Allow unsigned nested plugins if parent is allowed (#45)

ni · Nov 12, 2024 · 5f2a746 · 5f2a746
1 parent a347048
commit 5f2a746
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/pkg/plugins/manager/signature/authorizer.go b/pkg/plugins/manager/signature/authorizer.go
@@ -34,5 +34,14 @@ func (u *UnsignedPluginAuthorizer) CanLoadPlugin(p *plugins.Plugin) bool {
 		}
 	}
 
+	// Allow a plugin to be unsigned when nested in an whitelisted app plugin
+	if p.Parent != nil {
+		for _, pID := range u.cfg.PluginsAllowUnsigned {
+			if pID == p.Parent.ID {
+				return true
+			}
+		}
+	}
+
 	return false
 }