diff --git a/arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java b/arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java index e196d9b41..f38d81e4c 100644 --- a/arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java +++ b/arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java @@ -81,17 +81,20 @@ public class ContributionsIndexer { } public void parseIndex() throws Exception { - File defaultIndexFile = getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME); + // Read bundled index... File bundledIndexFile = new File(builtInHardwareFolder, Constants.BUNDLED_INDEX_FILE_NAME); - - // Check main index signature - if (!PreferencesData.getBoolean("allow_insecure_packages") && !signatureVerifier.isSigned(defaultIndexFile)) { - throw new SignatureVerificationFailedException(Constants.DEFAULT_INDEX_FILE_NAME); - } - - // Read bundled index and overlay the default index index = parseIndex(bundledIndexFile); - mergeContributions(parseIndex(defaultIndexFile), defaultIndexFile); + + // ...and overlay the default index if present + File defaultIndexFile = getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME); + if (defaultIndexFile.exists()) { + // Check main index signature + if (!PreferencesData.getBoolean("allow_insecure_packages") && !signatureVerifier.isSigned(defaultIndexFile)) { + throw new SignatureVerificationFailedException(Constants.DEFAULT_INDEX_FILE_NAME); + } + + mergeContributions(parseIndex(defaultIndexFile), defaultIndexFile); + } // Set main and bundled indexes as trusted index.getPackages().forEach(pack -> pack.setTrusted(true)); diff --git a/arduino-core/src/processing/app/BaseNoGui.java b/arduino-core/src/processing/app/BaseNoGui.java index 1cef43cbf..b160605c5 100644 --- a/arduino-core/src/processing/app/BaseNoGui.java +++ b/arduino-core/src/processing/app/BaseNoGui.java @@ -610,30 +610,12 @@ public class BaseNoGui { static public void initPackages() throws Exception { indexer = new ContributionsIndexer(getSettingsFolder(), getHardwareFolder(), getPlatform(), new GPGDetachedSignatureVerifier()); - File indexFile = indexer.getIndexFile("package_index.json"); - File defaultPackageJsonFile = new File(getContentFile("dist"), "package_index.json"); - if (!indexFile.isFile() || (defaultPackageJsonFile.isFile() && defaultPackageJsonFile.lastModified() > indexFile.lastModified())) { - FileUtils.copyFile(defaultPackageJsonFile, indexFile); - } else if (!indexFile.isFile()) { - // Otherwise create an empty packages index - FileOutputStream out = null; - try { - out = new FileOutputStream(indexFile); - out.write("{ \"packages\" : [ ] }".getBytes()); - } finally { - IOUtils.closeQuietly(out); - } - } - - File indexSignatureFile = indexer.getIndexFile("package_index.json.sig"); - File defaultPackageJsonSignatureFile = new File(getContentFile("dist"), "package_index.json.sig"); - if (!indexSignatureFile.isFile() || (defaultPackageJsonSignatureFile.isFile() && defaultPackageJsonSignatureFile.lastModified() > indexSignatureFile.lastModified())) { - FileUtils.copyFile(defaultPackageJsonSignatureFile, indexSignatureFile); - } try { indexer.parseIndex(); } catch (JsonProcessingException | SignatureVerificationFailedException e) { + File indexFile = indexer.getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME); + File indexSignatureFile = indexer.getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME + ".sig"); FileUtils.deleteIfExists(indexFile); FileUtils.deleteIfExists(indexSignatureFile); throw e;