Claudia Pellegrino claui

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

This is a quick guide of the commands we use to sign someone's GPG key in a virtual key signing party.

Note: The steps cover only the technical aspects of signing someone's key. Before signing someone's key, you must verify their identity. This is usually done by showing government-issued ID and confirming the key's fingerprint

The commands will work for both GPG and GPG2.

I use Julian's key for the examples. His key id is 2AD3FAE3. You should substitute with the appropriate key id when running the commands.

Signing the key

List the keys currently in your keyring: gpg --list-keys.

Requirements

Encrypt everthing including /boot and /root
Enter password once
Support UEFI

Installation media setup

Download NixOS minimal iso and copy to USB stick. For example on Mac OSX

$ diskutil list
$ diskutil unmountDisk /dev/disk1 # Make sure you got right device

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>Fullscreen Image Viewer</title>
	<style>
	body {
	font-family: Arial, sans-serif;
	}

	{
	"type": "object",
	"required": ["Statement"],
	"additionalProperties": false,
	"properties": {
	"Version": {
	"type": "string",
	"enum": ["2008-10-17", "2012-10-17"]
	},
	"Id": {

	require "#{ENV["TM_SUPPORT_PATH"]}/lib/scriptmate"

	class NodeScript < UserScript
	def lang; "JavaScript" end
	def default_extension; ".js" end
	def args
	[]
	end
	def executable; @hashbang \|\| ENV['TM_NODE'] \|\| 'node' end
	def version_string

	<?php
	require('workflows.php');
	$w = new Workflows();

	// Grab input and build query url string
	$in = "{query}";
	$url = "http://completion.amazon.co.uk/search/complete?method=completion&q=".urlencode( $in )."&search-alias=aps&mkt=4&x=updateISSCompletion&noCacheIE=1295031912518";

	// Grab the data from Amazon
	$str = $w->request( $url );

	wget --no-check-certificate --recursive --domains=opensource.apple.com --no-clobber --accept "*.gz" --no-parent -l2 https://opensource.apple.com/tarballs
	wget --no-check-certificate --recursive --domains=opensource.apple.com --no-clobber --accept "*.gz" -l2 https://opensource.apple.com/
	wget --no-check-certificate --recursive --domains=opensource.apple.com --no-clobber --accept "*.gz" --no-parent -l3 https://opensource.apple.com/darwinbuild/