IJHack / QtPass / 38204843826

93%

Build Type

push

github

Committed by web-flow

Commit Message

Signed .gpg-id: no fallback past a removed folder list, no signature by another key (#2014)

* Signed .gpg-id: no fallback past a removed folder list, no signature by another key

Found while reviewing the same design in PyQtPass (annejan/PyQtPass#27).

With a signing key configured, a sub-folder whose own .gpg-id was removed
(where this device accepted one before) or replaced by a link no longer
falls back to a parent folder's list. That parent list verifies, but it was
not signed for this folder: someone with write access to the store and no
signing key could delete secret/.gpg-id and have the next edit of secret/x
encrypted to the whole team. Insert and re-encryption (so Move and Copy too)
refuse with a message that says how to get through: save the folder's
recipients in Users, which writes and signs a fresh list. The Users dialog
preselects nothing for such a folder and names the missing list, so one OK
cannot sign the parent's list in. Without a signing key nothing changes;
the parent's list applies, as with pass.

GpgIdSigner::sign() signs with --local-user instead of --default-key, which
signed with any other secret key when the configured one was missing and
still exited 0. The new signature is verified against the signing keys
before the .sig is written. Init already checked for the secret key first;
creating a new profile (ProfileInit) did not, and is covered now.

SECURITY.md describes both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* skippedGpgId: an unreadable generation record fails closed

remembered() returns nothing when the record cannot be read (lock held by another QtPass, a corrupt file), and value_or(0) took that for never seen: a folder whose accepted list was removed could fall back to the parent's list while the record was briefly unreadable, then accept() of the parent's list could suc... (continued)

Coverage Stats

77 of 81 new or added lines in 3 files covered. (95.06%)

3 existing lines in 1 file now uncovered.

9135 of 9837 relevant lines covered (92.86%)

192.66 hits per line