From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 18 Jun 2026 17:24:49 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-wm1-f59.google.com (mail-wm1-f59.google.com [209.85.128.59]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65IFOnl5028880 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 18 Jun 2026 17:24:49 +0200 Received: by mail-wm1-f59.google.com with SMTP id 5b1f17b1804b1-490b9318944sf6292115e9.1 for ; Thu, 18 Jun 2026 08:24:49 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1781796284; cv=pass; d=google.com; s=arc-20240605; b=PmX0TAB3PztAy61NH8brIRqWGHU7wOxnGFqBzNgJ96VV8tc/3O0eECakIc7fsHQlFK D8PFwWW5zVMa3/vrIejTBz03gNrsMZ37NEVynmf5po4x2rlK26PhtXBz8iyxPfGMcxNo 64G6iLWP2lX2eytVViCeW6fz7Fd6n6dofJycKEYsrj9cOWbZjr/ZNUZJkATFmGZ7asQv RNwm4AnjobxZftya93YtWcwITcldgM3gN2Ht8LO06H6WzvXUFF6mk5rv1RAiK4rXz422 Ylj8qcgNYP5xSKei3ZP9C27daYi5cmvDunQmB9GZrfTBZkmsKSXGfwztWT6uYd+1kJhH 7X5w== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:mime-version:message-id:date :subject:cc:to:from:sender:dkim-signature; bh=2h7cvmPEuNNeBCYUK/x3RwJ7Nd2o4Q8ge7td4a/YKlQ=; fh=3PiQlzAUh6pj7ysM0J+s8d7Hw+7LoHmlYDmtcuZlLfk=; b=K6dKAnSOC+ib14DGMPdSe0KVq5DCBiVCbsmKpKXRJKjr1frzCvxLgkWv6FK1/JRxer D6vuqTW0enRggyD7/BWG3z9jxXOqyfrvwO4ysmKrAQreBFIc5QrkY513EPFUHf0FVsqd WwyirjSxRat8NzDvziuA+0/T5AQn3eVqBocJ2oFTQ7HJHlo+HuG2AVjTIJ3UVq6z5jD8 x/WFUwgHknhbziBTy9GtWQqJwxK44xOLHUjZKlnWWWUKgbL0trQ0kjqqJ/Bg0LjjuAjg c2SK72+3TNqR2H/NGoAwJgfX+H2nwqlwWGit/jsfe5t0pCl2V8i3kByvqQ3YqAi/ok3u 4IKA==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1781796284; x=1782401084; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:message-id:date:subject:cc:to:from :sender:from:to:cc:subject:date:message-id:reply-to; bh=2h7cvmPEuNNeBCYUK/x3RwJ7Nd2o4Q8ge7td4a/YKlQ=; b=H4eOJK8nlNUSWV411esBQcvVvOwihCJXeeoT2NZxUOa+uHHe4CmFwryj1Cz0v5YiHZ kLEjHfnEvOTGhvZE8UVIhmFNaLdtKMSmEaPBJ03fQ4ZwdxDE9G+crxtvuweI18ykHVR5 NfHS8zxSYQUTVK92Nd/lVT20YGiUwxLnGr2flDjrooZrD3RbCX/Sa8q16yApL19Qd5yS 4MPYBGDe4EmEoOqvgyblXhb810JIoRGoHZoExAfEyahJtsJGobS/09WxTFVDX+tyVmL1 jyLSWVIyG9bcZGVPI4cROSLL7NIWfsulNh494Ho1cGT7qbEy0d1DHD4YeeEqkNcMzG9C ICTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781796284; x=1782401084; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:mime-version :message-id:date:subject:cc:to:from:x-beenthere:x-gm-message-state :sender:from:to:cc:subject:date:message-id:reply-to; bh=2h7cvmPEuNNeBCYUK/x3RwJ7Nd2o4Q8ge7td4a/YKlQ=; b=frl1lgxeXTCtAZ6w+0SbluPDWH3GkvfJziUwq/Mrd4asp2PU0ePHC3w1iNgvX8Ktme OVPYwqvz7Js7I329+5cKYzzLZlzq/YwtcbUlp4bui3X0mLmRNiYm+0xUpU6Zb5lsytrO 2pw6A6GPmEVDZBpDFC5KwvfyWG0kZSp8PBJLbwxmo4u5V9PGjCvu2Kjf51y+JujfN1// ao5C6kKQBJgnc20KAs/G5ZnlrGVjUKNNck8exFiaSyDqqdAtY5+M0TvHBAbq9ao+8Aqk Z+XTuuwnIF3GDFhLgcBM8UKkIfZ05NAbbr+Sj7gFvN43gXp2RWt4OamUqB4FR6Sn1CfN I1oA== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AFNElJ/oUH8YtI7HgNFsZA/H5XdKQK3n2y95NvU1OpW1nXzgtkLuThM+78m26pCbWAKF8oyZMOdT@ilbers.de X-Gm-Message-State: AOJu0Yx1gCQeAYo7CjDG2xdtsVT0nHmpOHpSklFirXeOmiMrErm+kqdi 3VQ/idkqKF6k+Tdw4PCzwvsY7RXAHhODjAisQEkpKKrrbg4Xk/TWtKpr X-Received: by 2002:a05:600c:8106:b0:492:3dce:f707 with SMTP id 5b1f17b1804b1-4923f571763mr724905e9.17.1781796283315; Thu, 18 Jun 2026 08:24:43 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUdcIDibyqWeaLtgszbsUk888A2p/5DtVZmialkWs9n6lg==" Received: by 2002:a05:6000:4203:b0:460:1131:73dd with SMTP id ffacd0b85a97d-463abcce9f0ls933172f8f.1.-pod-prod-01-eu; Thu, 18 Jun 2026 08:24:40 -0700 (PDT) X-Received: by 2002:a05:600c:6389:b0:492:1e36:8c72 with SMTP id 5b1f17b1804b1-4923f6a2ab1mr176455e9.37.1781796280296; Thu, 18 Jun 2026 08:24:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1781796280; cv=none; d=google.com; s=arc-20240605; b=B7RlbofQJxIAw9xdAP9JpS9vv9Bj18wbTuWUVKWMSjMsL9hy/G/14kB2fgJF9nBqta 9is3GPpKbTR5ODlLZnvl2Kn725/3A2y9quPYhOo4o8PS+kOlZjH8MghoTI3YaLZKE/Ak uIcw2qQbSIDZ7VIjfqrXA1bgrHTXGX3FJpDTjFZX6owasGoI5pgILBnASQlV7AzzXoKf FOxg//iAJCfXQIihKowIS3vtgQSW41V0/d9enh9sfF/a1IfRm4x8ukAP/AGKd+LlJ4ta I6W0pyHjXa3Vd28hNs3lNd6lOgXiU/l9lNCvNtbuSTv8Tx7/v09uugKRSemRfJD1gQDp 9zPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from; bh=85Z0Ra3SSVz4JwNAaRvQeJjtbFDOFTyfh/uZ5g/QWJI=; fh=dLKbFY1nCVs0gw4Ot3U35lUCgkKClbVzBSGiWA5AeLc=; b=We27EK3t/2pMcAgYGKp7i1eyS2vcXWI3SwxSHnTN98Td/r1kmJMr980cSVxswVIN79 /LZUQrjA5igm/+cP8tC7pDdRByOUOYEIRiJ1Xqtj9jWmPLBNaJXPlN/fwCWC05x5T0Sr ewLUHeoQdMrT4CJy3VC7iqPrUzcOrTiECGRCiWbudCrW3eJqx+VLV+gCjHWS9UNoWLTw D+RKHF54isevTzOWdbfzVZX+z9ALZB3CzRpn2FusL0TjVZKRYiScimxyGIys8O/XSUCm OV/NNYl6X+zaRRaqUn3dNKLG38tS6vWjNb9uVTVYWM6Ba564+9uZetcCtAXaz9Yb3IEE sbUg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 5b1f17b1804b1-49230a6962dsi2544435e9.1.2026.06.18.08.24.40 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 18 Jun 2026 08:24:40 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from debian-zwei.m.ilbers.de ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPA id 65IFOdSk028871; Thu, 18 Jun 2026 17:24:39 +0200 From: Zhihang Wei To: isar-users@googlegroups.com Cc: felix.moessbauer@siemens.com Subject: Security Advisory: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap Date: Thu, 18 Jun 2026 17:24:38 +0200 Message-Id: <20260618152439.3884748-1-wzh@ilbers.de> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Content-Type: text/plain; charset="UTF-8" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: UJc0qh/COpM5 Hello all, A security advisory has been published at [1]. The patch fixing this issue, "[PATCH] mmdebstrap: ensure apt keystore is owned by root", is included in this series. The patch has been tested and applied to next already. [1] https://github.com/ilbers/isar/security/advisories/GHSA-rq66-pfw5-whqq Best, Zhihang Felix Moessbauer (1): mmdebstrap: ensure apt keystore is owned by root meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 1 + 1 file changed, 1 insertion(+) -- 2.39.5 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260618152439.3884748-1-wzh%40ilbers.de.