refactor(remote-config): fix remote config signature verification + add integration tests#3659
Open
tonidero wants to merge 2 commits into
Open
refactor(remote-config): fix remote config signature verification + add integration tests#3659tonidero wants to merge 2 commits into
tonidero wants to merge 2 commits into
Conversation
tonidero
changed the title
tonidero
changed the base branch from
phase_4__v2_config_topic_handler_registry
to
main
…ig bytes + 204) Make the SDK actually verify the /v1/config signed responses now that the endpoint is in production: - Require a nonce for GetRemoteConfig signing (was a WIP no-nonce stub) and thread it through the binary verification path. - Sign over the config part bytes exactly as received (RcFormatResponse main_body) instead of the element's 24-byte checksum; element checksums are untrusted lookup hints. Adds RCElement.dataBytes(); drops the now-unused checksumBytes() and the checksum gate. - Verify the 204 (no content) response over the request context with an empty body instead of trusting it unconditionally. Adds backend integration tests against production (200 + 204, informational and enforced) plus HTTPClient/Endpoint unit coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tonidero
force-pushed
the
remote_config_verify_signed_responses
branch
from
fd7e00c to
536fd30
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3659 +/- ##
=======================================
Coverage 80.34% 80.35%
=======================================
Files 382 382
Lines 15706 15711 +5
Branches 2191 2190 -1
=======================================
+ Hits 12619 12624 +5
Misses 2213 2213
Partials 874 874 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/v1/config/{domain}instead of as part of the body.Note
High Risk
Changes authentication/signature verification for remote config and alters trust model (checksum vs signed config bytes); incorrect verification could block config or accept bad responses under Enforced mode.
Overview
Aligns remote config (
GetRemoteConfig/ RC container format) signature verification with how the backend signs responses.GetRemoteConfignow requires a nonce for signing (needsNonceToPerformSigning), so requests sendX-Nonceand verification includes it. RC format verification no longer checks the config element’s checksum or signs overchecksumBytes(); it verifies the signature over the config element’s rawdatabytes via newRCElement.dataBytes(). Element checksums are treated as untrusted hints only.204 No Content RC responses are no longer auto-
VERIFIEDwithout crypto: a newverifyRCFormatNoContentResponserunssigningManager.verifyResponsewith an empty body plus request context (nonce, path, request time). Enforced mode can throw on failed 204 verification.Unit tests in
HTTPClientVerificationTestandEndpointTestwere updated;ProductionRemoteConfigIntegrationTesthits live/v1/configfor 200/204, manifest replay, and enforced verification.Reviewed by Cursor Bugbot for commit 536fd30. Bugbot is set up for automated code reviews on this repo. Configure here.