fix apt-key net-update by erroring out if there are any duplicated keys in master-keyring and add-keyring (see lp #857472) and add regression test

1 files changed, 11 insertions, 0 deletions

diff --git a/cmdline/apt-key b/cmdline/apt-key
index 4d2b7c49f..8a3f5ba54 100755
--- a/cmdline/apt-key
+++ b/cmdline/apt-key
@@ -50,6 +50,17 @@ add_keys_with_verify_against_master_keyring() {
     #   from a key in the $distro-master-keyring
     add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
     master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
+    # verify to ensure that there are no key id duplications that may be
+    # used to attack the system, see LP: #857472
+    for add_key in $add_keys; do
+	for master_key in $master_keys; do
+            if [ "$add_key" = "$master_key" ]; then
+                echo >&2 "Keyid collision for '$add_key' detected, operation aborted"
+                return 1
+            fi
+        done
+    done
+    # add all keys signed with any of the master key(s)
     for add_key in $add_keys; do
 	ADDED=0
 	for master_key in $master_keys; do