The Sparrow installer fetches a configured SIGNING_KEY, but artifact acceptance uses generic gpg --verify against the user's persistent GnuPG keyring. The successful signer fingerprint is never compared with the configured Sparrow publisher fingerprint.
Affected code:
bails/.local/bin/install-sparrow
Impact: if the Sparrow release channel is compromised, an unrelated key already present in the user's GnuPG keyring can authenticate attacker-controlled package data. The accepted package is then installed and launched and can execute package post-installation code.
Expected fix: verify artifacts in an isolated keyring containing only the expected Sparrow publisher key, or parse machine-readable VALIDSIG output and require an exact canonical fingerprint match with SIGNING_KEY before processing package contents.
Bisq, Liana, Wasabi, and generic wallet installers are outside the supported scope.
The Sparrow installer fetches a configured
SIGNING_KEY, but artifact acceptance uses genericgpg --verifyagainst the user's persistent GnuPG keyring. The successful signer fingerprint is never compared with the configured Sparrow publisher fingerprint.Affected code:
bails/.local/bin/install-sparrowImpact: if the Sparrow release channel is compromised, an unrelated key already present in the user's GnuPG keyring can authenticate attacker-controlled package data. The accepted package is then installed and launched and can execute package post-installation code.
Expected fix: verify artifacts in an isolated keyring containing only the expected Sparrow publisher key, or parse machine-readable
VALIDSIGoutput and require an exact canonical fingerprint match withSIGNING_KEYbefore processing package contents.Bisq, Liana, Wasabi, and generic wallet installers are outside the supported scope.