Merged
Conversation
code-asher
force-pushed
the
asher/binary-verification
branch
2 times, most recently
from
753e955 to
3e18934
Compare
The main thing here is to pass in an Axios client instead of the SDK client since this does not need to make API calls and we will need to pass a separate client without headers when downloading external signatures. Otherwise the structure remains the same. Some variables are renamed due to being in a new context and some strings messages are simplified.
A tiny refactor since I will need to get a third config option.
code-asher
force-pushed
the
asher/binary-verification
branch
2 times, most recently
from
33b14b9 to
18c3c88
Compare
code-asher
force-pushed
the
asher/binary-verification
branch
from
18c3c88 to
860b1aa
Compare
They are not needed, and the packaging step will error that it looks like you are trying to package secrets due to the test key fixtures.
aslilac
approved these changes
Jul 25, 2025
Member
aslilac
left a comment
aslilac
left a comment
There was a problem hiding this comment.
I'm gonna need you to sign a waiver indicating that you know I'm not a cryptography expert and will not be held responsible for any glaring security issues before you merge this 😝 but it looks good!
Member
Author
|
cc @jdomeracki-coder in case you want to take a look, should be similar to the JetBrains plugin but I went with the original flow instead of the checkbox during login since we can have prompts with multiple buttons here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I extracted the download function (since I needed to reuse it to download signatures) to a separate commit so it is easier to review the signature additions separately, if that is of interest.
This downloads the detached signature from Coder if available or releases.coder.com if not, then verifies the binary using that detached signature and the bundled public key. The check is performed only when the binary is first download.