mirror of
https://github.com/home-assistant/supervisor.git
synced 2025-12-20 06:48:16 +00:00
1448a33dbf
* Formally deprecate CodeNotary build config * Remove CodeNotary specific integrity checking The current code is specific to how CodeNotary was doing integrity checking. A future integrity checking mechanism likely will work differently (e.g. through EROFS based containers). Remove the current code to make way for a future implementation. * Drop CodeNotary integrity fixups * Drop unused tests * Fix pytest * Fix pytest * Remove CodeNotary related exceptions and handling Remove CodeNotary related exceptions and handling from the Docker interface. * Drop unnecessary comment * Remove Codenotary specific IssueType/SuggestionType * Drop Codenotary specific environment and secret reference * Remove unused constants * Introduce APIGone exception for removed APIs Introduce a new exception class APIGone to indicate that certain API features have been removed and are no longer available. Update the security integrity check endpoint to raise this new exception instead of a generic APIError, providing clearer communication to clients that the feature has been intentionally removed. * Drop content trust A cosign based signature verification will likely be named differently to avoid confusion with existing implementations. For now, remove the content trust option entirely. * Drop code sign test * Remove source_mods/content_trust evaluations * Remove content_trust reference in bootstrap.py * Fix security tests * Drop unused tests * Drop codenotary from schema Since we have "remove extra" in voluptuous, we can remove the codenotary field from the addon schema. * Remove content_trust from tests * Remove content_trust unsupported reason * Remove unnecessary comment * Remove unrelated pytest * Remove unrelated fixtures
57 lines
1.7 KiB
Python
57 lines
1.7 KiB
Python
"""Fetch last versions from webserver."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
|
|
from ..const import ATTR_FORCE_SECURITY, ATTR_PWNED, FILE_HASSIO_SECURITY
|
|
from ..coresys import CoreSys, CoreSysAttributes
|
|
from ..exceptions import PwnedError
|
|
from ..utils.common import FileConfiguration
|
|
from ..utils.pwned import check_pwned_password
|
|
from ..validate import SCHEMA_SECURITY_CONFIG
|
|
|
|
_LOGGER: logging.Logger = logging.getLogger(__name__)
|
|
|
|
|
|
class Security(FileConfiguration, CoreSysAttributes):
|
|
"""Handle Security properties."""
|
|
|
|
def __init__(self, coresys: CoreSys):
|
|
"""Initialize updater."""
|
|
super().__init__(FILE_HASSIO_SECURITY, SCHEMA_SECURITY_CONFIG)
|
|
self.coresys = coresys
|
|
|
|
@property
|
|
def force(self) -> bool:
|
|
"""Return if force security is enabled/disabled."""
|
|
return self._data[ATTR_FORCE_SECURITY]
|
|
|
|
@force.setter
|
|
def force(self, value: bool) -> None:
|
|
"""Set force security is enabled/disabled."""
|
|
self._data[ATTR_FORCE_SECURITY] = value
|
|
|
|
@property
|
|
def pwned(self) -> bool:
|
|
"""Return if pwned is enabled/disabled."""
|
|
return self._data[ATTR_PWNED]
|
|
|
|
@pwned.setter
|
|
def pwned(self, value: bool) -> None:
|
|
"""Set pwned is enabled/disabled."""
|
|
self._data[ATTR_PWNED] = value
|
|
|
|
async def verify_secret(self, pwned_hash: str) -> None:
|
|
"""Verify pwned state of a secret."""
|
|
if not self.pwned:
|
|
_LOGGER.warning("Disabled pwned, skip validation")
|
|
return
|
|
|
|
try:
|
|
await check_pwned_password(self.sys_websession, pwned_hash)
|
|
except PwnedError:
|
|
if self.force:
|
|
raise
|
|
return
|