gpg-bash-lib compare signed_on_unixtime with stored value feature

phabricator-migrator · February 19, 2024, 5:50pm

Information

ID: 238
PHID: PHID-TASK-dgznbaujum3oa3d5nc3s
Author: Patrick
Status at Migration Time: invalid
Priority at Migration Time: Normal

Description

Consider adding a feature to gpg-bash-lib for comparing $gpg_bash_lib_output_signed_on_date and $gpg_bash_lib_output_signed_on_unixtime stored values (T237).

Related code:

github.com

Kicksecure/tb-updater/blob/468f6e9406ac8dab92fea2568a7a59edd048ab59/usr/bin/update-torbrowser#L1080


      
             fi
             if [ -f "$tb_home_folder/.tb/last_used_gpg_bash_lib_output_signed_on_unixtime" ]; then
                last_used_gpg_bash_lib_output_signed_on_unixtime="$(cat "$tb_home_folder/.tb/last_used_gpg_bash_lib_output_signed_on_unixtime")" || true
             fi
             if [ "$last_used_gpg_bash_lib_output_signed_on_unixtime" = "" ]; then
                last_used_gpg_bash_lib_output_signed_on_unixtime="unknown"
             fi
          
             ## Thanks to:
             ## http://mywiki.wooledge.org/BashFAQ/054
             if [[ "$last_used_gpg_bash_lib_output_signed_on_unixtime" != *[!0-9]* ]]; then
                true "'$last_used_gpg_bash_lib_output_signed_on_unixtime' is strictly numeric."
                if [ "$last_used_gpg_bash_lib_output_signed_on_unixtime" -lt "$gpg_bash_lib_output_signed_on_unixtime" ]; then
                   signature_freshness_msg="The downloaded signature is newer than the last known signature as expected."
                   type="info"
                elif [ "$last_used_gpg_bash_lib_output_signed_on_unixtime" -gt "$gpg_bash_lib_output_signed_on_unixtime" ]; then
                   signature_freshness_msg="<b>You are likely target of a downgrade attack</b>, SAY NO NOW! The downloaded signature is older than the last known signature. \
          Unless you are downgrading, you should abort now and try again later!"
                   type="warning"
                elif [ "$last_used_gpg_bash_lib_output_signed_on_unixtime" = "$gpg_bash_lib_output_signed_on_unixtime" ]; then
                   signature_freshness_msg="<b>You could be target of an indefinite freeze attack!</b> The downloaded signature has the same creation date as the last known signature. \

      if [ "$last_used_gpg_bash_lib_output_signed_on_unixtime" -lt "$gpg_bash_lib_output_signed_on_unixtime" ]; then
         signature_freshness_msg="The downloaded signature is newer than the last known signature as expected."

That would help to avoid having that code in applications that use gpg-bash-lib.

Comments

Patrick

2016-04-05 15:57:48 UTC