amadan
geo: pin the tzdata signer to Paul Eggert's key; test zone.tab wins over a link
update-tzgeo.sh now requires a VALIDSIG whose primary fingerprint is the pinned key, instead of accepting any key in the keyring. The Amsterdam assertion fails if resolveLinks tries links before zone.tab.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 files changed,
+14
−1
internal/geo/tz_test.go+7 −0scripts/update-tzgeo.sh+7 −1
diff --git a/internal/geo/tz_test.go b/internal/geo/tz_test.go| index cf157808e..9d5de318d 100644 |
| --- a/internal/geo/tz_test.go |
| +++ b/internal/geo/tz_test.go |
| @@ -22,6 +22,13 @@ func TestZonePoint(t *testing.T) { |
| if a != b { |
| t.Errorf("Asia/Calcutta %v != Asia/Kolkata %v; the link must resolve to one point", a, b) |
| } |
| + // Amsterdam is a link to Brussels in tzdata 2026b, but zone.tab gives it |
| + // its own row: zone.tab wins over links (spec §6.2). |
| + am, _ := ZonePoint("Europe/Amsterdam") |
| + br, _ := ZonePoint("Europe/Brussels") |
| + if am == br { |
| + t.Errorf("Europe/Amsterdam = Europe/Brussels = %v; a zone.tab row must win over a link", am) |
| + } |
| unmapped := []string{ |
| "", "UTC", "Etc/UTC", "Etc/GMT+5", "GMT", "UCT", "Universal", "Zulu", |
| "Factory", "Local", "localtime", "posixrules", "../etc/passwd", |
diff --git a/scripts/update-tzgeo.sh b/scripts/update-tzgeo.sh| index fe9ae7457..704a0f3e6 100755 |
| --- a/scripts/update-tzgeo.sh |
| +++ b/scripts/update-tzgeo.sh |
| @@ -7,6 +7,8 @@ |
| # as a release-checklist step beside the Go toolchain bump; a stale table |
| # only misses zone names newer than it, and those fall through to IP. |
| set -euo pipefail |
| +# Paul Eggert's tzdata signing key: the only signer this script accepts. |
| +tz_signer=7E3792A9D8ACF7D633BC1588ED97E90E62AA7E34 |
| v="${1:?usage: update-tzgeo.sh <tzdata version, e.g. 2026b>}" |
| here="$(cd "$(dirname "$0")/.." && pwd)" |
| out="$here/internal/geo/data" |
| @@ -16,7 +18,11 @@ base="https://data.iana.org/time-zones/releases" |
| curl -fsSL -o "$work/tzdata.tar.gz" "$base/tzdata$v.tar.gz" |
| curl -fsSL -o "$work/tzdata.tar.gz.asc" "$base/tzdata$v.tar.gz.asc" |
| if command -v gpg >/dev/null; then |
| - gpg --verify "$work/tzdata.tar.gz.asc" "$work/tzdata.tar.gz" |
| + status="$(gpg --status-fd 1 --verify "$work/tzdata.tar.gz.asc" "$work/tzdata.tar.gz")" |
| + # VALIDSIG's 12th field is the signing key's primary fingerprint. An |
| + # expired key still gives VALIDSIG, which is fine: the signature predates it. |
| + printf '%s\n' "$status" | |
| + awk -v fp="$tz_signer" '$2 == "VALIDSIG" && $12 == fp { ok = 1 } END { exit !ok }' || exit 1 |
| else |
| echo "gpg not found: signature NOT checked" >&2 |
| exit 1 |