This project implements an Enterprise Security Hub designed to orchestrate the lifecycle and security of multiple desktop applications.
Unlike standard updaters, this system acts as a Trusted Gateway. It centralizes the security verification (Signatures, Integrity, TTL) for an entire ecosystem of managed tools, ensuring that no unauthenticated or tampered software ever runs on the local system.
The system is built on a Zero-Trust model. The Hub never trusts the update server; it only trusts the cryptographic proof provided by the developer's private key.
- Digital Signatures: Uses Ed25519. The Hub verifies a detached signature of the manifest before parsing any data. This prevents MITM and Tampering at the metadata layer.
- Integrity Hashing: Uses SHA-256. Post-patching, the Hub calculates the hash of the resulting binary. A single bit difference results in an immediate rejection and deletion of the update.
- Binary Delta Patching: Uses bsdiff4. This ensures updates are bandwidth-efficient while maintaining the requirement for bit-perfect binary reconstruction.
- Workspaces: Each managed application is installed in an isolated sub-directory within
managed_apps/. - Decoupled Security: Security failures for one application (e.g., a tampered Scanner manifest) do not affect the operational status or security of other managed apps.
| Threat | Mitigation Mechanism | Hub Implementation |
|---|---|---|
| Tampering | Ed25519 Signature | The Hub blocks any update where the manifest byte-stream does not match the signed hash. |
| MITM Attack | Ed25519 + Detached Sig | Even if network traffic is hijacked, the attacker cannot produce a valid signature without the developer's Private Key. |
| Replay Attack | TTL (Time-To-Live) | Every manifest contains a valid_until timestamp. The Hub rejects "stale" signed manifests. |
| Downgrade Attack | Version Comparison | The Hub compares the latest_version against local state. It blocks attempts to force-install older, vulnerable versions. |
| Corrupted Update | Post-Patch SHA-256 | After bsdiff4 reconstruction, the Hub verifies the final file hash. This stops "malicious patches" that aim to corrupt the final executable. |
- SAST (Bandit): Scanned for common Python vulnerabilities. Identified and verified safe usage of
subprocess(used only for trusted application restarts). - SCA (Safety): Identified and remediated a critical vulnerability in
pytestby upgrading the project to version9.0.3.
- Hardware Trust: Currently uses software PEM files. Future iterations should utilize TPM or YubiKey for the Publisher's signing operations.
- Process Protection: The Hub currently performs an atomic swap. Future hardening could include Certificate Pinning for the server connection.