Feature update: security improvement

It’s been some time the blog was last updated, but work continues behind the scene. This post describes a security improvement that has been merged.

Before this fix, when you registered a release, you submitted the URL of the release to the backend without signing the release’ index file, as it was generated server-side. It was the backend that contacted the publishing platform to get the details of the release and saved them on disk for signatures collection. The submitter of the release could then sign the release in a second step.

This introduced an issue similar to what is known in programming as TOCTTOU (Time Of Check To Time Of Use) If between the submission of the release (time of check) and the the signature by the submitter (time of use) an attacker replaced a release artifact by a malicious one, and simultaneously updated the data on the Asfaload backend, the submitter would unknowingly sign a malicious release. The vulnerability was not easy to exploit, and its availability timespan was limited, but it was still a weakness.

This vulnerability window is now closed as the user registering a release now signs the data that is saved by the backend. The backend still retrieves the release info from the publishing platform, but it only uses it to validate consistency of the data submitted by the user.

As the release registration can be done as part of the release publication, it effectively ensure the artifacts signed are those published in the release, completely closing the opportunity window for an attacker.