openvscode-server: Extension signature verification unconditionally disabled in all openvscode-server releases

[geo-chen]

reported via email on 27 May 2026 - no response:

I would like to report a security issue in the openvscode-server fork of VS Code.

In src/vs/platform/extensionManagement/node/extensionManagementService.ts, the class ExtensionManagementService contains a method not present in upstream microsoft/vscode:

private disableSignatureVerification() {
    return true;
}

This method is called during every gallery (marketplace) extension download at line 349, forcing verifySignature = false unconditionally. The result is that openvscode-server never performs cryptographic signature validation on gallery extensions, regardless of user settings or the VerifyExtensionSignatureConfigKey configuration. Upstream VS Code Server would reject unsigned or tampered extensions with a SignatureVerificationFailed error.

This affects all tagged releases through v1.109.5 (the latest as of this report) and the current HEAD (commit 2bfb814).

The practical risk is:

• Any tampered gallery extension that upstream VS Code would detect and block installs silently.
• Any unsigned or typosquatted extension that upstream VS Code would reject with a signing error installs without warning.
• Enterprise and cloud deployments that rely on extension signing as a supply-chain integrity control have that control silently removed.

I would suggest restoring the upstream behavior by removing disableSignatureVerification() and the block that calls it, allowing the standard VerifyExtensionSignatureConfigKey configuration path to govern verification as it does in microsoft/vscode.