Repository: freedomofpress/securedrop

Issue:
`securedrop-admin` does not include new UID in signature check
## Description

`securedrop-admin` (which is used by the graphical updater) does not check for our new release key UID, here:

https://github.com/freedomofpress/securedrop/blob/develop/admin/securedrop_admin/__init__.py#L946-L949

The new UID is `securedrop-release-key-2021@freedom.press`. This omission means that the tag verification will fail. (Note the closing quotation mark on the first line, which is not present when the key has a UID associated with it.)

## Steps to Reproduce

A bit difficult as we currently don't have a tag signed with the new key up. I've so far only tested this by manually attempting to match signature output in the same manner as the updater does.


Discussion:

Resolving patch:
diff --git a/admin/securedrop_admin/__init__.py b/admin/securedrop_admin/__init__.py
--- a/admin/securedrop_admin/__init__.py
+++ b/admin/securedrop_admin/__init__.py
@@ -946,7 +946,9 @@ def update(args: argparse.Namespace) -> int:
         good_sig_text = ['Good signature from "SecureDrop Release Signing ' +
                          'Key"',
                          'Good signature from "SecureDrop Release Signing ' +
-                         'Key <securedrop-release-key@freedom.press>"']
+                         'Key <securedrop-release-key@freedom.press>"',
+                         'Good signature from "SecureDrop Release Signing ' +
+                         'Key <securedrop-release-key-2021@freedom.press>"']
         bad_sig_text = 'BAD signature'
         gpg_lines = sig_result.split('\n')
 


Test patch:
diff --git a/admin/tests/test_securedrop-admin.py b/admin/tests/test_securedrop-admin.py
--- a/admin/tests/test_securedrop-admin.py
+++ b/admin/tests/test_securedrop-admin.py
@@ -274,6 +274,25 @@ def test_get_release_key_from_valid_keyserver(self, tmpdir, caplog):
                               b'Signing Key '
                               b'<securedrop-release-key@freedom.press>"\n',
 
+                              b'gpg: Signature made Thu 20 Jul '
+                              b'2017 08:12:25 PM EDT\n'
+                              b'gpg:                using RSA key '
+                              b'2359E6538C0613E652955E6C188EDD3B7B22E6A3\n'
+                              b'gpg: Good signature from "SecureDrop Release '
+                              b'Signing Key '
+                              b'<securedrop-release-key-2021@freedom.press>"\n',
+
+                              b'gpg: Signature made Thu 20 Jul '
+                              b'2017 08:12:25 PM EDT\n'
+                              b'gpg:                using RSA key '
+                              b'2359E6538C0613E652955E6C188EDD3B7B22E6A3\n'
+                              b'gpg: Good signature from "SecureDrop Release '
+                              b'Signing Key" [unknown]\n'
+                              b'gpg:                 aka "SecureDrop Release '
+                              b'Signing Key '
+                              b'<securedrop-release-key-2021@freedom.press>" '
+                              b'[unknown]\n',
+
                               b'gpg: Signature made Thu 20 Jul '
                               b'2017 08:12:25 PM EDT\n'
                               b'gpg:                using RSA key '