IJHack / QtPass / 35457665089

93%

Build Type

push

github

Committed by web-flow

Commit Message

Verify the .gpg-id bytes that are used, commit list and signature together (#1843)

* Verify the .gpg-id bytes that are used, commit list and signature together

Three related holes in the signed-recipients model, all from reading the
file more than once:

The signature was checked on the path and the recipients were then read
from the file again, in Insert() and in the re-encryption loop. Anyone
who can write to the store in that window chooses the recipients. gpg now
verifies the bytes on stdin (`--verify <sig> -`), Pass::parseRecipients
parses those same bytes, and the re-encryption cache maps each .gpg-id to
the recipient list its verified contents held.

The .gpg-id and its signature went into two commits, so the history had a
state with the new list under the old signature, permanently when the
second commit failed; and Init() started re-encrypting even when the
commit had failed, leaving the working tree on a list the repository did
not have. One add and one commit for both files now, nothing committed
when nothing changed, and a failed commit ends Init with processErrorExit
before any entry is touched.

A failed automatic pull before re-encryption aborts the run when it left
unmerged files; a pull that only failed to reach the remote continues as
before. The profile form requires full fingerprints as signing key, since
that is what pass compares with gpg's VALIDSIG.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* Wrap a comment clang-format did not like

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* Write .gpg-id atomically and stop when it fails; diff exit codes; wording

writeGpgIdFile ignored write errors and Init went on to sign and
re-encrypt whatever landed on disk, so a full disk turned the chosen
recipients into a truncated, correctly signed list. QSaveFile now, the
result ... (continued)

Coverage Stats

103 of 123 new or added lines in 4 files covered. (83.74%)

6 existing lines in 1 file now uncovered.

6692 of 8643 relevant lines covered (77.43%)

73.95 hits per line