tpagectl update verifies checksums but not binary authenticity #623

New issue

Closed

opened 2026-08-09 21:42:58 +00:00 by the.auditor · 1 comment

the.auditor commented

2026-08-09 21:42:58 +00:00

Owner

verifyChecksum in internal/tpagectl/update/update.go compares the downloaded archive against tarballs.sha256 fetched from the same Forgejo releases API. This provides integrity against corruption/transport errors but not authenticity: a compromised Forgejo host, a taken-over release-publishing account, or a malicious update.host/owner/repo config ships both the archive and its matching checksum, so tpagectl update would install an attacker-controlled binary (arbitrary code execution).

Consider binary signing (e.g. minisign/cosign) with a pinned public key, or at minimum document the trust model ("releases and checksums from the configured Forgejo host are trusted").

See #622

`verifyChecksum` in `internal/tpagectl/update/update.go` compares the downloaded archive against `tarballs.sha256` fetched from the **same** Forgejo releases API. This provides integrity against corruption/transport errors but not authenticity: a compromised Forgejo host, a taken-over release-publishing account, or a malicious `update.host/owner/repo` config ships both the archive and its matching checksum, so `tpagectl update` would install an attacker-controlled binary (arbitrary code execution). Consider binary signing (e.g. minisign/cosign) with a pinned public key, or at minimum document the trust model ("releases and checksums from the configured Forgejo host are trusted"). See https://git.lan.thwap.org/thwap/thwap-pagesd/pulls/622

the.auditor added the

Kind/Security

Priority

High

labels

2026-08-09 21:43:02 +00:00

fuzzy referenced this issue from a commit

2026-08-11 01:29:27 +00:00

fix(tpagectl): address CLI issues

automation referenced this issue

2026-08-11 01:29:32 +00:00

fix(tpagectl): address CLI issues #634

automation closed this issue

2026-08-11 01:29:49 +00:00

automation commented

2026-08-11 01:29:50 +00:00

Owner

Fixed in #634: the update command description documents the trust model explicitly — checksums provide integrity against corruption/transport errors, while authenticity relies on trusting the configured Forgejo host. Binary signing is out of scope until a signing key + infrastructure exist.

Fixed in #634: the `update` command description documents the trust model explicitly — checksums provide integrity against corruption/transport errors, while authenticity relies on trusting the configured Forgejo host. Binary signing is out of scope until a signing key + infrastructure exist.

fuzzy referenced this issue from a commit

2026-08-11 01:29:56 +00:00

fix(tpagectl): address CLI issues