Server: Apps with .htaccess file sometimes do not pass the integrity check

[MorrisJobke]

• having an app with an .htaccess file
• having a signature in this app
• install the app via appstore
• expected: signature passes
• actual: signature does not pass, because this .htaccess file is missing

We think that this is causes by the NC code do not allow to write .htaccess files in the apps.

See https://github.com/nextcloud/news/issues/297

[MorrisJobke]

cc @rullzer @blizzz @ChristophWurst

[MorrisJobke]

It seems that the file is actually in the archive, but does not get properly extracted :/

[Grotax]

I did some testing and digging and found the problem:
The file is ignored after extraction the extraction dir still contains the .htaccessfiles but after copyr the files are gone. This is caused by a blacklist check:
https://github.com/nextcloud/server/blob/master/lib/private/legacy/helper.php#L191
.htaccess is returned:
https://github.com/nextcloud/server/blob/master/lib/private/Files/Filesystem.php#L620

I guess .htaccess is blacklisted for a good reason and we can't simply remove it.

[MorrisJobke]

@Grotax Thanks - and suddenly all makes sense. So the approach by @rullzer was the correct one - it should simply not be packaged: https://github.com/nextcloud/news/pull/347

Thanks again for this finding. 👍