Skip to content

update_versions: change security warning #6904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AenBleidd merged 1 commit into from
Mar 10, 2026
+7 −8
Merged

update_versions: change security warning #6904

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions sched/sample_dummy_assimilator.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,9 @@
// You should have received a copy of the GNU Lesser General Public License
// along with BOINC. If not, see <http://www.gnu.org/licenses/>.

// A sample assimilator that only writes a log message.
// But WUs are marked as assimilated, which means file deleter
// A sample assimilator that writes a log message
// but doesn't do anything with the output files.
// WUs are marked as assimilated, so the file deleter
// will delete output files unless you mark them as no_delete,
// or include 'no_delete' in the WU name

Expand Down
10 changes: 4 additions & 6 deletions tools/update_versions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,12 +228,10 @@ function confirm_sig_gen($name) {
if ($sig_gen_confirmed) return true;

echo "
NOTICE: You have not provided a signature file for $name,
and your project's code-signing private key is on your server.

IF YOUR PROJECT IS PUBLICLY ACCESSIBLE, THIS IS A SECURITY VULNERABILITY.
PLEASE STOP YOUR PROJECT IMMEDIATELY AND READ:
https://github.com/BOINC/boinc/wiki/CodeSigning
NOTICE: files will be signed with your project's code-signing private key
(keys/code_sign_private).
We recommend that you encrypt it when done; see
Comment on lines +231 to +233
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new notice hardcodes the key path as keys/code_sign_private, but the actual key directory is configurable via <key_dir> in config.xml (read into $key_dir at line 48). The real path could be anything, not necessarily keys/. The message should either omit the path, use a generic description, or dynamically include the actual $key_dir value so it accurately reflects the project's configuration.

Suggested change
NOTICE: files will be signed with your project's code-signing private key
(keys/code_sign_private).
We recommend that you encrypt it when done; see
NOTICE: files will be signed with your project's code-signing private key.
We recommend that you encrypt this key when done; see

Copilot uses AI. Check for mistakes.
https://github.com/BOINC/boinc/wiki/Code-signing

Continue (y/n)? ";

Expand Down