Bug#696234: apt: Signed Debian control block parsing can be fooled

2012-12-18 Thread Guillem Jover
Package: apt Version: 0.9.7.7 Severity: normal File: apt-pkg/indexcopy.cc, ftparchive/writer.cc User: ans...@debian.org Usertags: gpg-clearsign Hi! The SigVerify::RunGPGV() function is too strict and will error out on correct Armor Header Lines (as per RFC4880), those with trailing whitespace. Th

Bug#696234: apt: Signed Debian control block parsing can be fooled

2013-03-19 Thread Guillem Jover
Hi! On Fri, 2013-03-15 at 17:28:31 +0100, David Kalnischkies wrote: > On Thu, Mar 14, 2013 at 7:31 PM, Guillem Jover wrote: > > So (from what I wrote on the initial bug report) SigVerify::RunGPGV() > > would not be able to parse something like: > > > > "-BEGIN PGP SIGNATURE- \t \n" >

Bug#696234: apt: Signed Debian control block parsing can be fooled

2013-03-14 Thread Guillem Jover
Hi! On Thu, 2013-03-14 at 18:17:52 +0100, David Kalnischkies wrote: > On Tue, Dec 18, 2012 at 2:33 PM, Guillem Jover wrote: > > The SigVerify::RunGPGV() function is too strict and will error out on > > correct Armor Header Lines (as per RFC4880), those with trailing > > whitespace. The function S

Bug#696234: apt: Signed Debian control block parsing can be fooled

2013-03-15 Thread David Kalnischkies
(Disclaimer: I am not arguing that we don't need to fix this – we are working on it – the following just outlines why I think that it is a "bug" in gpgv and/or other implementations that we have to fix to use them …) On Thu, Mar 14, 2013 at 7:31 PM, Guillem Jover wrote: > I think you might have