diff options
| author | Allan McRae <allan@archlinux.org> | 2022-03-06 21:19:57 +1000 |
|---|---|---|
| committer | Allan McRae <allan@archlinux.org> | 2022-03-06 21:25:30 +1000 |
| commit | 632eb9739d23181996cc3f4fb069b81eb0e998c7 (patch) | |
| tree | 290a97f1abbcb890333a1058c055fa39854e1ec5 | |
| parent | 6b37d9943183f662cbd9be9031e5e7ba6fd6bea1 (diff) | |
Do not use WKD to import keys for package installs from a file
In order to use WKD in pacman -U/--upgrade operations, we need to
get the packager information from the .PKGINFO within the package.
That has obvious security implications. e.g. something like this
could convince a user to download a different key to what they
expect:
packager = foo bar <>^[[2K^[[0G:: Import PGP key DEADBEEF, "foo <bar>
While downloading an untrusted key has little impact due to the
web-of-trust model used by pacman, this could be bad in combination
with an exploit that allowed trust of keys in the keyring to be
altered.
To be safe, do not use WKD when installing using -U.
Fixes FS#73703.
Signed-off-by: Allan McRae <allan@archlinux.org>
| -rw-r--r-- | lib/libalpm/be_package.c | 9 |
1 files changed, 1 insertions, 8 deletions
diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index e837ffb8..203c98c1 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -721,7 +721,6 @@ int SYMEXPORT alpm_pkg_load(alpm_handle_t *handle, const char *filename, int ful int validation = 0; char *sigpath; alpm_pkg_t *pkg_temp; - char *packager; CHECK_HANDLE(handle, return -1); ASSERT(pkg != NULL, RET_ERR(handle, ALPM_ERR_WRONG_ARGS, -1)); @@ -747,13 +746,7 @@ int SYMEXPORT alpm_pkg_load(alpm_handle_t *handle, const char *filename, int ful char *key = k->data; if(_alpm_key_in_keychain(handle, key) == 0) { pkg_temp = _alpm_pkg_load_internal(handle, filename, full); - if(pkg_temp) { - packager = pkg_temp->packager; - - } else { - packager = NULL; - } - if(_alpm_key_import(handle, packager, key) == -1) { + if(_alpm_key_import(handle, NULL, key) == -1) { fail = 1; } _alpm_pkg_free(pkg_temp); |