Airship\Engine\Continuum\AutoUpdater::checkKeyggdrasil PHP Method

checkKeyggdrasil() public method

Dear future security auditors: This is important.
public checkKeyggdrasil ( UpdateInfo $info, UpdateFile $file ) : boolean
$info UpdateInfo
$file UpdateFile
return boolean
    public function checkKeyggdrasil(UpdateInfo $info, UpdateFile $file) : bool
    {
        $debugArgs = ['supplier' => $info->getSupplierName(), 'name' => $info->getPackageName(), 'root' => $info->getMerkleRoot()];
        $this->log('Checking Keyggdrasil', LogLevel::DEBUG, $debugArgs);
        $db = \Airship\get_database();
        $merkle = $db->row('SELECT * FROM airship_tree_updates WHERE merkleroot = ?', $info->getMerkleRoot());
        if (empty($merkle)) {
            $this->log('Merkle root not found in tree', LogLevel::DEBUG, $debugArgs);
            // Not found in Keyggdrasil
            return false;
        }
        $data = \Airship\parseJSON($merkle['data'], true);
        if ($data['action'] !== 'CORE') {
            if (!\hash_equals($this->type, $data['pkg_type'])) {
                $this->log('Wrong package type', LogLevel::DEBUG, $debugArgs);
                // Wrong package type
                return false;
            }
            if (!\hash_equals($info->getSupplierName(), $data['supplier'])) {
                $this->log('Wrong supplier', LogLevel::DEBUG, $debugArgs);
                // Wrong supplier
                return false;
            }
            if (!\hash_equals($info->getPackageName(), $data['name'])) {
                $this->log('Wrong package', LogLevel::DEBUG, $debugArgs);
                // Wrong package
                return false;
            }
        }
        $data = \Airship\parseJSON($merkle['data'], true);
        // Finally, we verify that the checksum matches the entry in our Merkle tree:
        return \hash_equals($file->getHash(), $data['checksum']);
    }