Rules / GL069

GL069 package signature/authentication verification bypassed

Severity: warn
OWASP: CICD-SEC-3 – Dependency Chain Abuse

What glsec checks

glsec flags package-manager invocations in script / before_script / after_script / run: steps that turn off the package manager's signature/authentication check:

• apt-get … --allow-unauthenticated
• -o APT::Get::AllowUnauthenticated=true
• a [trusted=yes] deb source (e.g. echo "deb [trusted=yes] http://repo …" >> /etc/apt/sources.list)
• apk … --allow-untrusted
• GOSUMDB=off, GONOSUMDB=* or GOINSECURE=* — in a script step or in a variables block

With verification off, a compromised or MITM'd mirror can serve an unsigned or tampered package that installs without error — a supply-chain foothold inside the pipeline. This is a different control from TLS verification (the transport), which GL042 covers; a repository can be reached over HTTPS and still serve unsigned packages.

apt-key add and add-apt-repository ppa:… are intentionally not flagged — they add a signing key rather than disabling verification, and are far noisier.

For Go, GONOSUMDB/GOPRIVATE scoped to a specific private host (GONOSUMDB=gitlab.example.com/*) is the normal setup for private modules and stays quiet; only off or a bare * is reported.

Trigger example

build:
  script:
    - apt-get install -y --allow-unauthenticated somepkg              # skips package signature check
    - echo "deb [trusted=yes] http://repo.example/ ./" >> /etc/apt/sources.list
    - GOSUMDB=off go mod download                                    # skips the Go checksum database

The Go settings are also caught in a variables block:

build:
  variables:
    GOSUMDB: "off"
  script:
    - go mod download

Safe alternative

Keep signature verification on. Import the repository's signing key into a dedicated keyring and reference it with signed-by= instead of [trusted=yes]:

install:
  script:
    - curl -fsSL https://repo.example/key.gpg | gpg --dearmor -o /usr/share/keyrings/example.gpg
    - echo "deb [signed-by=/usr/share/keyrings/example.gpg] https://repo.example/ ./" >> /etc/apt/sources.list.d/example.list
    - apt-get update && apt-get install -y somepkg

References

• Debian wiki: SecureApt
• apk-add: --allow-untrusted
• Go modules reference: GOSUMDB and the checksum database
• GL042: TLS certificate verification disabled (curl -k, --no-check-certificate)
• GL011: download-and-execute pattern in script

Documentation for glsec 1.23.0. Source of this page · Rule implementation