Skip to content

Commit 85b65cc

Browse files
infeoinfeo
committed
Merge branch 'develop'
2 parents b260b47 + cd78744 commit 85b65cc

File tree

7 files changed

+205
-54
lines changed

7 files changed

+205
-54
lines changed

‎.github/workflows/update-windows-info.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Updates verify-installers.md after desktop release
2+
3+
on:
4+
repository_dispatch:
5+
types: [desktop-release]
6+
7+
defaults:
8+
run:
9+
shell: bash
10+
11+
12+
jobs:
13+
create-pr:
14+
name: Create PR to update windows signing cert
15+
runs-on: windows-latest
16+
permissions:
17+
contents: write
18+
env:
19+
DESKTOP_VERSION: ${{ github.event.client_payload.version }}
20+
steps:
21+
- name: Checkout repo
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
- name: Create new branch
24+
run: |
25+
git config --global --add safe.directory "$GITHUB_WORKSPACE"
26+
if [[ ! "$DESKTOP_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z]+)*$ ]]; then
27+
echo "Invalid version in payload: $DESKTOP_VERSION" >&2
28+
exit 1;
29+
fi
30+
git checkout -b "feature/desktop-${DESKTOP_VERSION}"
31+
- name: Download MSI
32+
run: |
33+
MSI_URL=$(jq -r '[.[] | select(.name | endswith(".msi"))][0].browser_download_url // "null"' <<< "$ASSETS_JSON")
34+
if [[ "$MSI_URL" == "null" || -z "$MSI_URL" ]]; then
35+
echo "No MSI asset found in repository_dispatch payload." >&2
36+
exit 1
37+
fi
38+
curl --silent --fail-with-body --proto "=https" -L -H "Accept: application/vnd.github+json" $MSI_URL --output cryptomator.msi
39+
env:
40+
ASSETS_JSON: ${{ toJson(github.event.client_payload.release.assets ) }}
41+
- name: Update verify-installers.md
42+
shell: pwsh
43+
run: |
44+
$Thumbprint = (Get-AuthenticodeSignature -FilePath 'cryptomator.msi' -ErrorAction Stop).SignerCertificate.Thumbprint
45+
46+
$DocPath = 'docs/security/verify-installers.md'
47+
$Content = Get-Content -Path $DocPath -Raw
48+
49+
$CurrentThumbprintRegex = [regex] ([regex]::Escape($env:AUTOMATION_MARKER) + '`[A-F0-9]+`')
50+
$UpdatedContent = $CurrentThumbprintRegex.Replace($Content, ($env:AUTOMATION_MARKER + '`' + $Thumbprint + '`'), 1)
51+
if ($UpdatedContent -eq $Content) {
52+
throw 'Failed to update the current Windows thumbprint in verify-installers.md.'
53+
}
54+
$Content = $UpdatedContent
55+
56+
$MarkedRow = (Get-Content -Path $DocPath | Where-Object { $_.TrimStart().StartsWith('|') -and $_.Contains($env:AUTOMATION_MARKER) } | Select-Object -First 1)
57+
if ($null -eq $MarkedRow) {
58+
throw 'Failed to find the marked Windows certificate table row in verify-installers.md.'
59+
}
60+
61+
$PreviousRow = $MarkedRow.Substring(0, $MarkedRow.IndexOf($env:AUTOMATION_MARKER)).TrimEnd() + " |"
62+
$NewRow = "| $env:DESKTOP_VERSION |" + '`' + $Thumbprint + '`' + "$env:AUTOMATION_MARKER |"
63+
$Content = $Content.Replace($MarkedRow, $NewRow + "`r`n" + $PreviousRow)
64+
65+
Set-Content -Path $DocPath -Value $Content
66+
env:
67+
AUTOMATION_MARKER: '<!-- AUTOMATION MARKER FOR WORKFLOW -->'
68+
- name: Commit and push
69+
id: commit-and-push
70+
run: |
71+
git config user.name "cryptobot"
72+
git config user.email "cryptobot@users.noreply.github.com"
73+
git config push.autoSetupRemote true
74+
git stage docs/security/verify-installers.md
75+
if git diff --cached --quiet; then
76+
echo "No changes to commit"
77+
echo "changed=false" >> "$GITHUB_OUTPUT"
78+
exit 0
79+
fi
80+
git commit -m "Update Windows section for verifying installers for release ${DESKTOP_VERSION}"
81+
git push
82+
echo "changed=true" >> "$GITHUB_OUTPUT"
83+
- name: Create pull request
84+
id: create-pr
85+
if: steps.commit-and-push.outputs.changed == 'true'
86+
run: |
87+
printf "Created by $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > pr_body.md
88+
PR_URL=$(gh pr create --title "Desktop release ${DESKTOP_VERSION}" --body-file pr_body.md)
89+
echo "url=$PR_URL" >> "$GITHUB_OUTPUT"
90+
env:
91+
GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
92+
- name: Slack Notification
93+
if: steps.commit-and-push.outputs.changed == 'true'
94+
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
95+
env:
96+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }}
97+
SLACK_USERNAME: 'Cryptobot'
98+
SLACK_ICON: false
99+
SLACK_ICON_EMOJI: ':bot:'
100+
SLACK_CHANNEL: 'cryptomator-desktop'
101+
SLACK_TITLE: "Docs update PR created for release ${{ github.event.client_payload.version }} ."
102+
SLACK_MESSAGE: "See <${{ steps.create-pr.outputs.url }}|PR> on how to proceed."
103+
SLACK_FOOTER: false
104+
MSG_MINIMAL: true

‎docs/desktop/accessing-vaults.md‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -58,20 +58,7 @@ On Windows, you can choose the drive letter of the virtual drive for each vault
5858

5959
## Locate Encrypted File {#locate-encrypted-file}
6060

61-
The Locate Encrypted File feature helps users find the encrypted version of a specific file. This feature is particularly useful when vault files are versioned and the user wants to restore an older version of a file. As Cryptomator encrypts filenames and obfuscates directory structures, users first locate the encrypted file and then restore an older version of the encrypted file with the third party app.
62-
63-
1. Unlock the desired vault.
64-
2. Click on the `Locate Encrypted File` button.
65-
3. Select the file within the vault.
66-
67-
As an alternative for clicking the button, you can directly drag & drop a file onto the button.
68-
69-
A file manager window opens showing the encrypted folder and marking the encrypted file.
70-
71-
<video controls autoplay loop muted style={{width: '100%', maxWidth: '1280px', height: 'auto'}}>
72-
<source src="/vid/locate-encrypted-file.mov" type="video/mp4" />
73-
Your browser does not support the video tag.
74-
</video>
61+
See [Locate Encrypted File](/docs/desktop/encrypted-file-names.md#locate-encrypted-file) in the Encrypted File Names section.
7562

7663
## File System Case Sensitivity {#file-system-case-sensitivity}
7764

‎docs/desktop/encrypted-file-names.md‎

Lines changed: 58 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,59 @@ sidebar_position: 7
77
# Encrypted File Names
88

99
:::info
10-
Neither file name nor directory structure encryption can be disabled.
10+
File name and directory structure encryption **cannot** be disabled.
1111
:::
1212

13-
Cryptomator protects your files by not only encrypting their content, but also their names and the overall directory structure of the vault.
14-
For example, if you have a directory structure inside your vault like this:
13+
Cryptomator protects your files by not only encrypting their content, but also their names and the overall directory structure of the vault. As a result, encrypted files and folders inside the vault storage location do not reveal the original names or layout (for an example see [below](#technical-example)).
14+
15+
This matters whenever you need to match a cleartext file in your unlocked vault with its encrypted counterpart in the vault storage location, for example when restoring an older version from a cloud provider or backup tool.
16+
17+
The app offers two features to reveal the mapping between the cleartext and the encrypted files:
18+
* `Locate Encrypted File`: You have the cleartext file in the unlocked vault and want to find its encrypted counterpart in the vault storage location.
19+
* `Decrypt File Name`: You have an encrypted vault file and want to know its original cleartext name.
20+
21+
<Image src="/img/desktop/encrypted-file-names-vault-detail-unlocked.png" alt="Vault detail view in the unlocked state" width="495" height="381" />
22+
23+
## Locate Encrypted File {#locate-encrypted-file}
24+
25+
The Locate Encrypted File feature helps you find the encrypted counterpart of a file from inside the vault. This comes in handy when you want to restore an older version of a file. As Cryptomator encrypts file names and obfuscates directory structures, first locate the encrypted file and then restore an older version of the encrypted file with your third-party app.
26+
27+
1. Unlock the desired vault.
28+
2. Click on the `Locate Encrypted File` button.
29+
3. Select the file within the vault.
30+
31+
As an alternative for clicking the button, you can directly drag & drop a file onto the button.
32+
33+
A file manager window opens showing the encrypted folder and marking the encrypted file inside the vault storage location.
34+
35+
## Decrypt File Name {#decrypt-file-name}
36+
37+
The Decrypt File Name feature helps you resolve encrypted file names back to their original cleartext names.
38+
39+
1. Unlock the desired vault.
40+
2. Click on the `Decrypt File Name` zone at the bottom of the unlocked view.
41+
3. Select the encrypted file.
42+
43+
As an alternative for clicking the zone, you can directly drag & drop files onto it.
44+
45+
A modal window opens showing a two-column table with the encrypted names on the left and their decrypted, cleartext names on the right.
46+
47+
<Image src="/img/desktop/decrypt-file-names.png" alt="Decrypt file names window" width="311" height="385" />
48+
49+
The action bar at the top of the table provides two buttons:
50+
* Clipboard button to copy the whole table as CSV into the system clipboard
51+
* Trash button to clear the table
52+
53+
You can select single cells and copy their content with the OS-specific keyboard shortcut.
54+
55+
:::note
56+
For technical reasons, Cryptomator can only decrypt the *file name* of a given encrypted file.
57+
It cannot tell where that file is located in the unlocked vault.
58+
:::
59+
60+
## Technical Example
61+
62+
If you have a directory structure inside your vault like this:
1563

1664
```
1765
.
@@ -40,30 +88,13 @@ The actual directory structure of the vault on your hard drive/cloud will look l
4088
└─ vault.cryptomator
4189
```
4290

43-
While this increases security, it also makes it impossible to see the original file names and directory structure without decrypting them first.
44-
When you need to know the original name of a file (e.g. to restore an older version), you can use the `Decrypt File Name` feature to decrypt the file name.
45-
46-
## Decrypting File Names {#decrypting-file-names}
91+
This is why you cannot identify files in the vault storage location by name alone without decrypting them first. For more information about the vault encryption scheme read [the specification](/docs/security/vault.md).
4792

48-
:::note
49-
Due to technical reasons, given only an encrypted file Cryptomator can only decrypt its name.
50-
It cannot compute its cleartext path.
51-
:::
52-
53-
You can access this feature from the unlocked view of a vault in the Cryptomator main window.
54-
On the bottom of the unlocked view, drop files on the `Decrypt File Name` zone or click on it.
55-
A modal window with the encrypted-decrypted-mapping opens.
56-
57-
<Image src="/img/desktop/vault-detail-unlocked.png" alt="Vault detail view in the unlocked state" width="495" height="381" />
58-
59-
The encrypted-decrypted-table has an action bar at the top with two buttons:
60-
* Clipboard button to copy the whole table as a CSV into the system clipboard
61-
* Trash button to clear the table
62-
63-
<Image src="/img/desktop/decrypt-file-names.png" alt="Decrypt file names window" width="311" height="385" />
93+
## Video Walkthrough
6494

65-
Encrypted file names and their corresponding decrypted, original name are shown inside a two column table, with the encrypted names on the right.
66-
If you have not dropped any files, the table is empty.
67-
You can click inside the empty table to select files with a file picker dialog.
95+
The following video demonstrates both features in action: first, **Locate Encrypted File** to find the encrypted counterpart of a file, and then **Decrypt File Name** to resolve an encrypted file name back to its original name.
6896

69-
Once the table has content, you can select single cells and copy their content with the OS specific keyboard copy shortcut.
97+
<video controls autoplay loop muted style={{width: '100%', maxWidth: '1280px', height: 'auto'}}>
98+
<source src="/vid/file-names.mov" type="video/mp4" />
99+
Your browser does not support the video tag.
100+
</video>

‎docs/security/verify-installers.md‎

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,24 +28,53 @@ If shown, you can ignore the following warning:
2828

2929
## Windows (exe, msi) {#windows}
3030

31-
Our Windows installers are signed using a code signing certificate. You can verify the signature in five simple steps:
31+
Our Windows installers are signed using a code signing certificate. You can verify the signature in three simple steps:
3232

33-
<Image src="/img/security/verify-win-installer.png" srcset=" /img/security/verify-win-installer 1x, /img/security/verify-win-installer@2x.png 2x" alt="How to check the code signing certificate on Windows" width="1316" height="767" />
33+
1. Open Terminal or PowerShell (found in Windows Start menu).
34+
2. Run either of the following commands to check the signature of the corresponding file:
35+
```pwsh
36+
Get-AuthenticodeSignature -FilePath "~\Downloads\Cryptomator-*.msi"
37+
Get-AuthenticodeSignature -FilePath "~\Downloads\Cryptomator-*.exe"
38+
```
39+
3. Verify that the output includes:
40+
- Column `SignerCertificate` with value <!-- AUTOMATION MARKER FOR WORKFLOW -->`20F30D7C5B1AB3ACAFA4AB27874ACBC4B47B0697`(*)
41+
- Column `Status` with value `Valid`
42+
- no errors
43+
44+
*for older releases, see [below](#windows-all-versions).
45+
46+
If the installer is properly signed, you should see output similar to:
47+
```text
48+
SignerCertificate Status StatusMessage Path
49+
----------------- ------ ------------- ----
50+
BB0E... Valid Signature verified. Cryptomator-1.19.1-x64.msi
51+
```
3452

35-
1. Right-click on the file and click on Properties.
53+
You can also inspect the certificate manually:
54+
1. Right-click on the cryptomator installer file and click on Properties.
3655
2. Select the Digital Signatures tab: It should show one or more signatures by `Skymatic GmbH` under Embedded Signatures.
3756
- For releases since 1.18.0, the `exe` release artifact will have two signatures, and the `msi` release artifact will have one signature.
3857
3. Click on the first signature, and then click Details.
39-
4. Click on View Certificates.
40-
5. Click the Details tab. Different Cryptomator versions are signed with different certificates. The following list shows for each version the certificate serial number:
41-
- Version 1.19.2: `33000890b1b9dff7ee6e525b2d0000000890b1`
42-
- Version 1.19.1: `33000852bd6c3a151ff92180ee0000000852bd`
43-
- Version 1.19.0: `3300083c47651e1daeb99b00eb000000083c47`
44-
- Version 1.18.1: `330007d28ad57305892a81cac600000007d28a`
45-
- Version 1.18.0: `3300052c3561155e2baf361702000000052c35`
46-
- Versions 1.6.11 to 1.17.1: `00d77e4f8b938f56ae265cd08e9193490c`
47-
- Versions 1.4.12 to 1.6.10: `63c45bff1a148d60ed2994d3a2639034`
48-
- Versions up to 1.4.11: `1a360f3933964c71f14e8754d94615d4`
58+
4. Click on View Certificates and select the field `Thumbprint`.
59+
60+
<Image src="/img/security/verify-win-installer.png" srcset=" /img/security/verify-win-installer 1x, /img/security/verify-win-installer@2x.png 2x" alt="How to check the code signing certificate on Windows" width="1316" height="767" />
61+
62+
### Certificate thumbprints for all Cryptomator versions {#windows-all-versions}
63+
64+
Every Cryptomator installer is signed with a certificate. A certificate is identified by its thumbprint. The signing certificate changed over time and the following table shows for each version the certificate thumbprint:
65+
66+
| Version(s) | Certificate Thumbprint |
67+
|---------------------|--------------------------------------------|
68+
| 1.19.2 | `20F30D7C5B1AB3ACAFA4AB27874ACBC4B47B0697`<!-- AUTOMATION MARKER FOR WORKFLOW --> |
69+
| 1.19.1 | `BB0EEBF8E92E4584DF4B6AE4F9577B60BEB5DF4C` |
70+
| 1.19.0 | `14524B1F8A3A1CA8B24B769C7C6DC92851120B22` |
71+
| 1.18.1 | `53FA929F6D50D5E2AE59A7C9A9750D373AFF7D40` |
72+
| 1.18.0 | `4DC9A70B94F731562A9C37B4391C4FD5BEC72C94` |
73+
| 1.6.11 to 1.17.1 | `5FC94CE149E5B511E621F53A060AC67CBD446B3A` |
74+
| 1.4.12 to 1.6.10 | `FF52240075AD7D14AF25629FDF69635357C7D14B` |
75+
| up to 1.4.11 | `6FDEC9DFCFE59E6BAEE64B7ED97F00E120E70D97` |
76+
77+
4978

5079
## macOS (app) {#macos}
5180

‎static/img/desktop/decrypt-file-names.png‎

252 KB
Loading

‎static/img/desktop/encrypted-file-names-vault-detail-unlocked.png‎

216 KB
Loading

‎static/vid/file-names.mov‎

10.8 MB
Binary file not shown.

0 commit comments

Comments
 (0)