{"action":"created","comment":{"url":"https://api.github.com/repos/flutter/engine/pulls/comments/42177024","id":42177024,"diff_hunk":"@@ -88,18 +122,65 @@ class UpdateTask {\n   Future<MojoResult> _fetchBundle() async {\n     // TODO(mpcomplete): Use the cache dir. We need an equivalent of mkstemp().\n     _tempPath = path.join(_dataDir, 'tmp.skyx');\n-    String bundleUrl = _currentManifest['update_url'] + '/' + kBundleFile;\n+    String bundleUrl = _currentManifest['update-url'] + '/' + kBundleFile;\n     UrlResponse response = await fetchUrl(bundleUrl);\n     return PipeToFile.copyToFile(response.body, _tempPath);\n   }\n \n-  _replaceBundle() async {\n+  Future _validateBundle() async {\n+    Bundle bundle = await Bundle.readHeader(_tempPath);\n+\n+    if (bundle.manifest['key'] != _currentManifest['key'])\n+      throw 'Remote package key does not match.';","path":"sky/packages/updater/lib/main.dart","position":null,"original_position":135,"commit_id":"45908e6f41bcb06275b470813a1500c0ffd7eaeb","original_commit_id":"c00531f274b13ea93c917fc876038777a06bb127","user":{"login":"mpcomplete","id":1071986,"avatar_url":"https://avatars.githubusercontent.com/u/1071986?v=3","gravatar_id":"","url":"https://api.github.com/users/mpcomplete","html_url":"https://github.com/mpcomplete","followers_url":"https://api.github.com/users/mpcomplete/followers","following_url":"https://api.github.com/users/mpcomplete/following{/other_user}","gists_url":"https://api.github.com/users/mpcomplete/gists{/gist_id}","starred_url":"https://api.github.com/users/mpcomplete/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpcomplete/subscriptions","organizations_url":"https://api.github.com/users/mpcomplete/orgs","repos_url":"https://api.github.com/users/mpcomplete/repos","events_url":"https://api.github.com/users/mpcomplete/events{/privacy}","received_events_url":"https://api.github.com/users/mpcomplete/received_events","type":"User","site_admin":false},"body":"Done.","created_at":"2015-10-15T20:38:47Z","updated_at":"2015-10-15T20:38:47Z","html_url":"https://github.com/flutter/engine/pull/1612#discussion_r42177024","pull_request_url":"https://api.github.com/repos/flutter/engine/pulls/1612","_links":{"self":{"href":"https://api.github.com/repos/flutter/engine/pulls/comments/42177024"},"html":{"href":"https://github.com/flutter/engine/pull/1612#discussion_r42177024"},"pull_request":{"href":"https://api.github.com/repos/flutter/engine/pulls/1612"}}},"pull_request":{"url":"https://api.github.com/repos/flutter/engine/pulls/1612","id":47700654,"html_url":"https://github.com/flutter/engine/pull/1612","diff_url":"https://github.com/flutter/engine/pull/1612.diff","patch_url":"https://github.com/flutter/engine/pull/1612.patch","issue_url":"https://api.github.com/repos/flutter/engine/issues/1612","number":1612,"state":"open","locked":false,"title":"Add support for verifying .flx signatures when updating","user":{"login":"mpcomplete","id":1071986,"avatar_url":"https://avatars.githubusercontent.com/u/1071986?v=3","gravatar_id":"","url":"https://api.github.com/users/mpcomplete","html_url":"https://github.com/mpcomplete","followers_url":"https://api.github.com/users/mpcomplete/followers","following_url":"https://api.github.com/users/mpcomplete/following{/other_user}","gists_url":"https://api.github.com/users/mpcomplete/gists{/gist_id}","starred_url":"https://api.github.com/users/mpcomplete/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpcomplete/subscriptions","organizations_url":"https://api.github.com/users/mpcomplete/orgs","repos_url":"https://api.github.com/users/mpcomplete/repos","events_url":"https://api.github.com/users/mpcomplete/events{/privacy}","received_events_url":"https://api.github.com/users/mpcomplete/received_events","type":"User","site_admin":false},"body":"Adds a step to the updater to verify that the new .flx package is signed and untampered.\r\n\r\nEach .flx contains a signed manifest file. The manifest contains a SHA-256 hash of the .flx contents. See bundle.dart for a description of the new .flx format.","created_at":"2015-10-14T19:02:15Z","updated_at":"2015-10-15T20:38:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"44c50d5a5a13dad52166b7de1000789eb0a0b576","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/flutter/engine/pulls/1612/commits","review_comments_url":"https://api.github.com/repos/flutter/engine/pulls/1612/comments","review_comment_url":"https://api.github.com/repos/flutter/engine/pulls/comments{/number}","comments_url":"https://api.github.com/repos/flutter/engine/issues/1612/comments","statuses_url":"https://api.github.com/repos/flutter/engine/statuses/45908e6f41bcb06275b470813a1500c0ffd7eaeb","head":{"label":"mpcomplete:signer.cipher","ref":"signer.cipher","sha":"45908e6f41bcb06275b470813a1500c0ffd7eaeb","user":{"login":"mpcomplete","id":1071986,"avatar_url":"https://avatars.githubusercontent.com/u/1071986?v=3","gravatar_id":"","url":"https://api.github.com/users/mpcomplete","html_url":"https://github.com/mpcomplete","followers_url":"https://api.github.com/users/mpcomplete/followers","following_url":"https://api.github.com/users/mpcomplete/following{/other_user}","gists_url":"https://api.github.com/users/mpcomplete/gists{/gist_id}","starred_url":"https://api.github.com/users/mpcomplete/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpcomplete/subscriptions","organizations_url":"https://api.github.com/users/mpcomplete/orgs","repos_url":"https://api.github.com/users/mpcomplete/repos","events_url":"https://api.github.com/users/mpcomplete/events{/privacy}","received_events_url":"https://api.github.com/users/mpcomplete/received_events","type":"User","site_admin":false},"repo":{"id":39223454,"name":"engine","full_name":"mpcomplete/engine","owner":{"login":"mpcomplete","id":1071986,"avatar_url":"https://avatars.githubusercontent.com/u/1071986?v=3","gravatar_id":"","url":"https://api.github.com/users/mpcomplete","html_url":"https://github.com/mpcomplete","followers_url":"https://api.github.com/users/mpcomplete/followers","following_url":"https://api.github.com/users/mpcomplete/following{/other_user}","gists_url":"https://api.github.com/users/mpcomplete/gists{/gist_id}","starred_url":"https://api.github.com/users/mpcomplete/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpcomplete/subscriptions","organizations_url":"https://api.github.com/users/mpcomplete/orgs","repos_url":"https://api.github.com/users/mpcomplete/repos","events_url":"https://api.github.com/users/mpcomplete/events{/privacy}","received_events_url":"https://api.github.com/users/mpcomplete/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mpcomplete/engine","description":"The Sky engine","fork":true,"url":"https://api.github.com/repos/mpcomplete/engine","forks_url":"https://api.github.com/repos/mpcomplete/engine/forks","keys_url":"https://api.github.com/repos/mpcomplete/engine/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mpcomplete/engine/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mpcomplete/engine/teams","hooks_url":"https://api.github.com/repos/mpcomplete/engine/hooks","issue_events_url":"https://api.github.com/repos/mpcomplete/engine/issues/events{/number}","events_url":"https://api.github.com/repos/mpcomplete/engine/events","assignees_url":"https://api.github.com/repos/mpcomplete/engine/assignees{/user}","branches_url":"https://api.github.com/repos/mpcomplete/engine/branches{/branch}","tags_url":"https://api.github.com/repos/mpcomplete/engine/tags","blobs_url":"https://api.github.com/repos/mpcomplete/engine/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mpcomplete/engine/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mpcomplete/engine/git/refs{/sha}","trees_url":"https://api.github.com/repos/mpcomplete/engine/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mpcomplete/engine/statuses/{sha}","languages_url":"https://api.github.com/repos/mpcomplete/engine/languages","stargazers_url":"https://api.github.com/repos/mpcomplete/engine/stargazers","contributors_url":"https://api.github.com/repos/mpcomplete/engine/contributors","subscribers_url":"https://api.github.com/repos/mpcomplete/engine/subscribers","subscription_url":"https://api.github.com/repos/mpcomplete/engine/subscription","commits_url":"https://api.github.com/repos/mpcomplete/engine/commits{/sha}","git_commits_url":"https://api.github.com/repos/mpcomplete/engine/git/commits{/sha}","comments_url":"https://api.github.com/repos/mpcomplete/engine/comments{/number}","issue_comment_url":"https://api.github.com/repos/mpcomplete/engine/issues/comments{/number}","contents_url":"https://api.github.com/repos/mpcomplete/engine/contents/{+path}","compare_url":"https://api.github.com/repos/mpcomplete/engine/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mpcomplete/engine/merges","archive_url":"https://api.github.com/repos/mpcomplete/engine/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mpcomplete/engine/downloads","issues_url":"https://api.github.com/repos/mpcomplete/engine/issues{/number}","pulls_url":"https://api.github.com/repos/mpcomplete/engine/pulls{/number}","milestones_url":"https://api.github.com/repos/mpcomplete/engine/milestones{/number}","notifications_url":"https://api.github.com/repos/mpcomplete/engine/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mpcomplete/engine/labels{/name}","releases_url":"https://api.github.com/repos/mpcomplete/engine/releases{/id}","created_at":"2015-07-16T22:27:29Z","updated_at":"2015-09-21T17:14:10Z","pushed_at":"2015-10-15T20:38:30Z","git_url":"git://github.com/mpcomplete/engine.git","ssh_url":"git@github.com:mpcomplete/engine.git","clone_url":"https://github.com/mpcomplete/engine.git","svn_url":"https://github.com/mpcomplete/engine","homepage":null,"size":76974,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"flutter:master","ref":"master","sha":"fb6143da0f2bcfbe0879b12b7ea777955e51fdc3","user":{"login":"flutter","id":14101776,"avatar_url":"https://avatars.githubusercontent.com/u/14101776?v=3","gravatar_id":"","url":"https://api.github.com/users/flutter","html_url":"https://github.com/flutter","followers_url":"https://api.github.com/users/flutter/followers","following_url":"https://api.github.com/users/flutter/following{/other_user}","gists_url":"https://api.github.com/users/flutter/gists{/gist_id}","starred_url":"https://api.github.com/users/flutter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flutter/subscriptions","organizations_url":"https://api.github.com/users/flutter/orgs","repos_url":"https://api.github.com/users/flutter/repos","events_url":"https://api.github.com/users/flutter/events{/privacy}","received_events_url":"https://api.github.com/users/flutter/received_events","type":"Organization","site_admin":false},"repo":{"id":39211337,"name":"engine","full_name":"flutter/engine","owner":{"login":"flutter","id":14101776,"avatar_url":"https://avatars.githubusercontent.com/u/14101776?v=3","gravatar_id":"","url":"https://api.github.com/users/flutter","html_url":"https://github.com/flutter","followers_url":"https://api.github.com/users/flutter/followers","following_url":"https://api.github.com/users/flutter/following{/other_user}","gists_url":"https://api.github.com/users/flutter/gists{/gist_id}","starred_url":"https://api.github.com/users/flutter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flutter/subscriptions","organizations_url":"https://api.github.com/users/flutter/orgs","repos_url":"https://api.github.com/users/flutter/repos","events_url":"https://api.github.com/users/flutter/events{/privacy}","received_events_url":"https://api.github.com/users/flutter/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/flutter/engine","description":"The Flutter engine","fork":false,"url":"https://api.github.com/repos/flutter/engine","forks_url":"https://api.github.com/repos/flutter/engine/forks","keys_url":"https://api.github.com/repos/flutter/engine/keys{/key_id}","collaborators_url":"https://api.github.com/repos/flutter/engine/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/flutter/engine/teams","hooks_url":"https://api.github.com/repos/flutter/engine/hooks","issue_events_url":"https://api.github.com/repos/flutter/engine/issues/events{/number}","events_url":"https://api.github.com/repos/flutter/engine/events","assignees_url":"https://api.github.com/repos/flutter/engine/assignees{/user}","branches_url":"https://api.github.com/repos/flutter/engine/branches{/branch}","tags_url":"https://api.github.com/repos/flutter/engine/tags","blobs_url":"https://api.github.com/repos/flutter/engine/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/flutter/engine/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/flutter/engine/git/refs{/sha}","trees_url":"https://api.github.com/repos/flutter/engine/git/trees{/sha}","statuses_url":"https://api.github.com/repos/flutter/engine/statuses/{sha}","languages_url":"https://api.github.com/repos/flutter/engine/languages","stargazers_url":"https://api.github.com/repos/flutter/engine/stargazers","contributors_url":"https://api.github.com/repos/flutter/engine/contributors","subscribers_url":"https://api.github.com/repos/flutter/engine/subscribers","subscription_url":"https://api.github.com/repos/flutter/engine/subscription","commits_url":"https://api.github.com/repos/flutter/engine/commits{/sha}","git_commits_url":"https://api.github.com/repos/flutter/engine/git/commits{/sha}","comments_url":"https://api.github.com/repos/flutter/engine/comments{/number}","issue_comment_url":"https://api.github.com/repos/flutter/engine/issues/comments{/number}","contents_url":"https://api.github.com/repos/flutter/engine/contents/{+path}","compare_url":"https://api.github.com/repos/flutter/engine/compare/{base}...{head}","merges_url":"https://api.github.com/repos/flutter/engine/merges","archive_url":"https://api.github.com/repos/flutter/engine/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/flutter/engine/downloads","issues_url":"https://api.github.com/repos/flutter/engine/issues{/number}","pulls_url":"https://api.github.com/repos/flutter/engine/pulls{/number}","milestones_url":"https://api.github.com/repos/flutter/engine/milestones{/number}","notifications_url":"https://api.github.com/repos/flutter/engine/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/flutter/engine/labels{/name}","releases_url":"https://api.github.com/repos/flutter/engine/releases{/id}","created_at":"2015-07-16T17:39:56Z","updated_at":"2015-10-15T14:15:35Z","pushed_at":"2015-10-15T20:38:31Z","git_url":"git://github.com/flutter/engine.git","ssh_url":"git@github.com:flutter/engine.git","clone_url":"https://github.com/flutter/engine.git","svn_url":"https://github.com/flutter/engine","homepage":"http://flutter.io","size":88906,"stargazers_count":274,"watchers_count":274,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":66,"mirror_url":null,"open_issues_count":193,"forks":66,"open_issues":193,"watchers":274,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/flutter/engine/pulls/1612"},"html":{"href":"https://github.com/flutter/engine/pull/1612"},"issue":{"href":"https://api.github.com/repos/flutter/engine/issues/1612"},"comments":{"href":"https://api.github.com/repos/flutter/engine/issues/1612/comments"},"review_comments":{"href":"https://api.github.com/repos/flutter/engine/pulls/1612/comments"},"review_comment":{"href":"https://api.github.com/repos/flutter/engine/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/flutter/engine/pulls/1612/commits"},"statuses":{"href":"https://api.github.com/repos/flutter/engine/statuses/45908e6f41bcb06275b470813a1500c0ffd7eaeb"}}}}