security: verify JoininBox updates before install

build_joininbox.sh

@@ -393,7 +393,7 @@ elif echo "${lastCommit}" | grep B5690EEEBB952194; then
   echo "# The last commit was made on GitHub and is signed with the GitHub PGP key."
   PGPsigner="web-flow"
   PGPpubkeyLink="https://github.com/${PGPsigner}.gpg"
-  PGPpubkeyFingerprint="B5690EEEBB952194"
+  PGPpubkeyFingerprint="968479A1AFF927E37D1A566BB5690EEEBB952194"
 else
   echo "# No known PGP key found"
   exit 1

scripts/_functions.sh

@@ -195,6 +195,35 @@ function copyJoininboxScripts() {
 }
 
 # updateJoininBox <reset|commit|pr[PRnumber]>
+function verifyJoininBoxRef() {
+  local ref="$1"
+  local kind="$2"
+  local signer keyUrl fingerprint signature
+
+  if [ "$kind" = "tag" ]; then
+    signer="openoms"
+    keyUrl="https://github.com/openoms.gpg"
+    fingerprint="13C688DB5B9C745DE4D2E4545BFB77609B081B65"
+    /home/joinmarket/verify.git.sh "$signer" "$keyUrl" "$fingerprint" "$ref"
+    return
+  fi
+
+  signature=$(git log -1 --show-signature --format=oneline "$ref" 2>&1)
+  if echo "$signature" | grep -q '13C688DB5B9C745DE4D2E4545BFB77609B081B65'; then
+    signer="openoms"
+    keyUrl="https://github.com/openoms.gpg"
+    fingerprint="13C688DB5B9C745DE4D2E4545BFB77609B081B65"
+  elif echo "$signature" | grep -q 'B5690EEEBB952194'; then
+    signer="web-flow"
+    keyUrl="https://github.com/web-flow.gpg"
+    fingerprint="968479A1AFF927E37D1A566BB5690EEEBB952194"
+  else
+    echo "# Refusing an update without a recognized signing key" >&2
+    return 1
+  fi
+  /home/joinmarket/verify.git.sh "$signer" "$keyUrl" "$fingerprint"
+}
+
 function updateJoininBox() {
   cd /home/joinmarket || exit 1
   if [ "$1" = "reset" ] ||  [ "$1" = "pr" ];then
@@ -216,12 +245,9 @@ function updateJoininBox() {
     TAG=$(git describe --tags)
     echo "# Updating to the latest commit in the default branch"
   elif [ "$1" = "pr" ]; then
-    PRnumber=$2
-    echo "# Using the PR:"
-    echo "# https://github.com/JoinMarket-Org/joinmarket-clientserver/release/tag/$PRnumber"
-    sudo -u joinmarket git fetch origin pull/$PRnumber/head:pr$PRnumber
-    sudo -u joinmarket git checkout pr$PRnumber
-    TAG=$(git describe --tags)
+    echo "# Refusing to install pull-request code into privileged script paths." >&2
+    echo "# Test pull requests in an isolated development image instead." >&2
+    return 1
   else
     TAG=$(git tag | sort -V | tail -1)
     # unset $1
@@ -234,6 +260,11 @@ function updateJoininBox() {
     fi
     sudo -u joinmarket git reset --hard $TAG
   fi
+  if [ "$1" = "commit" ]; then
+    verifyJoininBoxRef HEAD commit || return 1
+  else
+    verifyJoininBoxRef "$TAG" tag || return 1
+  fi
   echo "# Current version: $TAG"
   copyJoininboxScripts
 }
@@ -415,4 +446,4 @@ function confirmation() {
   fi
   answer=$?
   return $answer
-}
+}

scripts/verify.git.sh

@@ -62,7 +62,9 @@ elif [ $# -eq 4 ] && [ -n "$4" ]; then
   commitOrTag="$4 tag"
 fi
 echo "# running: ${gitCommand}"
-if ${gitCommand} 2>&1 >&"$_temp"; then
+# --raw includes GnuPG's machine-readable VALIDSIG record with the complete
+# signing-key fingerprint. Do not authenticate signatures using a short key ID.
+if ${gitCommand} --raw >"$_temp" 2>&1; then
   goodSignature=1
 else
   goodSignature=0
@@ -71,7 +73,7 @@ echo
 cat "$_temp"
 echo "# goodSignature(${goodSignature})"
 
-correctKey=$(tr -d " \t\n\r" <"$_temp" | grep "${PGPpubkeyFingerprint}" -c)
+correctKey=$(grep -F "[GNUPG:] VALIDSIG ${PGPpubkeyFingerprint} " "$_temp" -c)
 echo "# correctKey(${correctKey})"
 
 if [ "${correctKey}" -lt 1 ] || [ "${goodSignature}" -lt 1 ]; then