mirror of
https://github.com/moparisthebest/pacman
synced 2024-08-13 17:03:46 -04:00
pacman-key: stricter parsing for -verify
Prevents trust being spoofed by using TRUST_FULLY in the signatory's name or in an added notation. Fixes FS#41147. Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
parent
3e19cd366a
commit
879e4665c4
@ -482,7 +482,7 @@ verify_sig() {
|
|||||||
local ret=0
|
local ret=0
|
||||||
for sig; do
|
for sig; do
|
||||||
msg "Checking %s ..." "$sig"
|
msg "Checking %s ..." "$sig"
|
||||||
if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" | grep -qE 'TRUST_(FULLY|ULTIMATE)'; then
|
if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE)$'; then
|
||||||
error "$(gettext "The signature identified by %s could not be verified.")" "$sig"
|
error "$(gettext "The signature identified by %s could not be verified.")" "$sig"
|
||||||
ret=1
|
ret=1
|
||||||
fi
|
fi
|
||||||
|
Loading…
Reference in New Issue
Block a user