plugin signature validation

app/scripts/plugins/plugin-manager.js

@@ -42,10 +42,13 @@ const PluginManager = Backbone.Model.extend({
         });
     },
 
-    install(url, expectedManifest) {
+    install(url, expectedManifest, skipSignatureValidation) {
         this.trigger('change');
         return Plugin.loadFromUrl(url, expectedManifest).then(plugin => {
             return this.uninstall(plugin.id).then(() => {
+                if (skipSignatureValidation) {
+                    plugin.set('skipSignatureValidation', true);
+                }
                 return plugin.install(true, false).then(() => {
                     this.get('plugins').push(plugin);
                     this.trigger('change');

app/scripts/plugins/plugin.js

@@ -41,7 +41,8 @@ const Plugin = Backbone.Model.extend(_.extend({}, PluginStatus, {
         installTime: null,
         installError: null,
         updateCheckDate: null,
-        updateError: null
+        updateError: null,
+        skipSignatureValidation: false
     },
 
     resources: {},
@@ -106,6 +107,9 @@ const Plugin = Backbone.Model.extend(_.extend({}, PluginStatus, {
         if (!manifest.publicKey) {
             return 'No plugin public key';
         }
+        if (!this.get('skipSignatureValidation') && manifest.publicKey !== SignatureVerifier.getPublicKey()) {
+            return 'Public key mismatch';
+        }
         if (!manifest.resources || !Object.keys(manifest.resources).length) {
             return 'No plugin resources';
         }

app/scripts/views/settings/settings-plugins-view.js

@@ -125,7 +125,7 @@ const SettingsPluginsView = Backbone.View.extend({
         urlTextBox.prop('disabled', true);
         installBtn.text(Locale.setPlInstallBtnProgress + '...').prop('disabled', true);
         this.installFromUrl = { url };
-        PluginManager.install(url)
+        PluginManager.install(url, undefined, true)
             .then(() => {
                 this.installFinished();
                 this.installFromUrl = null;

release-notes.md

@@ -14,6 +14,7 @@ Release notes
 `*` clear clipboard on exit  
 `*` don't remove spaces in custom fields  
 `*` auto-type on subdomains  
+`*` plugin signature validation  
 
 ##### v1.5.6 (2017-08-31)
 `-` fix #722: hang on start in desktop