Fix: validate pacman signing key before allowing update by Naveen-Boddepalli · Pull Request #9706 · warpdotdev/warp

Naveen-Boddepalli · 2026-05-01T03:56:01Z

Description

Summary

This PR improves the pacman update flow by validating the signing key before proceeding with the update.

Currently, Warp checks for the presence and expiration of the pacman signing key, but does not verify whether the key is valid at the trust level (e.g., revoked, expired, or otherwise unusable). This can lead to update failures during package installation due to signature verification errors.

Changes

Added parsing of the pub: line from GPG output to extract the validity field
Ensured only valid keys (f = full, u = ultimate) are accepted
Return false for invalid states (e, r, -, q) to trigger key reconfiguration
Preserved existing expiry checks and overall logic flow

Impact

Prevents update attempts with invalid or misconfigured pacman signing keys, improving reliability and user experience on pacman-based systems.

Happy to make further changes if needed.

Linked Issue

N/A

The linked issue is labeled ready-to-spec or ready-to-implement.
Where appropriate, screenshots or a short video of the implementation are included below (especially for user-visible or UI changes).

Screenshots / Videos

N/A

Testing

Verified correctness of GPG output parsing logic
Ensured compatibility with existing expiry validation
Confirmed no changes to external interfaces or update flow beyond validation

No new tests were added as this is a small internal validation improvement.

Agent Mode

Warp Agent Mode - This PR was created via Warp's AI Agent Mode

cla-bot · 2026-05-01T03:56:05Z

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have the users @Naveen-Boddepalli on file. In order for us to review and merge your code, each contributor must visit https://cla.warp.dev to read and agree to our CLA. Once you have done so, please comment @cla-bot check to trigger another check.

oz-for-oss · 2026-05-01T03:56:13Z

@Naveen-Boddepalli

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I reviewed this pull request and requested human review from: @warpdotdev/oss-maintainers.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Naveen-Boddepalli · 2026-05-01T04:00:46Z

Hi! This PR adds validation for pacman signing key validity to prevent update failures due to invalid keys. Happy to make any changes if needed.

oz-for-oss

Overview

This PR updates the pacman signing-key detection path to inspect GPG's colon-formatted pub validity field before treating the key as configured, while preserving the existing expiration checks.

Concerns

No blocking correctness or security concerns found in the changed hunk.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Naveen-Boddepalli · 2026-05-01T04:02:23Z

recheck

Naveen-Boddepalli · 2026-05-01T04:08:28Z

/oz-review

Naveen-Boddepalli · 2026-05-01T04:08:32Z

/oz-review

Naveen-Boddepalli · 2026-05-01T04:08:35Z

/oz-review

oz-for-oss · 2026-05-01T04:08:38Z

@Naveen-Boddepalli

I'm re-reviewing this pull request in response to a review request.

You can view the conversation on Warp.

I reviewed this pull request and requested human review from: @warpdotdev/oss-maintainers.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss · 2026-05-01T04:08:43Z

@Naveen-Boddepalli

I'm re-reviewing this pull request in response to a review request.

You can view the conversation on Warp.

I reviewed this pull request and requested human review from: @warpdotdev/oss-maintainers.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss · 2026-05-01T04:08:45Z

@Naveen-Boddepalli

I'm re-reviewing this pull request in response to a review request.

You can view the conversation on Warp.

I reviewed this pull request and requested human review from: @warpdotdev/oss-maintainers.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss

Overview

This PR adds a pub: validity check to the pacman signing-key detection path before preserving the existing expiry validation. The change causes revoked, expired, unknown, or otherwise insufficiently trusted keys to be treated as needing reconfiguration before update.

Concerns

No blocking correctness or security concerns found in the changed lines.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss

Overview

This PR adds a GPG colon-format validity check before the existing pacman signing-key expiry validation, so invalid, revoked, expired, or untrusted keys trigger key reconfiguration before update.

Concerns

GnuPG documents the validity field as a leading letter that may include additional appended data in future versions; exact string matching can create false negatives. The inline suggestion keeps the same policy while parsing the documented leading letter.

Verdict

Found: 0 critical, 0 important, 1 suggestions

Approve with nits

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>

oz-for-oss

Overview

This PR adds a GPG colon-format validity check before the existing pacman signing-key expiry validation, so invalid, revoked, expired, or untrusted keys trigger key reconfiguration before update.

Concerns

GnuPG documents the validity field as a leading letter that may include additional appended data in future versions; exact string matching can create false negatives. The inline suggestion keeps the same policy while parsing the documented leading letter.

Verdict

Found: 0 critical, 0 important, 1 suggestions

Approve with nits

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>

oz-for-oss

Overview

This PR adds validation of the GPG pub: validity field for Warp's pacman signing key before preserving the existing expiry check. Invalid or unusable trust states now cause the update flow to reconfigure the key before running pacman.

Concerns

No blocking correctness or security concerns found in the changed lines.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

vorporeal · 2026-05-04T17:08:42Z

hey @Naveen-Boddepalli, was there a particular issue you or another user ran into that this change is fixing?

Naveen-Boddepalli · 2026-05-05T05:18:06Z

Hi! I didn’t encounter a specific user-facing failure personally, but while looking at the pacman key validation logic I noticed that we only check for key presence and expiration, and not the GPG validity state.

In cases where a key is revoked, expired, or not trusted, GPG marks it as invalid (e.g., e, r, q, etc.), but the current logic could still treat it as usable if the expiration check passes. This could allow pacman to proceed with a key that isn’t actually valid, potentially causing failures during package verification. This change ensures we catch those cases earlier and trigger key reconfiguration before attempting the update, aligning better with GPG’s trust model.

Happy to adjust the approach if you think this should be handled differently.

vorporeal

that makes sense! just wanted to understand the source of the PR. thanks for the contribution!

vorporeal · 2026-05-06T14:48:39Z

+    if !matches!(validity, 'f' | 'u') {
+        return false; // Force key reconfiguration
+    }
+    if !matches!(validity, 'f' | 'u') {
+        return false; // Force key reconfiguration
+    }


can you remove the duplicated check? (the suggested diffs sometimes don't target the correct range, leading to issues like this)

Removed the duplicated validity check — thanks for catching that.

Removed redundant validity check for key reconfiguration.

) ## Description ## Summary This PR improves the pacman update flow by validating the signing key before proceeding with the update. Currently, Warp checks for the presence and expiration of the pacman signing key, but does not verify whether the key is valid at the trust level (e.g., revoked, expired, or otherwise unusable). This can lead to update failures during package installation due to signature verification errors. ## Changes - Added parsing of the `pub:` line from GPG output to extract the validity field - Ensured only valid keys (`f` = full, `u` = ultimate) are accepted - Return false for invalid states (`e`, `r`, `-`, `q`) to trigger key reconfiguration - Preserved existing expiry checks and overall logic flow ## Impact Prevents update attempts with invalid or misconfigured pacman signing keys, improving reliability and user experience on pacman-based systems. Happy to make further changes if needed. ## Linked Issue N/A - [ ] The linked issue is labeled `ready-to-spec` or `ready-to-implement`. - [ ] Where appropriate, screenshots or a short video of the implementation are included below (especially for user-visible or UI changes). ## Screenshots / Videos N/A ## Testing - Verified correctness of GPG output parsing logic - Ensured compatibility with existing expiry validation - Confirmed no changes to external interfaces or update flow beyond validation No new tests were added as this is a small internal validation improvement. ## Agent Mode - [ ] Warp Agent Mode - This PR was created via Warp's AI Agent Mode --------- Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>

Fix: validate pacman signing key validity before allowing update

0cb3eb0

github-actions Bot added the external-contributor Indicates that a PR has been opened by someone outside the Warp team. label May 1, 2026

oz-for-oss Bot reviewed May 1, 2026

View reviewed changes

Comment thread app/src/autoupdate/linux.rs Outdated

Update app/src/autoupdate/linux.rs

be75ec2

Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>

cla-bot Bot added the cla-signed label May 1, 2026

oz-for-oss Bot reviewed May 1, 2026

View reviewed changes

Comment thread app/src/autoupdate/linux.rs

Update app/src/autoupdate/linux.rs

242be6d

Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>

oz-for-oss Bot reviewed May 1, 2026

View reviewed changes

captainsafia requested review from a team and zachbai and removed request for a team May 4, 2026 00:29

zachbai requested review from vorporeal and removed request for zachbai May 4, 2026 04:42

vorporeal approved these changes May 6, 2026

View reviewed changes

Simplify validity check in linux.rs

4a212cc

Removed redundant validity check for key reconfiguration.

vorporeal enabled auto-merge (squash) May 8, 2026 15:06

vorporeal merged commit c2565f5 into warpdotdev:master May 8, 2026
23 checks passed

timomak mentioned this pull request May 10, 2026

[twarp upstream] bootstrap-installers timomak/twarp#29

Merged

1 task

Conversation

Naveen-Boddepalli commented May 1, 2026

Description

Summary

Changes

Impact

Linked Issue

Screenshots / Videos

Testing

Agent Mode

Uh oh!

cla-bot Bot commented May 1, 2026

Uh oh!

oz-for-oss Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Naveen-Boddepalli commented May 1, 2026

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

Naveen-Boddepalli commented May 1, 2026

Uh oh!

Naveen-Boddepalli commented May 1, 2026

Uh oh!

Naveen-Boddepalli commented May 1, 2026

Uh oh!

Naveen-Boddepalli commented May 1, 2026

Uh oh!

oz-for-oss Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

vorporeal commented May 4, 2026

Uh oh!

Naveen-Boddepalli commented May 5, 2026

Uh oh!

vorporeal left a comment

Choose a reason for hiding this comment

Uh oh!

vorporeal May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Naveen-Boddepalli May 6, 2026

Choose a reason for hiding this comment

Uh oh!

oz-for-oss Bot commented May 1, 2026 •

edited

Loading

oz-for-oss Bot commented May 1, 2026 •

edited

Loading

oz-for-oss Bot commented May 1, 2026 •

edited

Loading

oz-for-oss Bot commented May 1, 2026 •

edited

Loading