Skip to content

Commit

Permalink
(chocolatey#247) Enable packageHashValidation feature
Browse files Browse the repository at this point in the history
With Chocolatey 2.3.0 we introduced a feature
which will validate the checksum of a downloaded
nupkg with the SHA512 checksum that the repository
reports.

This increases confidence that the nupkg you are
installing is in fact the nupkg you expect.

This change enables the feature on the server as
it is being setup, and adds the command to turn on
the feature to the ClientSetup script.
  • Loading branch information
steviecoaster authored and JPRuskin committed Oct 18, 2024
1 parent ff4cfc0 commit 5eeeff1
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 0 deletions.
1 change: 1 addition & 0 deletions Start-C4bSetup.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ try {

# Set Choco Server Chocolatey Configuration
Invoke-Choco feature enable --name="'excludeChocolateyPackagesDuringUpgradeAll'"
Invoke-Choco feature enable --name="'usePackageHashValidation'"

# Convert license to a "choco-license" package, and install it locally to test
Write-Host "Creating a 'chocolatey-license' package, and testing install." -ForegroundColor Green
Expand Down
3 changes: 3 additions & 0 deletions scripts/ClientSetup.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,9 @@ choco feature enable --name="'useBackgroundServiceWithNonAdministratorsOnly'"
choco feature enable --name="'allowBackgroundServiceUninstallsFromUserInstallsOnly'"
choco config set --name="'backgroundServiceAllowedCommands'" --value="'install,upgrade,uninstall'"

# Enable Package Hash Validation (Good security practice)
choco feature enable --name="'usePackageHashValidation'"

# CCM Check-in Configuration
choco config set CentralManagementServiceUrl "https://${hostName}:24020/ChocolateyManagementService"
if ($ClientSalt) {
Expand Down

0 comments on commit 5eeeff1

Please sign in to comment.