{"action":"created","issue":{"url":"https://api.github.com/repos/debian-pi/raspbian-ua-netinst/issues/176","labels_url":"https://api.github.com/repos/debian-pi/raspbian-ua-netinst/issues/176/labels{/name}","comments_url":"https://api.github.com/repos/debian-pi/raspbian-ua-netinst/issues/176/comments","events_url":"https://api.github.com/repos/debian-pi/raspbian-ua-netinst/issues/176/events","html_url":"https://github.com/debian-pi/raspbian-ua-netinst/issues/176","id":53700507,"number":176,"title":"Insecure validation of archive.raspberrypi.org signing key","user":{"login":"mologie","id":597682,"avatar_url":"https://avatars.githubusercontent.com/u/597682?v=3","gravatar_id":"","url":"https://api.github.com/users/mologie","html_url":"https://github.com/mologie","followers_url":"https://api.github.com/users/mologie/followers","following_url":"https://api.github.com/users/mologie/following{/other_user}","gists_url":"https://api.github.com/users/mologie/gists{/gist_id}","starred_url":"https://api.github.com/users/mologie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mologie/subscriptions","organizations_url":"https://api.github.com/users/mologie/orgs","repos_url":"https://api.github.com/users/mologie/repos","events_url":"https://api.github.com/users/mologie/events{/privacy}","received_events_url":"https://api.github.com/users/mologie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":18,"created_at":"2015-01-08T00:27:04Z","updated_at":"2015-05-09T13:49:35Z","closed_at":null,"body":"Hello,\r\n\r\nthe marked lines allows for malicious keys to be imported into the temporary keychain:\r\nhttps://github.com/debian-pi/raspbian-ua-netinst/blob/master/update.sh#L115-L118\r\n\r\nUsing `gpg -k`, one merely checks for the presence of the good key in the previously imported file. It does not check for the absence of malicious keys. Specifically, `gpg --import` allows for importing multiple keys from one file. Therefore, an attacker must only append his malicious key to the file downloaded over HTTP (and leave the good key in it too) in order to inject a malicious key.\r\n\r\nAs fix, I recommend embedding a verified copy of the correct key into update.sh.\r\n"},"comment":{"url":"https://api.github.com/repos/debian-pi/raspbian-ua-netinst/issues/comments/100489021","html_url":"https://github.com/debian-pi/raspbian-ua-netinst/issues/176#issuecomment-100489021","issue_url":"https://api.github.com/repos/debian-pi/raspbian-ua-netinst/issues/176","id":100489021,"user":{"login":"diederikdehaas","id":2184351,"avatar_url":"https://avatars.githubusercontent.com/u/2184351?v=3","gravatar_id":"","url":"https://api.github.com/users/diederikdehaas","html_url":"https://github.com/diederikdehaas","followers_url":"https://api.github.com/users/diederikdehaas/followers","following_url":"https://api.github.com/users/diederikdehaas/following{/other_user}","gists_url":"https://api.github.com/users/diederikdehaas/gists{/gist_id}","starred_url":"https://api.github.com/users/diederikdehaas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diederikdehaas/subscriptions","organizations_url":"https://api.github.com/users/diederikdehaas/orgs","repos_url":"https://api.github.com/users/diederikdehaas/repos","events_url":"https://api.github.com/users/diederikdehaas/events{/privacy}","received_events_url":"https://api.github.com/users/diederikdehaas/received_events","type":"User","site_admin":false},"created_at":"2015-05-09T13:49:35Z","updated_at":"2015-05-09T13:49:35Z","body":"Good point @Mausy5043 :+1: "}}