU+YT6
+e/HnSbTjSroSJdW7VnbABek/8Knasqp+fQm8fIFqKIrSPGiyWs5I3VE8G/PEPfT
reInVGJXfhP8hvZL3wq5lwuPYlqyEwlwzxSmtvJImc9Aei/fbNEx3adQWlHLwQ8w
mAjNHHRpdkz+ufdWdirFHbAx3D5Edl7p5zSA6WFxpTHGoqiIeBZPQBUPkVEfDonB
ydyP8yUBuurAiTusu/1CRQ3AHWTEQm2pK8KswKJAIkV8K/REAwrOdMdvIXeQ1TTG
W6uiwVkEJ0TZ0AmGdZSFC0t/LLFPkE9NrQntvQ9excsHKDxjPX6ubdaSMyzNfPNj
RJojkmZxjBvZf9jeWbCYKw59ijnjrM8MJVHhBK6RQiDifu/mYk88o84UYZDMtZvq
CktpZ/qteunstXDZx6lRAoIBAQDVFoyV4LBqHb1VnoQZY97yl+rFXHBlJW18Juo2
JIOA1w2rMhkBUcSRG06AMvWrG4ccnUpP4gMCzoOLIPP3SDHEz5foBv/W5d0cpADR
Zi2OT8CncY4vuq7RjGzfuujmkCFu8sZWD7WLemim2+5j6JSvVtJtkbtWAZXpItKi
Ha+j4vjt12F1qzCVTa0+fmPUTvjI4g14ldxHPPA+noAj+CAXIfxmsnxTTfLNva6q
M+PKcCCGuX9XCK+0PMCypkZh2rek5IutfM+PmMm/tC5fSv+Z31u42xihMXKyo/3P
El+ghvziHLbxtskfvD/DNFNG7EGNPKprxiEYVqAnfyzEMMz9AoIBAQC2rDnx4Fnw
ncb6jxaI6ClFFmqneOZlLkpJ3CZZ/7RoSvWV5DopBhU87pQ7Ps7/gbx9lpyQZvDw
Y7Znezv1vQLdmwurHxtuUxnG8yUgL5GH+exz1BtXL7Jyt4CI9OFPRnsSXTfdNG4Y
g72/lKJXF0tvrJizxfYh3KO0YeRyxzwC2sOUpxOV4JotSAWfnP1Dj+dDRKdLCXLP
ig6cgeR2q463qIxwoDyeIJbylcbrqArtd3UZzmvzx+Fsu8RYJgt+5X8L4pThW79I
Sn0gx0gY72LhrT8r2+xHyLWwpYn1zZs/WBf2j2JYcvp4Gezbln07qdZpsfsiwHcE
puhCk7RuZ7GjAoIBAFmqEGQs1O8CLp5tglaQwMrCBCciG6VkF2rrkRhRSwiW9Yh5
Hy5/8r/AhsrJJrjmb3cp9JAioXO35IBR0HbYaSDQ3bHj6BnMRbt8g1+ZqEe+5WlQ
Di2lV1STy2hlZQVH1tmxzKWAHLthOdIkr25Y+t/BH/C9JuAs8KDWZ12SMks7AdZL
EBaMf3gD5IdsdaNry6H0BQkdvkA3szwWRANesForkeLA7jG7lhTe4TV7ejm/7t/i
BGRiIlUsT0WdU/ZvK2F2ThQldc2N1C8XqX+ttlpQM29Yukdx4DqtaOqOZ7DLvHOE
87JIYN86vnXsebJZTcgZo/iPuXNdWCzmhbbUdh0CggEACyyj6sjnl5F/P4qLPVq+
U4yYf6Akr+HSB4yhB/ZdadfUCBRK/oFxwSVzCeDAtt6P0jrpXuf9KydeXBwswc6L
I1U9tH0Vp30L4aC0D7D5PRErxrYd6gpv5xaUlUwtkDTmiGwNY8m2Rmegrtx/xcYW
BkHPoYelk9K0bO9kEyVe5WnOdwR1bUCtDcIPHgFzeLOP2QyVE0EDtfBjDm3ftOav
t0pnNOiIbL/fm/1PitDfwkEBd8+pyOLcRlOCIkZJg7y0NdzpcJO1Ms3js6KdJXFX
Yii/6YXtgUKk4qZttwyZx5ky9hE1WeXGrpwfYhtlk8XC6PpLO4f8f9tZ7+CrM+nB
8wKCAQAMUmm3BhJ33hognMgMsM8QfySj3jTe3x1YqIa9kj1aTnddinnu9O9uf43E
C0QbIvSkcuvbXEzwSVeScjN52UXyovWpEYwU6g1diOkTxMiO003+Q84o5rnKCDy8
EMRTgY+oLfMqxi99mFKRegtJ7Zhbb4vMedbvRFlLC3aVC6knM1D3EuHBaxO5Ox8O
dhCEwloOPQykJ8KxDyXsoexgpsaYu2dxArbVMXZ6Fj1Fd0NJHGO4vvGg7wlXEh1B
lGMBQyjXycpvimR7POj4o9aWcSJd3dOdE+axBktZQ5Na5Mn4zvGIi9WmWSjtq9Tb
rAdxjSdZxE4bIqyfXD3cUusq3rPp
-----END PRIVATE KEY-----

@bruvzg bruvzg added this to the 4.6 milestone Nov 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant