Plugins should be signed #2487

New issue

Open

opened 2026-02-21 16:14:51 -05:00 by deekerman · 1 comment

deekerman commented

2026-02-21 16:14:51 -05:00

Owner

Originally created by @yurivict on GitHub (May 15, 2015).

Currently qBittorrent downloads search plugins (python source files) from GitHub without any checking. If they will be substituted by an attacker with the malicious code, they can cause damage to the user system.

The correct way to handle this is to distribute the public key with qBittorrent itself, download every plugin along with its signature made with the private key, and check the signature with the public part of the key in qBittorrent app.

Look here https://github.com/infobyte/evilgrade for one example how unsigned executable downloads can be exploited.

OpenSSL supports signing, here is the easy reference: http://stackoverflow.com/questions/10782826/digital-signature-for-a-file-using-openssl

# generate key
openssl genrsa -des3 -out privkey.pem 2048
openssl rsa -pubout -in privkey.pem -out pubkey.pem

# sign
openssl dgst -sha256 -sign privkey.pem -out $1.sign $1

# verify
openssl dgst -sha256 -verify pubkey.pem -signature $1.sign $1

Originally created by @yurivict on GitHub (May 15, 2015). Currently qBittorrent downloads search plugins (python source files) from GitHub without any checking. If they will be substituted by an attacker with the malicious code, they can cause damage to the user system. The correct way to handle this is to distribute the public key with qBittorrent itself, download every plugin along with its signature made with the private key, and check the signature with the public part of the key in qBittorrent app. Look here https://github.com/infobyte/evilgrade for one example how unsigned executable downloads can be exploited. OpenSSL supports signing, here is the easy reference: http://stackoverflow.com/questions/10782826/digital-signature-for-a-file-using-openssl ``` # generate key openssl genrsa -des3 -out privkey.pem 2048 openssl rsa -pubout -in privkey.pem -out pubkey.pem # sign openssl dgst -sha256 -sign privkey.pem -out $1.sign $1 # verify openssl dgst -sha256 -verify pubkey.pem -signature $1.sign $1 ```

deekerman added the

labels

2026-02-21 16:14:51 -05:00

deekerman commented

2026-02-21 16:14:54 -05:00

Author

Owner

@xavier2k6 commented on GitHub (May 23, 2025):

ANNOUNCEMENT!

For anybody coming across this "Feature Request" & would like/love to see a potential implementation in the future!
Here are some options available to you:

Please select/click the 👍 &/or ❤ reactions in the original/opening post of this ticket.
Please feel free (If you have the "skillset") to create a "Pull Request" implementing what's being requested in this ticket.
(new/existing contributors/developers are always welcome)

DO:

Provide constructive feedback.
Display how other projects implemented same/similar etc.

DO NOT:

Add a "Bump", "me too", "2nd/3rd" etc. or "criticizing" comment(s).
(These will be disregarded/hidden as "spam/abuse/off-topic" etc. as they don't provide anything constructive.)

@xavier2k6 commented on GitHub (May 23, 2025): ## ANNOUNCEMENT! For anybody coming across this **_"Feature Request"_** & would like/love to see a potential implementation in the future! **Here are some options available to you:** 1. Please select/click the 👍 **&/or** ❤ `reactions` in the original/opening post of this ticket. 2. Please feel free _(If you have the "skillset")_ to create a **_"Pull Request"_** implementing what's being requested in this ticket. **_(new/existing contributors/developers are always welcome)_** ____ **DO:** * Provide constructive feedback. * Display how other projects implemented same/similar etc. **DO NOT:** * Add a "Bump", "me too", "2nd/3rd" etc. or "criticizing" comment(s). **(These will be disregarded/hidden as "spam/abuse/off-topic" etc. as they don't provide anything constructive.)**