Merge pull request #725 from nextcloud/backport/723/stable32

[stable32] fix: verify integrity with URL override but allow to disable if needed

Author: susnux

index.php

@@ -766,19 +766,14 @@ private function getDownloadedFilePath(): string {
 	 *
 	 * @throws \Exception
 	 */
-	public function verifyIntegrity(?string $urlOverride = null): void {
+	public function verifyIntegrity(): void {
 		$this->silentLog('[info] verifyIntegrity()');
 
 		if ($this->getCurrentReleaseChannel() === 'daily') {
 			$this->silentLog('[info] current channel is "daily" which is not signed. Skipping verification.');
 			return;
 		}
 
-		if ($urlOverride) {
-			$this->silentLog('[info] custom download url provided, cannot verify signature');
-			return;
-		}
-
 		$response = $this->getUpdateServerResponse();
 		if (empty($response['signature'])) {
 			throw new \Exception('No signature specified for defined update');

lib/UpdateCommand.php

@@ -21,6 +21,8 @@ class UpdateCommand extends Command {
 	protected bool $shouldStop = false;
 	protected bool $skipBackup = false;
 	protected bool $skipUpgrade = false;
+	protected bool $skipIntegrityCheck = false;
+
 	protected string $urlOverride = '';
 
 	/** @var list<string> strings of text for stages of updater */
@@ -47,7 +49,8 @@ protected function configure(): void {
 			->setHelp('This command fetches the latest code that is announced via the updater server and safely replaces the existing code with the new one.')
 			->addOption('no-backup', null, InputOption::VALUE_NONE, 'Skip backup of current Nextcloud version')
 			->addOption('no-upgrade', null, InputOption::VALUE_NONE, "Don't automatically run occ upgrade")
-			->addOption('url', null, InputOption::VALUE_OPTIONAL, 'The URL of the Nextcloud release to download');
+			->addOption('url', null, InputOption::VALUE_OPTIONAL, 'The URL of the Nextcloud release to download')
+			->addOption('no-verify', null, InputOption::VALUE_OPTIONAL, 'Skip integrity verification of the downloaded file');
 	}
 
 	public static function getUpdaterVersion(): string {
@@ -62,6 +65,7 @@ public static function getUpdaterVersion(): string {
 	protected function execute(InputInterface $input, OutputInterface $output) {
 		$this->skipBackup = (bool)$input->getOption('no-backup');
 		$this->skipUpgrade = (bool)$input->getOption('no-upgrade');
+		$this->skipIntegrityCheck = (bool)$input->getOption('no-verify');
 		$this->urlOverride = (string)$input->getOption('url');
 
 		$version = static::getUpdaterVersion();
@@ -143,6 +147,11 @@ protected function execute(InputInterface $input, OutputInterface $output) {
 			$updateString = $this->updater->checkForUpdate();
 		}
 
+		if ($this->skipIntegrityCheck) {
+			$this->updater->log('[warn] Integrity check of the downloaded file will be skipped');
+			$output->writeln('Integrity check of the downloaded file will be skipped.');
+		}
+
 		$output->writeln('');
 
 		$lines = explode('<br />', $updateString);
@@ -407,7 +416,11 @@ protected function executeStep(int $step): array {
 					$this->updater->downloadUpdate($this->urlOverride);
 					break;
 				case 5:
-					$this->updater->verifyIntegrity($this->urlOverride);
+					if ($this->skipIntegrityCheck) {
+						$this->updater->silentLog('[info] Skipping integrity check as requested');
+						break;
+					}
+					$this->updater->verifyIntegrity();
 					break;
 				case 6:
 					$this->updater->extractDownload();

lib/Updater.php

@@ -749,19 +749,14 @@ private function getDownloadedFilePath(): string {
 	 *
 	 * @throws \Exception
 	 */
-	public function verifyIntegrity(?string $urlOverride = null): void {
+	public function verifyIntegrity(): void {
 		$this->silentLog('[info] verifyIntegrity()');
 
 		if ($this->getCurrentReleaseChannel() === 'daily') {
 			$this->silentLog('[info] current channel is "daily" which is not signed. Skipping verification.');
 			return;
 		}
 
-		if ($urlOverride) {
-			$this->silentLog('[info] custom download url provided, cannot verify signature');
-			return;
-		}
-
 		$response = $this->getUpdateServerResponse();
 		if (empty($response['signature'])) {
 			throw new \Exception('No signature specified for defined update');