cdsoft/luax
2
23
Fork
You've already forked luax
0

Zig signature trusted comment not verified #2

Closed
opened 2025年12月13日 23:20:20 +01:00 by silversquirl · 3 comments

Hi! I'm doing an audit of Zig community mirrors downloaders - good job on yours, it's better than many!
However one important missing detail is verification of the trusted comment in the minisig file. It is important to check that this comment matches the requested filename, to avoid potential downgrade attacks by malicious mirrors.

Hi! I'm doing an audit of Zig community mirrors downloaders - good job on yours, it's better than many! However one important missing detail is verification of the trusted comment in the minisig file. It is important to check that this comment matches the requested filename, to avoid potential downgrade attacks by malicious mirrors.

Hi! Thanks for your feedback.
I've added a check to ensure the file field in the trusted comment matches the requested archive filename.
It's fixed in LuaX 9.7.2.

Hi! Thanks for your feedback. I've added a check to ensure the file field in the trusted comment matches the requested archive filename. It's fixed in LuaX 9.7.2.

fwiw, you can use the -Q option to minisign instead of extracting the trusted comment with grep!

fwiw, you can use the `-Q` option to minisign instead of extracting the trusted comment with grep!

Right, I should have read the man page ;-)
This should simplify the signature verification.

=> done in 9.7.3

Right, I should have read the man page ;-) This should simplify the signature verification. => done in 9.7.3
Sign in to join this conversation.
No Branch/Tag specified
master
dev
32bit
dev-ng
mbedtls
lua-5.5
pages
LibreSSL
isocline-freeze_and_memory_leak_issue_when_the_terminal_is_closed
optimizations-local_variables
djot
wasm
testing_teal
10.7.1
10.7
10.6.7
10.6.6
10.6.5
10.6.4
10.6.3
10.6.2
10.6.1
10.6
10.5
10.4.5
10.4.4
10.4.3
10.4.2
10.4.1
10.4
10.3.4
10.3.3
10.3.2
10.3.1
10.3
10.2.2
10.2.1
10.2
10.1.4
10.1.3
10.1.2
10.1.1
10.1
10.0.2
10.0.1
10.0
9.15.1
9.15
9.14.14
9.14.13
9.14.12
9.14.11
9.14.10
9.14.9
9.14.8
9.14.7
9.14.6
9.14.5
9.14.4
9.14.3
9.14.2
9.14.1
9.14
9.13.5
9.13.4
9.13.3
9.13.2
9.13.1
9.13
9.12.3
9.12.2
9.12.1
9.12
9.11.2
9.11.1
9.11
9.10.1
9.10
9.9.3
9.9.2
9.9.1
9.9
9.8.1
9.8
9.7.4
9.7.3
9.7.2
9.7.1
9.7
9.6.3
9.6.2
9.6.1
9.6
9.5.9
9.5.8
9.5.7
9.5.6
9.5.5
9.5.4
9.5.3
9.5.2
9.5.1
9.5
9.4.3
9.4.2
9.4.1
9.4
9.3
9.2.11
9.2.10
9.2.9
9.2.8
9.2.7
9.2.6
9.2.5
9.2.4
9.2.3
9.2.2
9.2.1
9.2
9.1.4
9.1.3
9.1.2
9.1.1
9.1
9.0
8.9.7
8.9.6
8.9.5
8.9.4
8.9.3
8.9.2
8.9.1
8.9
8.8.2
8.8.1
8.8
8.7.3
8.7.2
8.7.1
8.7
8.6.2
8.6.1
8.6
8.5
8.4
8.3
8.2.2
8.2.1
8.2
8.1.3
8.1.2
8.1.1
8.1
8.0.3
8.0.2
8.0.1
8.0
7.7.4
7.7.3
7.7.2
7.7.1
7.7
7.6.5
7.6.4
7.6.3
7.6.2
7.6.1
7.6
7.5.1
7.5
7.4.1
7.4
7.3.4
7.3.3
7.3.2
7.3.1
7.3
7.2.1
7.2
7.1.12
7.1.11
7.1.10
7.1.9
7.1.8
7.1.7
7.1.6
7.1.5
7.1.4
7.1.3
7.1.2
7.1.1
7.1
7.0
6.4.6
6.4.5
6.4.4
6.4.3
6.4.2
6.4.1
6.4
6.3.7
6.3.6
6.3.5
6.3.4
6.3.3
6.3.2
6.3.1
6.3
6.2.3
6.2.2
6.2.1
6.2
6.1.2
6.1.1
6.1
6.0.22
6.0.21
6.0.20
6.0.19
6.0.18
6.0.17
6.0.16
6.0.15
6.0.14
6.0.13
6.0.12
6.0.11
6.0.10
6.0.9
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0
5.3
5.2.1
5.2
5.1.1
5.1
5.0.1
5.0
4.8.5
4.8.4
4.8.3
4.8.2
4.8.1
4.8
4.7.3
4.7.2
4.7.1
4.7
4.6
4.5.2
4.5.1
4.5
4.4.3
4.4.2
4.4.1
4.4
4.3.1
4.3
4.2
4.1
4.0.7
4.0.6
4.0.5
4.0.4
4.0.3
4.0.2
4.0.1
4.0
3.3
3.2.5
3.2.4
3.2.3
3.2.2
3.2.1
3.2
3.1.13
3.1.12
3.1.11
3.1.10
3.1.9
3.1.8
3.1.7
3.1.6
3.1.5
3.1.4
3.1.3
3.1.2
3.1.1
3.1
3.0.3
3.0.2
3.0.1
3.0
2.25.2
2.25.1
2.25
2.24.4
2.24.3
2.24.2
2.24.1
2.24
2.23.3
2.23.2
2.23.1
2.23
2.22.1
2.22
2.21
2.20.5
2.20.4
2.20.3
2.20.2
2.20.1
2.20
2.19
2.18.4
2.18.3
2.18.2
2.18.1
2.18
2.17.1
2.17
2.16.4
2.16.3
2.16.2
2.16.1
2.16
2.15.4
2.15.3
2.15.2
2.15.1
2.15
2.14.7
2.14.6
2.14.5
2.14.4
2.14.3
2.14.2
2.14.1
2.14
2.13.1
2.13
2.12.5
2.12.4
2.12.3
2.12.2
2.12.1
2.12
2.11.3
2.11.2
2.11.1
2.11
2.10.1
2.10
2.9.1
2.9
2.8.5
2.8.4
2.8.3
2.8.2
2.8.1
2.8.0
2.7.7
2.7.6
2.7.5
2.7.4
2.7.3
2.7.2
2.7.1
2.7.0
2.6.2
2.6.1
2.6.0
2.5.2
2.5.1
2.5.0
2.4.1
2.4.0
2.3.0
2.2.3
2.2.2
2.2.1
2.2.0
2.1.3
2.1.2
2.1.1
2.1.0
2.0.3
2.0.2
2.0.1
2.0.0
1.15.1
1.15.0
1.14.5
1.14.4
1.14.3
1.14.2
1.14.1
1.14.0
1.13.1
1.13.0
1.12.10
1.12.9
1.12.8
1.12.7
1.12.6
1.12.5
1.12.4
1.12.3
1.12.2
1.12.1
1.12.0
1.11.0
1.10.1
1.10.0
1.9.1
1.9.0
1.8.0
1.7.2
1.7.1
1.7.0
1.6.3
1.6.2
1.6.1
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.3
1.1.2
1.1.1
1.1.0
1.0.0
0.15.0
0.14.0
0.13.0
0.12.0
0.11.4
0.11.3
0.11.2
0.11.1
0.11.0
0.10.1
0.10.0
0.9.1
0.9.0
0.8.0
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.3
0.6.2
0.6.1
0.6.0
0.5.3
0.5.2
0.5.1
0.5.0
0.4.0
0.3.2
0.3.1
0.3.0
0.2.1
0.2.0
0.1.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cdsoft/luax#2
Reference in a new issue
cdsoft/luax
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?