feat: G2 code-signing verifier (Mode-1) with legacy G1 transition

changelog/unreleased/41680

@@ -0,0 +1,15 @@
+Change: G2 code-signing verifier and G1 signature sunset
+
+We've replaced the app-signature verification with a new G2 code-signing
+verifier that validates the full certificate chain against bundled trust
+anchors, enforces an algorithm allowlist, and checks a fail-closed CRL for
+revocation.
+
+Existing G1-signed apps continue to verify during the transition. However,
+all G1 signatures stop verifying on 2027-01-01 (the hardcoded sunset at
+2026-12-31T23:59:59Z), regardless of individual certificate expiry. After
+that cutoff, affected apps must be re-signed with a G2 certificate to install
+or pass integrity verification. Administrators running third-party apps signed
+under G1 should plan for re-signed releases ahead of that date.
+
+https://github.com/owncloud/core/pull/41680

core/Command/Integrity/CheckApp.php

@@ -64,7 +64,13 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 		$path = \strval($input->getOption('path'));
 		$result = $this->checker->verifyAppSignature($appid, $path);
 		$this->writeArrayInOutputFormat($input, $output, $result);
-		if (\count($result)>0) {
+
+		// A valid but expired, pre-sunset legacy (G1) app verifies with the single
+		// 'LEGACY_ACCEPTED_WARN' marker (spec §8 "warn + allow"). The marker is printed
+		// above so the warning is visible, but it is a pass — do not fail the command.
+		$isLegacyWarnOnly = \array_key_exists('LEGACY_ACCEPTED_WARN', $result)
+			&& \count($result) === 1;
+		if (\count($result) > 0 && !$isLegacyWarnOnly) {
 			return 1;
 		}
 		return 0;

lib/kernel.php

@@ -527,6 +527,15 @@ public static function init() {
 		\spl_autoload_register([self::$loader, 'load']);
 		$loaderEnd = \microtime(true);
 
+		// SECURITY: Disable phpseclib's automatic URL fetching process-wide.
+		// phpseclib's X509 will otherwise follow AIA caIssuers / CRL distribution
+		// point URLs found inside a certificate, which is an SSRF vector when
+		// validating attacker-supplied certificates (e.g. the IntegrityCheck
+		// code-signing verifier). ownCloud never relies on phpseclib fetching
+		// remote URLs, so this is disabled once here at boot rather than toggled
+		// per validation call — a single, greppable, non-hidden global default.
+		\phpseclib3\File\X509::disableURLFetch();
+
 		try {
 			self::initPaths();
 		} catch (\RuntimeException $e) {

lib/private/Installer.php

@@ -349,7 +349,12 @@ public static function checkAppsIntegrity($data, $extractDir, $path, $isShipped
 					$info['id'],
 					$extractDir
 				);
-			if ($integrityResult !== []) {
+			// A valid but expired, pre-sunset legacy (G1) app verifies with the
+			// single 'LEGACY_ACCEPTED_WARN' marker (spec §8 "warn + allow"). That is
+			// a pass-with-warning, not a failure, so it must not block the install.
+			$isLegacyWarnOnly = \array_key_exists('LEGACY_ACCEPTED_WARN', $integrityResult)
+				&& \count($integrityResult) === 1;
+			if ($integrityResult !== [] && !$isLegacyWarnOnly) {
 				$e = new \Exception(
 					$l->t(
 						'Signature could not get checked. Please contact the app developer and check your admin screen.'