Public bug reported:
[Impact]
* python3-debian's deb822.GpgInfo.from_sequence() (used e.g. by tools
that validate .changes/.dsc/Release signatures) decodes the stdout/
stderr of `gpgv`/`gpg` with a hard-coded 'utf-8' codec. When gpg
emits non-UTF-8 bytes on stderr (e.g. because a key's User ID
contains invalid/legacy encoded characters), decoding raises an
unhandled UnicodeDecodeError instead of returning the parsed
signature information. This breaks callers that rely on GpgInfo to
check signatures, including dput-ng and other archive tooling.
* Fixed upstream in python-debian commit
01d2f7c2d4a77731aa640b710ae1002cf20da280
("Handle non-UTF-8 data from gpgv signature checking"), which
switches the decode codec from 'utf-8' to 'unicode-escape' so the
bytes are always decodable without raising.
[Test Plan]
1. Install python3-debian from -proposed.
2. Use pull-lp-source
$ pull-lp-source cloud-initramfs-tools
BEFORE:
Traceback (most recent call last):
File "/usr/bin/pull-lp-source", line 14, in <module>
PullPkg.main(distro="ubuntu", pull="source")
File "/usr/lib/python3/dist-packages/ubuntutools/pullpkg.py", line 111, in
main
cls(*args, **kwargs).pull()
File "/usr/lib/python3/dist-packages/ubuntutools/pullpkg.py", line 449, in
pull
for key in srcpkg.dsc.keys():
^^^^^^^^^^
File "/usr/lib/python3/dist-packages/ubuntutools/archive.py", line 318, in dsc
self._check_dsc_signature()
File "/usr/lib/python3/dist-packages/ubuntutools/archive.py", line 374, in
_check_dsc_signature
gpg_info = self.dsc.get_gpg_info(
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/debian/deb822.py", line 1206, in
get_gpg_info
self.gpg_info = GpgInfo.from_sequence(self.raw_text,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/debian/deb822.py", line 1375, in
from_sequence
return cls.from_output(out.decode('utf-8'),
^^^^^^^^^^^^^^^^^^^
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xb7 in position 307:
invalid start byte
AFTER FIX:
The package source should be downloaded successfully.
[Where problems could occur]
* The change only affects the codec used to decode gpgv/gpg's stdout/
stderr. Using 'unicode-escape' instead of 'utf-8' means previously
valid UTF-8 multi-byte sequences are now decoded as Latin-1 + escaped
codepoints instead of correctly as UTF-8. This is a low-risk, display-
only side effect confined to this parsing path; it does not affect
signature validity logic. No other code paths are touched.
[Other Info]
* Upstream fix:
https://salsa.debian.org/python-debian-team/python-debian/-/commit/01d2f7c2d4a77731aa640b710ae1002cf20da280
* Already fixed in later Ubuntu releases (python-debian >= 1.0.1) and
in Debian unstable;
only Noble (24.04 LTS, python-debian 0.1.49ubuntu2) or older
are affected and needs an SRU backport. However, I cannot reproduce the
issue wioth cloud-inittamfs-tools package in Jammy, so I will target
only Noble for now.
---
A package can be signed with sequoia ending up having signatures having
NOTATION_DATA field that is binary. When that data is read and decoded to
UTF-8, exceptions are thrown.
On Ubuntu Noble:
$ pull-lp-source cloud-initramfs-tools
Traceback (most recent call last):
File "/usr/bin/pull-lp-source", line 14, in <module>
PullPkg.main(distro="ubuntu", pull="source")
File "/usr/lib/python3/dist-packages/ubuntutools/pullpkg.py", line 111, in
main
cls(*args, **kwargs).pull()
File "/usr/lib/python3/dist-packages/ubuntutools/pullpkg.py", line 449, in
pull
for key in srcpkg.dsc.keys():
^^^^^^^^^^
File "/usr/lib/python3/dist-packages/ubuntutools/archive.py", line 318, in dsc
self._check_dsc_signature()
File "/usr/lib/python3/dist-packages/ubuntutools/archive.py", line 374, in
_check_dsc_signature
gpg_info = self.dsc.get_gpg_info(
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/debian/deb822.py", line 1206, in
get_gpg_info
self.gpg_info = GpgInfo.from_sequence(self.raw_text,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/debian/deb822.py", line 1375, in
from_sequence
return cls.from_output(out.decode('utf-8'),
^^^^^^^^^^^^^^^^^^^
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xb7 in position 307:
invalid start byte
** Affects: python-debian (Ubuntu)
Importance: Undecided
Assignee: Hector Cao (hectorcao)
Status: New
** Changed in: python-debian (Ubuntu)
Assignee: (unassigned) => Hector Cao (hectorcao)
** Summary changed:
- python3-debian fails to parse the GPG signature with binary blobs
+ python-debian GpgInfo.from_sequence() raises UnicodeDecodeError on non-UTF-8
gpgv output
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171509
Title:
python-debian GpgInfo.from_sequence() raises UnicodeDecodeError on
non-UTF-8 gpgv output
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-debian/+bug/2171509/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
