From 3ec10fee4173f6b86620a4b88c9c8efd1fb8bcc5 Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Mon, 12 Oct 2026 13:09:59 +0200 Subject: [PATCH] =?UTF-8?q?Security-Review:=20Schl=C3=BCsseldatei=20der=20?= =?UTF-8?q?Paketquelle=20darf=20nur=20den=20einen=20Schl=C3=BCssel=20entha?= =?UTF-8?q?lten=20(#39)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Geprüft wurde der erste Fingerabdruck der Datei, apt vertraut aber jedem Schlüssel darin. Die Datei muss jetzt genau einen Hauptschlüssel enthalten, den erwarteten; sonst läuft das Review ohne Datenbank weiter. --- .github/workflows/security-review.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security-review.yml b/.github/workflows/security-review.yml index 055f33c..b6fff1a 100644 --- a/.github/workflows/security-review.yml +++ b/.github/workflows/security-review.yml @@ -391,14 +391,17 @@ jobs: # The package source of PostgreSQL: the image of the runner brings an # older version than the applications need. Its key is checked - # against the fingerprint above, wherever it came from. + # against the fingerprint above, wherever it came from: apt trusts + # every key of the file, so the file has to hold that one and no + # other. Each primary key is a pub record followed by its fpr. key=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc if [ ! -s "$key" ]; then sudo install -d "$(dirname "$key")" sudo curl -sS --fail --location -o "$key" https://www.postgresql.org/media/keys/ACCC4CF8.asc fi - fingerprint="$(gpg --show-keys --with-colons "$key" 2> /dev/null | awk -F: '$1 == "fpr" && !seen++ { print $10 }')" - if [ "$fingerprint" != "$POSTGRES_KEY" ]; then + fingerprints="$(gpg --show-keys --with-colons "$key" 2> /dev/null \ + | awk -F: '$1 == "pub" { primary = 1; next } primary && $1 == "fpr" { print $10; primary = 0 }')" + if [ "$fingerprints" != "$POSTGRES_KEY" ]; then echo "::error::Der Schlüssel der Paketquelle von PostgreSQL ist nicht der erwartete. Das Review läuft ohne Datenbank." exit 1 fi