IJHack / QtPass / 35646452898

93%

Build Type

push

github

Committed by web-flow

Commit Message

.gpg-id and its signature: written staged, signed over the bytes written (#1884)

* .gpg-id and its signature: written staged, signed over the bytes written

The recipient list and its signature were the last writes of entries,
lists and signatures that opened a store path by name after the link
check: .gpg-id through QSaveFile, which resolves a link under the name at
open (from the Users dialog, a new profile, and a new folder seeded with
its parent's list), and .gpg-id.sig by gpg --detach-sign in place, with
gpg reading the list back by name to sign it. A co-writer of the store who
swapped the list between the write and the signing would have had the
user's key vouch for theirs.

GpgIdSigner::sign() takes the bytes the caller just wrote and feeds them
to gpg on stdin (UTF-8 text, as verify() requires; anything else is
refused before gpg runs), with --output in a QTemporaryDir of QtPass's
own; the signature then goes next to the list through
Util::writeFileReplacing(): a staged sibling with an opaque name, written
by its open handle, flushed to the device (Util::syncToDisk, what
QSaveFile's commit did), given the name with the operating system's
rename, so a link planted under .gpg-id.sig since the check is replaced as
an entry (on Windows a junction there fails the write instead: MoveFileEx
does not replace a directory). ImitatePass::writeGpgIdFile(),
ProfileInit::writeGpgId() and Pass::seedGpgIdFile() write the list the
same way, the first two handing the bytes on to the signing step; the
Insert and Copy staging flush to the device too.

Tests: tst_gpgidsigner pins the stdin bytes, the --output outside the
store, the signature placed and the scratch gone, a gpg that writes an
empty signature leaving the old one, bytes that are not UTF-8 refused with
gpg not run, and a link under the .sig name replaced with its target
untouched; tst_util pins writeFileReplacing (owner-only, no temporary
left, refused without replace, a link replaced as an entry; on ... (continued)

Coverage Stats

108 of 140 new or added lines in 5 files covered. (77.14%)

3 existing lines in 2 files now uncovered.

7478 of 9464 relevant lines covered (79.02%)

80.3 hits per line