Extension `.sigzip` assets does not match zip format

[jeanp413]

VS Code added a simple format verification for the signature asset for extension, it has to be a zip file and contain a .signature.p7s (the content does not matter), the signature file returned from open-vsx fails this verification resulting in any extension failing to install.

We need to update the format of the signature asset so this verification step passes

cc @amvanbaren

[jeanp413]

Not sure if this was since the beginning but now thw signature zip file has two files a manifest and the actual key with extension .p7s, this is validated by vscode

[jeanp413]

i think this would take some time to fix, can we just remove the signature asset from the server response that way verification will be skiped by vscode automatically

[amvanbaren]

Hi @jeanp413, you mean node-ovsx-sign has changed?

[mustard-mh]

VS Code will verify extension signature since microsoft/vscode#212722, code refer

• Perhaps we could make extension.isSigned=false to skip this checking for all clients first? (see code below, refer)
• Or we need to have real signature implemented. Here's example links for extension go
  • open-vsx https://open-vsx.org/vscode/asset/golang/Go/0.41.4/Microsoft.VisualStudio.Services.VsixSignature
  • official marketplace https://golang.gallerycdn.vsassets.io/extensions/golang/go/0.41.4/1713979050133/Microsoft.VisualStudio.Services.VsixSignature

The one downloaded from openvsx is not a zip file, but official one is and it includes a .signature.p7s file

cc @amvanbaren @jeanp413

[amvanbaren]

Microsoft's extension validation process was proprietary when I worked on extension signing. That's why @filiptronicek developed node-ovsx-sign to offer an open alternative.

Is the extension signing and validation process no longer proprietary?

[mustard-mh]

Microsoft's extension validation process was proprietary when I worked on extension signing. That's why ~~@~~filiptronicek developed node-ovsx-sign to offer an open alternative.

Is the extension signing and validation process no longer proprietary?

Then make extension.isSigned=false seems to be our only choice?

[mustard-mh]

Do you think we can make a PR to vscode to default disable this feature? It makes no sense if signature needs to use their lib for oss clients @jeanp413

[filiptronicek]

@mustard-mh I think it makes sense to disable by default in the microsoft/vscode repository and finally implement https://github.com/filiptronicek/node-ovsx-sign in our fork and encourage other forks to do the same to not have to deal with just not verifying anything ever.

[filiptronicek]

There is a reference implementation I did a while back but it needs some more testing: gitpod-io/openvscode-server@d468864

[jeanp413]

it's already disabled by default in vscode, if @vscode/vsce-sign is not present then no verification is done.
The issue is that the format of the sigzip asset, vscode is verifying that it's a zip file and contains a .p7s file, it doesn't matter if it's empty, that's why it's an openvsx issue it should always aim to have the same format in all assets

cc @amvanbaren

[amvanbaren]

vscode is verifying that it's a zip file and contains a .p7s file

@jeanp413 vscode always does this, even if @vscode/vsce-sign is disabled?

[jeanp413]

@jeanp413 vscode always does this, even if @vscode/vsce-sign is disabled?

yes

[filiptronicek]

I have a basic implementation here: filiptronicek/node-ovsx-sign#16. Would be happy if anyone could take a look