robbat2

#!/bin/bash
# Clean up a x509 cert to make it nice to use
# supports multiple certs in the same file!
#
# Copyright 2014-2018 Robin H Johnson <[email protected]>
# Licensed under the BSD-3 license
# http://opensource.org/licenses/BSD-3-Clause
TMP=$(mktemp)
TMPD=$(mktemp -d)
TMPOUT=$(mktemp)

robbat2

# SPDX-License: ???
def parseDate(date): date | capture("(?<no_tz>.*)(?<tz_sgn>[-+])(?<tz_hr>\\d{2}):(?<tz_min>\\d{2})$") | (.no_tz + "Z" | sub("\\.000Z";"Z")| fromdateiso8601) - (.tz_sgn + "60" | tonumber) * ((.tz_hr | tonumber) * 60 + (.tz_min | tonumber));

robbat2

FORMAIL=/usr/bin/formail
UUID=`/usr/bin/uuidgen`

# inject the salt into the mail
:0 fhw
* H ?? !^X-Archives-Salt
| $FORMAIL -A "X-Archives-Salt: $UUID"

# hash the mail headers, with the salt
HASH=`$FORMAIL -X Received -X Date -X Message-ID -X From -X Subject -X List-Id -X X-Archives-Salt | md5sum | awk '{print $1}'`

robbat2

Date: Tue, 11 Jul 2023 12:13:53 -0500 (CDT)
From: GitLab <[email protected]>
Subject: [Action Required] Review GitLab Emails Before Lock
To: (personal email, primary on my GitLab account)
Reply-To: [email protected]
Message-ID: (redacted)

We want to let you know that we recently changed the way Enterprise Users <https://docs.gitlab.com/ee/user/enterprise_user/>
are defined <https://about.gitlab.com/handbook/support/workflows/gitlab-com_overview.html#enterprise-users> to ensure that
members can be managed by valid enterprise admins and bolster security for your organization.

robbat2

{
  "Id": "SourceIP",
  "Statement": [
    {
      "Action": "s3:*",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": [
            "10.0.0.0/8",
            "172.16.0.0/12",

robbat2

#!/bin/bash
# You might need to insert this in a slightly different place
cat >>/etc/ssh/ssh_config <<EOF
Host *
  RevokedHostKeys /etc/ssh/ssh_revoked_hosts
EOF

cat >>/etc/ssh/ssh_revoked_hosts <<EOF
# https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

robbat2

>>> Creating Manifest for /code/gentoo/gentoo-git/repo/gentoo/app-crypt/age
 * age-1.0.0.tar.gz BLAKE2B SHA512 size ;-) ...                          [ ok ]
 * age-1.0.0-deps-tampered.tar.xz BLAKE2B SHA512 size ;-) ...            [ ok ]
>>> Unpacking source...
>>> Unpacking age-1.0.0.tar.gz to /var/tmp/portage-tmpfs/portage/app-crypt/age-1.0.0-r1/work
>>> Unpacking age-1.0.0-deps-tampered.tar.xz to /var/tmp/portage-tmpfs/portage/app-crypt/age-1.0.0-r1/work
go mod verify
all modules verified
>>> Source unpacked in /var/tmp/portage-tmpfs/portage/app-crypt/age-1.0.0-r1/work
>>> Preparing source in /var/tmp/portage-tmpfs/portage/app-crypt/age-1.0.0-r1/work/age-1.0.0 ...

robbat2

Gentoo Golang deps bundled injection PoC
----------------------------------------
Author: Robin H. Johnson <[email protected]>
Date: 2022/10/21

Go build does not catch the injection of malicious code that might have been
included in a deps tarball.

$WORKDIR/age-1.0.0/go.sum (which is more-trusted, since it came from the age
upstream), contains this entry:

robbat2

upgraded packages that could have broken it

x11-libs/pango  ->1.50.4 ->1.50.6
x11-libs/motif  ->2.3.8-r2 ->2.3.8-r3
x11-libs/libva  ->2.13.0-r2 ->2.14.0
x11-libs/mx  ->1.4.7-r2
x11-base/xwayland  ->22.1.0 ->22.1.1
x11-libs/vte  ->0.66.2 ->0.68.0
dev-qt/qtx11extras  ->5.15.2-r1 ->5.15.3
x11-libs/libX11  ->1.7.3 ->1.7.4

robbat2

#!/usr/bin/perl -w
# The -w is required to trigger the segfault
# Copyright 2021/11/17 Robin H. Johnson <[email protected]>
# Public domain
my $v = undef;
my $c = undef;
my %x;
$x{$v} = '';
$x{$v} .= '  '.$c; # crash