|
|
|
|
@ -309,7 +309,10 @@ class Installer { |
|
|
|
|
// Check if the signature actually matches the downloaded content |
|
|
|
|
$certificate = openssl_get_publickey($app['certificate']); |
|
|
|
|
$verified = (bool)openssl_verify(file_get_contents($tempFile), base64_decode($app['releases'][0]['signature']), $certificate, OPENSSL_ALGO_SHA512); |
|
|
|
|
openssl_free_key($certificate); |
|
|
|
|
// PHP 8+ deprecates openssl_free_key and automatically destroys the key instance when it goes out of scope |
|
|
|
|
if ((PHP_VERSION_ID < 80000)) { |
|
|
|
|
openssl_free_key($certificate); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if ($verified === true) { |
|
|
|
|
// Seems to match, let's proceed |
|
|
|
|
|