fix: gracefully handle install without signature (#41)

If the `MANIFEST` is missing the `Files.signature` then we first try
looking for `driver + '.sig'` and then error out.

Adds a new CLI argument `--allow-missing-signature` which will allow
installing if the signature is missing.

Author: zeroshade

cmd/dbc/install.go

@@ -3,7 +3,9 @@
 package main
 
 import (
+	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -18,15 +20,17 @@ import (
 
 type InstallCmd struct {
 	// URI    url.URL `arg:"-u" placeholder:"URL" help:"Base URL for fetching drivers"`
-	Driver  string             `arg:"positional,required" help:"Driver to install"`
-	Version *semver.Version    `arg:"-v" help:"Version to install"`
-	Level   config.ConfigLevel `arg:"-l" help:"Config level to install to (user, system)"`
+	Driver   string             `arg:"positional,required" help:"Driver to install"`
+	Version  *semver.Version    `arg:"-v" help:"Version to install"`
+	Level    config.ConfigLevel `arg:"-l" help:"Config level to install to (user, system)"`
+	NoVerify bool               `arg:"--no-verify" help:"Allow installation of drivers without a signature file"`
 }
 
 func (c InstallCmd) GetModelCustom(baseModel baseModel) tea.Model {
 	return progressiveInstallModel{
 		Driver:       c.Driver,
 		VersionInput: c.Version,
+		NoVerify:     c.NoVerify,
 		spinner:      spinner.New(),
 		cfg:          getConfig(c.Level),
 		baseModel:    baseModel,
@@ -39,6 +43,7 @@ func (c InstallCmd) GetModel() tea.Model {
 	return progressiveInstallModel{
 		Driver:       c.Driver,
 		VersionInput: c.Version,
+		NoVerify:     c.NoVerify,
 		spinner:      s,
 		cfg:          getConfig(c.Level),
 		baseModel: baseModel{
@@ -48,8 +53,8 @@ func (c InstallCmd) GetModel() tea.Model {
 	}
 }
 
-func verifySignature(m config.Manifest) error {
-	if m.Files.Driver == "" {
+func verifySignature(m config.Manifest, noVerify bool) error {
+	if m.Files.Driver == "" || (noVerify && m.Files.Signature == "") {
 		return nil
 	}
 
@@ -61,9 +66,17 @@ func verifySignature(m config.Manifest) error {
 	}
 	defer lib.Close()
 
-	sig, err := os.Open(filepath.Join(path, m.Files.Signature))
+	sigFile := m.Files.Signature
+	if sigFile == "" {
+		sigFile = m.Files.Driver + ".sig"
+	}
+
+	sig, err := os.Open(filepath.Join(path, sigFile))
 	if err != nil {
-		return fmt.Errorf("could not open signature file: %w", err)
+		if errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf("signature file '%s' for driver is missing", sigFile)
+		}
+		return fmt.Errorf("failed to open signature file: %w", err)
 	}
 	defer sig.Close()
 
@@ -108,6 +121,7 @@ type progressiveInstallModel struct {
 
 	Driver       string
 	VersionInput *semver.Version
+	NoVerify     bool
 	cfg          config.Config
 
 	DriverPackage      dbc.PkgInfo
@@ -201,7 +215,7 @@ func (m progressiveInstallModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.state = stVerifying
 		m.postInstallMessage = strings.Join(msg.PostInstall.Messages, "\n")
 		return m, func() tea.Msg {
-			if err := verifySignature(msg); err != nil {
+			if err := verifySignature(msg, m.NoVerify); err != nil {
 				return err
 			}
 			return writeDriverManifestMsg{DriverInfo: msg.DriverInfo}

cmd/dbc/install_test.go

@@ -3,6 +3,7 @@
 package main
 
 import (
+	"io/fs"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -126,3 +127,28 @@ func (suite *SubcommandTestSuite) TestInstallManifestOnlyDriver() {
 		suite.FileExists(filepath.Join(suite.tempdir, "test-driver-manifest-only.toml"))
 	}
 }
+
+func (suite *SubcommandTestSuite) TestInstallDriverNoSignature() {
+	m := InstallCmd{Driver: "test-driver-no-sig"}.
+		GetModelCustom(baseModel{getDriverList: getTestDriverList, downloadPkg: downloadTestPkg})
+	out := suite.runCmdErr(m)
+	suite.Contains(out, "signature file 'test-driver-1-not-valid.so.sig' for driver is missing")
+
+	filelist := []string{}
+	suite.NoError(fs.WalkDir(os.DirFS(suite.tempdir), ".", func(path string, d fs.DirEntry, err error) error {
+		if d.IsDir() {
+			return nil
+		}
+
+		filelist = append(filelist, path)
+		return nil
+	}))
+
+	// currently we don't clean out the downloaded file if signature verification fails
+	suite.Equal([]string{"test-driver-no-sig/test-driver-1-not-valid.so"}, filelist)
+
+	m = InstallCmd{Driver: "test-driver-no-sig", NoVerify: true}.
+		GetModelCustom(baseModel{getDriverList: getTestDriverList, downloadPkg: downloadTestPkg})
+	suite.validateOutput("\r[✓] searching\r\n[✓] downloading\r\n[✓] installing\r\n[✓] verifying signature\r\n"+
+		"\r\nInstalled test-driver-no-sig 1.0.0 to "+suite.tempdir+"\r\n", suite.runCmd(m))
+}

cmd/dbc/search.go

@@ -19,8 +19,6 @@ var (
 	nameStyle = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("35"))
 	descStyle = lipgloss.NewStyle().Italic(true)
 	bold      = lipgloss.NewStyle().Bold(true)
-
-	archStyle = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("5"))
 )
 
 type SearchCmd struct {

cmd/dbc/search_test.go

@@ -14,7 +14,8 @@ func (suite *SubcommandTestSuite) TestSearchCmd() {
 			downloadPkg: downloadTestPkg})
 	suite.validateOutput("• test-driver-1 - This is a test driver\r\n"+
 		"• test-driver-2 - This is another test driver\r\n"+
-		"• test-driver-manifest-only - This is manifest-only driver\r\n\r ", suite.runCmd(m))
+		"• test-driver-manifest-only - This is manifest-only driver\r\n"+
+		"• test-driver-no-sig - Driver manifest missing Files.signature entry\r\n\r ", suite.runCmd(m))
 }
 
 func (suite *SubcommandTestSuite) TestSearchCmdWithInstalled() {
@@ -26,7 +27,8 @@ func (suite *SubcommandTestSuite) TestSearchCmdWithInstalled() {
 		baseModel{getDriverList: getTestDriverList,
 			downloadPkg: downloadTestPkg})
 	suite.validateOutput("• test-driver-1 - This is a test driver [installed: env=>1.1.0]\r\n"+
-		"• test-driver-2 - This is another test driver\r\n• test-driver-manifest-only - This is manifest-only driver\r\n\r ", suite.runCmd(m))
+		"• test-driver-2 - This is another test driver\r\n• test-driver-manifest-only - This is manifest-only driver\r\n"+
+		"• test-driver-no-sig - Driver manifest missing Files.signature entry\r\n\r ", suite.runCmd(m))
 }
 
 func (suite *SubcommandTestSuite) TestSearchCmdVerbose() {
@@ -41,6 +43,9 @@ func (suite *SubcommandTestSuite) TestSearchCmdVerbose() {
 		"Available Versions:\r\n    ├── 2.0.0\r\n    ╰── 2.1.0\r\n"+
 		"• test-driver-manifest-only\r\n   Title: Test Driver Manifest Only\r\n   "+
 		"Description: This is manifest-only driver\r\n   License: Apache-2.0\r\n   "+
+		"Available Versions:\r\n    ╰── 1.0.0\r\n"+
+		"• test-driver-no-sig\r\n   Title: Test Driver No Signature\r\n   "+
+		"Description: Driver manifest missing Files.signature entry\r\n   License: Apache-2.0\r\n   "+
 		"Available Versions:\r\n    ╰── 1.0.0\r\n\r ", suite.runCmd(m))
 }
 
@@ -64,5 +69,11 @@ func (suite *SubcommandTestSuite) TestSearchCmdVerboseWithInstalled() {
 		"   Description: This is manifest-only driver\r\n"+
 		"   License: Apache-2.0\r\n"+
 		"   Available Versions:\r\n"+
+		"    ╰── 1.0.0\r\n"+
+		"• test-driver-no-sig\r\n"+
+		"   Title: Test Driver No Signature\r\n"+
+		"   Description: Driver manifest missing Files.signature entry\r\n"+
+		"   License: Apache-2.0\r\n"+
+		"   Available Versions:\r\n"+
 		"    ╰── 1.0.0\r\n\r ", suite.runCmd(m))
 }

cmd/dbc/sync.go

@@ -26,22 +26,25 @@ var (
 )
 
 type SyncCmd struct {
-	Path  string             `arg:"-p" placeholder:"FILE" default:"./dbc.toml" help:"Drivers list to sync from"`
-	Level config.ConfigLevel `arg:"-l" help:"Config level to install to (user, system)"`
+	Path         string             `arg:"-p" placeholder:"FILE" default:"./dbc.toml" help:"Drivers list to sync from"`
+	Level        config.ConfigLevel `arg:"-l" help:"Config level to install to (user, system)"`
+	AllowMissing bool               `arg:"--allow-missing-signature" help:"Allow installation of drivers without a signature file"`
 }
 
 func (c SyncCmd) GetModelCustom(baseModel baseModel) tea.Model {
 	return syncModel{
-		baseModel: baseModel,
-		Path:      c.Path,
-		cfg:       getConfig(c.Level),
+		baseModel:    baseModel,
+		Path:         c.Path,
+		cfg:          getConfig(c.Level),
+		AllowMissing: c.AllowMissing,
 	}
 }
 
 func (c SyncCmd) GetModel() tea.Model {
 	return syncModel{
-		Path: c.Path,
-		cfg:  getConfig(c.Level),
+		Path:         c.Path,
+		cfg:          getConfig(c.Level),
+		AllowMissing: c.AllowMissing,
 		baseModel: baseModel{
 			getDriverList: getDriverList,
 			downloadPkg:   downloadPkg,
@@ -54,6 +57,7 @@ type syncModel struct {
 
 	// path to drivers list
 	Path         string
+	AllowMissing bool
 	LockFilePath string
 	// information to write the new lockfile
 	locked LockFile
@@ -254,7 +258,7 @@ func (s syncModel) installDriver(cfg config.Config, item installItem) tea.Cmd {
 		manifest.DriverInfo.Source = "dbc"
 		manifest.DriverInfo.Driver.Shared.Set(config.PlatformTuple(), driverPath)
 
-		if err := verifySignature(manifest); err != nil {
+		if err := verifySignature(manifest, s.AllowMissing); err != nil {
 			return fmt.Errorf("failed to verify signature: %w", err)
 		}
 

cmd/dbc/sync_test.go

@@ -42,6 +42,8 @@ func downloadTestPkg(pkg dbc.PkgInfo) (*os.File, error) {
 		return os.Open(filepath.Join("testdata", "test-driver-2.tar.gz"))
 	case "test-driver-manifest-only":
 		return os.Open(filepath.Join("testdata", "test-driver-manifest-only.tar.gz"))
+	case "test-driver-no-sig":
+		return os.Open(filepath.Join("testdata", "test-driver-no-sig.tar.gz"))
 	default:
 		return nil, fmt.Errorf("unknown driver: %s", pkg.Driver.Path)
 	}

cmd/dbc/testdata/test-driver-no-sig.tar.gz

@@ -60,3 +60,14 @@ drivers:
           - platform: macos_amd64
           - platform: macos_arm64
           - platform: windows_amd64
+  - name: Test Driver No Signature
+    description: Driver manifest missing Files.signature entry
+    license: Apache-2.0
+    path: test-driver-no-sig
+    pkginfo:
+      - version: v1.0.0
+        packages:
+          - platform: linux_amd64
+          - platform: macos_amd64
+          - platform: macos_arm64
+          - platform: windows_amd64