mirror of
https://github.com/rclone/rclone.git
synced 2026-11-07 10:12:56 -05:00
Nick Craig-Wood
3a14789eb4
rclone selfupdate checked the PGP signature on the clearsigned block
of SHA256SUMS but then looked up the archive hash in the whole
downloaded file. Unsigned data can appear in that file without
invalidating the signature. A hash line placed before or after the
signed text was accepted, allowing whoever controlled the download to
install an arbitrary unsigned archive.
The hash is now only looked up in the signed text.
Affects stable (non --beta) selfupdate since v1.55.0. --beta updates
are not signature checked.
(cherry picked from commit 672bbf75ec)