I extracted the download function (since I needed to reuse it to download signatures) to a separate commit so it is easier to review the signature additions separately, if that is of interest.

This downloads the detached signature from Coder if available or releases.coder.com if not, then verifies the binary using that detached signature and the bundled public key. The check is performed only when the binary is first download.

Add option to disable
Skip headers when requesting releases.coder.com
Tests (for signing, no tests for the UI changes, ideally we get something set up to do that at some point, although we could mock the VS Code APIs in the meantime...)

code-asher force-pushed theasher/binary-verification branch 2 times, most recently from753e955 to3e18934Compare

July 23, 2025 20:45

code-asher added2 commits

July 23, 2025 12:49

Break out download code

63067d0

The main thing here is to pass in an Axios client instead of the SDKclient since this does not need to make API calls and we will need topass a separate client without headers when downloading externalsignatures.Otherwise the structure remains the same.  Some variables are renameddue to being in a new context and some strings messages are simplified.

Get config once

e903482

A tiny refactor since I will need to get a third config option.

code-asher force-pushed theasher/binary-verification branch 2 times, most recently from33b14b9 to18c3c88Compare

July 23, 2025 21:59

Add binary signature verification

860b1aa

code-asher force-pushed theasher/binary-verification branch from18c3c88 to860b1aaCompare

July 23, 2025 22:11

code-asher requested a review fromaslilac

July 23, 2025 22:15

Omit fixtures when packaging

df064f9

They are not needed, and the packaging step will error that it lookslike you are trying to package secrets due to the test key fixtures.

aslilac approved these changes

Jul 25, 2025

View reviewed changes

Copy link

Member

aslilac left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I'm gonna need you to sign a waiver indicating that you know I'm not a cryptography expert and will not be held responsible for any glaring security issues before you merge this 😝 but it looks good!

pgp-public.key OutdatedShow resolvedHide resolved

src/pgp.tsShow resolvedHide resolved

src/storage.tsShow resolvedHide resolved

src/pgp.ts OutdatedShow resolvedHide resolved

code-asher added4 commits

July 28, 2025 11:10

Add trailing newline to public key

46ee3f6

be me; in rome

d6d1e7c

No need for default

c4f3d0a

Merge remote-tracking branch 'github/main' into asher/binary-verifica…

022e832

…tion

Copy link

MemberAuthor

code-asher commentedJul 28, 2025

cc@jdomeracki-coder in case you want to take a look, should be similar to the JetBrains plugin but I went with the original flow instead of the checkbox during login since we can have prompts with multiple buttons here.