From 3a137a4a17c81b2d0adf0e75de8ca51bdf7776e0 Mon Sep 17 00:00:00 2001 From: Lightning Date: Wed, 17 Jan 2024 14:23:09 +0100 Subject: [PATCH] don't bypass the web of trust (#378) (#379) * don't bypass the web of trust (#378) the choice whether to use a web of trust and on which trust level is up to the user of PGP/GPG and must not be overriden by tools that are set on top users can decide to ignore this safety net by setting their gpg.conf adequately, defining an alias for `gpg --trust-model=always` or passing the env GPG to blackbox in this way but we should not override their preferences hardcoded * update README add note about the web of trust * fix broken test assume that we have `--quick-generate-key` if we run gpg2 instead of doing a dry run for that (which has side effects that break the test) --- README.md | 14 ++++++++++++++ bin/_blackbox_common.sh | 2 +- integrationTest/ithelpers.go | 9 ++------- pkg/crypters/gnupg/gnupg.go | 1 - 4 files changed, 17 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index c2e215a..7d5afc2 100644 --- a/README.md +++ b/README.md @@ -36,6 +36,7 @@ Table of Contents - User Management - [How to indoctrinate a new user into the system?](#how-to-indoctrinate-a-new-user-into-the-system) - [How to remove a user from the system?](#how-to-remove-a-user-from-the-system) + - [Note to the Web Of Trust](#note-to-the-web-of-trust) - Repo Management - [Enabling BlackBox For a Repo](#enabling-blackbox-for-a-repo) - [Set up automated users or “role accounts”](#set-up-automated-users-or-role-accounts) @@ -482,6 +483,19 @@ The key ring only has public keys. There are no secret keys to delete. Remember that this person did have access to all the secrets at one time. They could have made a copy. Therefore, to be completely secure, you should change all passwords, generate new SSL keys, and so on just like when anyone that had privileged access leaves an organization. +Note to the Web Of Trust +======================== + +Validating the trustworthiness of keys is a task that can't be accomplished by Blackbox; this is a completely external topic that has to be dealt with manually (the same way as generating/managing your key is, for example) or by a dedicated mechanism (a company CA with corresponding workflows e.g.). Aside from the "common" benefits of a Web Of Trust (see [here](https://www.gnupg.org/gph/en/manual/x334.html) or [here](https://www.gnupg.org/gph/en/manual/x547.html) e.g.), it prevents several errors as well. + +Historically Blackbox was using and enforcing a "trust every key" model but this has changed! Now the decision of whether and how to use the PGP/GPG trust models is left up to the user by configuration (or by the PGP/GPG defaults). +When updating Blackbox people might run into functional problems if they haven't yet dealt with the trustability of the keys they're using. It's the right time to do so and built up your Web Of Trust now! + +If you have an external workflow in place that ensures the integrity of the keys Blackbox uses you might want to disable the PGP/GPG trust models and rely on this workflow. +This can be achieved by declaring "trust model always", either by passing the command line parameter `--trust-model=always` to your PGP/GPG binary when using Blackbox (by defining an alias or using the environment variable (e.g. `GPG="gpg2 --trust-model=always"`) or a combination of both) or by setting `trust-model always` in your `gpg.conf` (note that this disables the Web Of Trust everywhere, not just for Blackbox). + +WARNING: It is strongly disadvised to not use any key validation at all! This opens up various ways to bypass the confidentiality of your encrypted secrets! + Where is the configuration stored? .blackbox vs. keyrings/live ============================================================== diff --git a/bin/_blackbox_common.sh b/bin/_blackbox_common.sh index ccc05f9..cad9b4d 100755 --- a/bin/_blackbox_common.sh +++ b/bin/_blackbox_common.sh @@ -253,7 +253,7 @@ function encrypt_file() { encrypted="$2" echo "========== Encrypting: $unencrypted" >&2 - $GPG --use-agent --yes --trust-model=always --encrypt -o "$encrypted" $(awk '{ print "-r" $1 }' < "$BB_ADMINS") "$unencrypted" >&2 + $GPG --use-agent --yes --encrypt -o "$encrypted" $(awk '{ print "-r" $1 }' < "$BB_ADMINS") "$unencrypted" >&2 echo '========== Encrypting: DONE' >&2 } diff --git a/integrationTest/ithelpers.go b/integrationTest/ithelpers.go index 5a49dcc..35f7d62 100644 --- a/integrationTest/ithelpers.go +++ b/integrationTest/ithelpers.go @@ -421,13 +421,8 @@ Expire-Date: 0 func hasQuick(t *testing.T) bool { testing.Init() - fmt.Println("========== Do we have --quick-generate-key?") - err := bbutil.RunBash("gpg2", - "--dry-run", - "--quick-generate-key", - "--batch", - "--passphrase", "", - "foo", "rsa", "encr") + fmt.Println("========== Do we run gpg2?") + err := bbutil.RunBash("gpg2", "--version") fmt.Println("========== Done") if err == nil { return true diff --git a/pkg/crypters/gnupg/gnupg.go b/pkg/crypters/gnupg/gnupg.go index b29f4b5..6abdf8e 100644 --- a/pkg/crypters/gnupg/gnupg.go +++ b/pkg/crypters/gnupg/gnupg.go @@ -106,7 +106,6 @@ func (crypt CrypterHandle) Encrypt(filename string, umask int, receivers []strin a := []string{ "--use-agent", "--yes", - "--trust-model=always", "--encrypt", "-o", encrypted, }