Code signature validation might fail depending on PHP implementation

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

I found during some research on the server code some issue that ATM does not trigger a problem but might cause trouble in the future.

Summary:

The Nextcloud server core checks the integration from a set of hashes of apps and the core. The current implementation contains some issues that might cause the checker to fail.

Details:

In the current implementation, the checking of the files is done in this line.

Note that the ordering of the PHP function json_encode is not defined in the manual. Thus, the string representation is ambiguous: The different entries in the associative array can be stored in any order within the output string. This will for sure change the hash of the string representation.

The same argumentation can be made for the creation of the signatures.

Suppose the machine running the server and the machine generating the signature are different. Then, the PHP algorithms might differ causing different JSON string representations.

The string to be checked against the certificate is generated on-the-fly. Thus, the different implementations might lead to different strings failing the validation of the certificate (false negative).

Additional considerations

Any change in this code section must be done carefully as this might break the core's and apps' signatures.

Personally, I think there are two options:

1. Create a function that mimics the current behavior and use that in the future with well-defined sorting behavior.
2. Allow for a transition in the structure of the signature.json file and store the signed string as well.

Personally, I would even prefer variant 2 as this seems more explicit and less hacky to me. I wanted to provide a PR if this is okay, but I would like to know before starting something like this if it was even considered valuable/mergeable and what of the options above would be best suited.

Start in lib/private/IntegrityCheck/Checker.php at the signature creation and validation locations cited around lines 234 and 371, then inspect the signature.json structure. Reproduce or verify whether json_encode ordering can differ between PHP implementations; completion requires an agreed migration or canonicalization approach that preserves existing core and app signatures.