|
|
|
@ -11,6 +11,15 @@ IFS='
@@ -11,6 +11,15 @@ IFS='
|
|
|
|
|
if [ "$BITCOIN_VERIFY_COMMITS_ALLOW_SHA1" = 1 ]; then |
|
|
|
|
GPG_RES="$(echo "$INPUT" | gpg --trust-model always "$@" 2>/dev/null)" |
|
|
|
|
else |
|
|
|
|
# Note how we've disabled SHA1 with the --weak-digest option, disabling |
|
|
|
|
# signatures - including selfsigs - that use SHA1. While you might think that |
|
|
|
|
# collision attacks shouldn't be an issue as they'd be an attack on yourself, |
|
|
|
|
# in fact because what's being signed is a commit object that's |
|
|
|
|
# semi-deterministically generated by untrusted input (the pull-req) in theory |
|
|
|
|
# an attacker could construct a pull-req that results in a commit object that |
|
|
|
|
# they've created a collision for. Not the most likely attack, but preventing |
|
|
|
|
# it is pretty easy so we do so as a "belt-and-suspenders" measure. |
|
|
|
|
|
|
|
|
|
GPG_RES="$(echo "$INPUT" | gpg --trust-model always --weak-digest sha1 "$@" 2>/dev/null)" |
|
|
|
|
fi |
|
|
|
|
for LINE in $(echo "$GPG_RES"); do |
|
|
|
|