I reviewed rust-sequoia-sq 1.4.0-0ubuntu1~ppa3 as to be checked into
stonking. This shouldn't be considered a full audit but rather a quick
gauge of maintainability. The review focused on the `sq` crate and the
packaging; for the ~381 vendored upstream crates it relies on static
scans, osv-scanner, and their upstream maintenance. Note this is a PPA
version which fixed the FTBFS issue with the archive upload, and soon to
be checked into stonking.
rust-sequoia-sq, or `sq`, is the command-line OpenPGP tool of the
Sequoia-PGP project, built on the sequoia-openpgp Rust library suite. It
provides key/certificate management, signing, encryption, a SQLite-backed
certificate store, WKD publishing, and network fetches of certificates
from keyservers and WKD. It is a pure user-facing CLI; a companion
`sequoia-keystore` service is packaged separately.
- CVE History
- None
- Build-Depends
- Sensitive libraries: libssl-dev (OpenSSL used for all crypto/TLS,
enforced by the use-openssl-for-tls patch for MIR policy),
libsqlite3-dev (certificate store), capnproto (IPC codegen),
libclang-dev (vendored bindgen, build-time only).
Experimental/variable-time crypto features are not enabled.
- The rustls TLS backend concern raised by the MIR team review is
resolved in this upload (use-openssl-for-tls patch); rustls remains
vendored but is not compiled into sq.
- capnproto, libclang-dev and quilt are in universe, but they are
build-only tools with no code compiled into sq.
- ~381 vendored Rust crates in debian/rust-vendor (standard rust-team
packaging, osv-scanner clean) - a routine but real security
maintenance burden, as each crate must be refreshed when CVEs land.
- pre/post inst/rm scripts
- None
- init scripts
- None
- systemd units
- None
- dbus services
- None
- setuid binaries
- None
- binaries in PATH
- Single binary /usr/bin/sq (root-owned 0755), the expected CLI tool
itself; nothing elevated or unusual.
- sudo fragments
- None
- polkit files
- None
- udev rules
- None
- unit tests / autopkgtests
- No tests run during package build (dh_auto_test executes cargo build
only) and no autopkgtests are configured (no debian/tests). The MIR team
review accepted the missing autopkgtest on the assumption that a
build-time test suite runs; that assumption does not hold for this
upload, so upstream's extensive test suite is never exercised by
Ubuntu builds/CI.
- cron jobs
- None
- Build logs
- Clean build, no errors. Warnings are almost entirely cosmetic (lifetime
syntax, cfg conditions, unused parens) in vendored crates; the sq crate
itself only produces 12 trivial style warnings. Fully vendored offline
build with standard Ubuntu hardening (stack protector, RELRO, frame
pointers); system OpenSSL/SQLite linked via pkg-config.
- Lintian flags prebuilt Windows DLL test fixtures in the vendored
libloading crate (test data, never compiled into sq) and undefined
${cargo:*} substitution variables in dpkg-gencontrol (Depends metadata
gap worth fixing).
- Processes spawned
- Only external spawn is `sq wkd publish --rsync` optionally running
`rsync` (PATH-resolved default, `--rsync-path` override). Arguments are
passed as a vector without a shell, so no injection risk; it only runs
when explicitly requested by the user.
- Vendored sequoia IPC code spawns helper programs (keystore/gpg-agent)
over Unix sockets with raw-fd stdio wiring; standard sequoia machinery,
no user-controlled command lines.
- Memory management
- sq itself is safe Rust. Vendored unsafe code is standard FFI/atomics in
maintained crates; sequoia-specific unsafe is justified (mmap-backed
`set_len`, key-role `transmute`, secret `Protected` type, constant-time
MPI comparison). No red flags.
- File IO
- None
- Logging
- None
- Environment variable usage
- Uses user-session config vars only (SEQUOIA_POLICY_CONFIG, PGP_CERT_D,
SEQUOIA_HOME, TMPDIR, standard proxy vars). Env control implies shell
control already; nothing abusable. rustls' SSLKEYLOGFILE support is not
enabled by sq.
- Use of privileged functions
- None
- Use of cryptography / random number sources etc
- Crypto delegated to sequoia-openpgp on the system OpenSSL backend;
experimental/variable-time crypto features are disabled. Legacy SHA-1
verification uses collision detection.
- Secret material is held in a zeroizing `Protected` type and MPI
comparisons are constant-time; randomness comes from the OS CSPRNG
(getrandom).
- Use of temp files
- None
- Use of networking
- Client-side only: WKD/keyserver certificate fetches over HTTPS/HKP; no
listening sockets or server code. Received data is parsed by sequoia's
defensive OpenPGP parsers. Hardcoded https://keys.openpgp.org shadow CA
in the cert store.
- Use of WebKit
- N/A
- Use of PolicyKit
- None
- Any significant cppcheck results
- All 40 findings are in vendored C code that is not compiled into sq
(libsqlite3-sys's bundled SQLite amalgamations and ring's p256-nistz.c;
the build links system OpenSSL and system SQLite instead). They are also
known cppcheck false-positive patterns in those codebases. No impact on
the shipped binary.
- Any significant Coverity results
- None
- Any significant shellcheck results
- None
- Any significant bandit results
- None
- Any significant govulncheck results
- N/A
- Any significant Semgrep results
- None
Upstream (Sequoia-PGP) is an active, well-documented project that ships
regular releases and maintains a modern, defensive Rust codebase; no
security policy file (SECURITY.md) ships in this crate tree, but the project
publishes advisories via its GitLab instance. Combined with the small `sq`
code footprint relative to the vendored dependency tree, this package is a
low-risk promotion once the conditions below are met.
Security team ACK for promoting rust-sequoia-sq 1.4.0-0ubuntu1~ppa3 in
stonking to main, conditional on:
- some test coverage being exercised by Ubuntu builds/CI (either cargo test
at build time or autopkgtests);
- this latest version is merged to stonking (thus LP#2161399 being resolved)
** Changed in: rust-sequoia-sq (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
** Changed in: rust-sequoia-sq (Ubuntu)
Status: New => In Progress
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2121154
Title:
[MIR] rust-sequoia-sq
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-sequoia-sq/+bug/2121154/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
