securedrop-admin
does not include new UID in signature check
#5994
Labels
Milestone
securedrop-admin
does not include new UID in signature check
#5994
Description
securedrop-admin
(which is used by the graphical updater) does not check for our new release key UID, here:https://github.com/freedomofpress/securedrop/blob/develop/admin/securedrop_admin/__init__.py#L946-L949
The new UID is
[email protected]
. This omission means that the tag verification will fail. (Note the closing quotation mark on the first line, which is not present when the key has a UID associated with it.)Steps to Reproduce
A bit difficult as we currently don't have a tag signed with the new key up. I've so far only tested this by manually attempting to match signature output in the same manner as the updater does.
The text was updated successfully, but these errors were encountered: