Struct OpenPGPKeyId 

pub struct OpenPGPKeyId {}

What it does

Ensure that no OpenPGP Key ID is used to authenticate and verify upstream artifacts.

Why is this bad?

An OpenPGP certificate can be used to verify and authenticate upstream sources. In PKGBUILD and SRCINFO files these certificates are identified using an ID. This allows the retrieval of matching certificates from remote resources (e.g. Web Key Directory or OpenPGP keyservers).

An OpenPGP Key ID is a short identifier that can be used to identify an OpenPGP certificate. However, its uniqueness cannot be guaranteed and thus it does not guard against collision.

If an OpenPGP certificate cannot be uniquely identified:

• an arbitrary certificate may have a matching OpenPGP Key ID and it would not be possible to use it for authentication and verification of the particular upstream sources.
• sophisticated attackers may be able to craft a certificate with a matching OpenPGP Key ID and swap upstream sources and digital signatures with malicious ones.

Only an OpenPGP fingerprint meaningfully guards against collision and should always be used instead of an OpenPGP Key ID to uniquely identify an OpenPGP certificate.

Example

pkgbase = test
    pkgver = 1.0.0
    pkgrel = 1
    arch = x86_64
    validpgpkeys = 2F2670AC164DB36F

Use instead:

pkgbase = test
    pkgver = 1.0.0
    pkgrel = 1
    arch = x86_64
    validpgpkeys = 4A0C4DFFC02E1A7ED969ED231C2358A25A10D94E

Implementations

impl OpenPGPKeyId

pub fn new_boxed(_: &LintRuleConfiguration) -> Box<dyn LintRule>

Create a new, boxed instance of OpenPGPKeyId.

Trait Implementations

impl Clone for OpenPGPKeyId

fn clone(&self) -> OpenPGPKeyId

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OpenPGPKeyId

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Documented for OpenPGPKeyId

const DOCS: &'static str = "# What it does\n\nEnsure that no [OpenPGP Key ID] is used to authenticate and verify upstream artifacts.\n\n# Why is this bad?\n\nAn [OpenPGP certificate] can be used to verify and authenticate upstream sources.\nIn [PKGBUILD] and [SRCINFO] files these certificates are identified using an ID.\nThis allows the retrieval of matching certificates from remote resources (e.g. Web Key Directory\nor OpenPGP keyservers).\n\nAn [OpenPGP Key ID] is a short identifier that can be used to identify an [OpenPGP certificate].\nHowever, its uniqueness cannot be guaranteed and thus it does not guard against collision.\n\nIf an [OpenPGP certificate] cannot be uniquely identified:\n\n- an arbitrary certificate may have a matching [OpenPGP Key ID] and it would not be possible to\nuse it for authentication and verification of the particular upstream sources.\n- sophisticated attackers may be able to craft a certificate with a matching [OpenPGP Key ID]\nand swap upstream sources and digital signatures with malicious ones.\n\nOnly an [OpenPGP fingerprint] meaningfully guards against collision and should always be used\ninstead of an [OpenPGP Key ID] to uniquely identify an [OpenPGP certificate].\n\n# Example\n\n```ini,ignore\npkgbase = test\npkgver = 1.0.0\npkgrel = 1\narch = x86_64\nvalidpgpkeys = 2F2670AC164DB36F\n```\n\nUse instead:\n\n```ini,ignore\npkgbase = test\npkgver = 1.0.0\npkgrel = 1\narch = x86_64\nvalidpgpkeys = 4A0C4DFFC02E1A7ED969ED231C2358A25A10D94E\n```\n\n[PKGBUILD]: https://man.archlinux.org/man/PKGBUILD.5\n[SRCINFO]: https://alpm.archlinux.page/specifications/SRCINFO.5.html\n[OpenPGP Key ID]: https://openpgp.dev/book/glossary.html#term-Key-ID\n[OpenPGP certificate]: https://openpgp.dev/book/certificates.html\n[OpenPGP fingerprint]: https://openpgp.dev/book/certificates.html#fingerprint"

The static doc comments on this type.

impl LintRule for OpenPGPKeyId

fn name(&self) -> &'static str

Returns the name of this lint rule.

fn scope(&self) -> LintScope

Return the scope of this lint rule.

fn level(&self) -> Level

The severity level of this lint rule.

fn documentation(&self) -> String

Returns the full documentation for this lint rule.

fn help_text(&self) -> String

Returns the help text for this lint rule.

fn run( &self, resources: &Resources, issues: &mut Vec<LintIssue>, ) -> Result<(), Error>

Executes the linting logic and appends to list of accumulated issues.

fn extra_links(&self) -> Option<BTreeMap<String, String>>

Returns a map of additional associated links for this lint rule.

fn scoped_name(&self) -> String

Returns the full name of this lint by combining LintRule::scope and LintRule::name as {scope}::{name}.

fn groups(&self) -> &'static [LintGroup]

Returns the static lint groups this lint rule belongs to.

fn configuration_options(&self) -> &[LintRuleConfigurationOptionName]

Returns a map of configuration options used by this lint rule.