code audit vs SigSpoof: Spoofing signatures in GnuPG - CVE-2018-12020

[adrelanos]

https://neopg.io/blog/gpg-signature-spoof
https://blog.patternsinthevoid.net/pretty-bad-protocolpeople.html

Does it look like any code changes are advisable?

[marmarek]

I've just checked again and it looks to be fine - in no place we mix --verbose output with --status-fd output. Places I've checked:

• verify-git-tag script in qubes-builder - uses git verify-tag, --verbose isn't used
• command verification in builder-github - uses separate fd for status-fd (not stderr), also no --verbose in use

[marmarek]

I've just checked again and it looks to be fine - in no place we mix --verbose output with --status-fd output. Places I've checked:

• verify-git-tag script in qubes-builder - uses git verify-tag, --verbose isn't used
• command verification in builder-github - uses separate fd for status-fd (not stderr), also no --verbose in use