Severity: high
Type: security
Location: clipsync/syncthing.py — _verify_release_signature() (~line 175), _fetch_official_sha256sums() (~line 225), _verify_archive_hash() (~line 250)
Problem: On stock Windows and other systems without gpg/gpg2 on PATH, the code logs a warning and falls back to a hash-only check. Because the hashes are fetched from the same remote origin as the archive, a compromised release can tamper with both, defeating supply-chain verification. The README claims PGP-signed verification.
Suggested fix: Either ship a minimal gpg verifier with the bundle or fail closed (refuse to download) when no verifier is available. Do not treat “gpg absent” as an acceptable silent downgrade to hash-only.
Filed from a full-source audit of the repo (2026-07-29). Independently confirmed against the source before filing.
Severity: high
Type: security
Location:
clipsync/syncthing.py—_verify_release_signature()(~line 175),_fetch_official_sha256sums()(~line 225),_verify_archive_hash()(~line 250)Problem: On stock Windows and other systems without
gpg/gpg2onPATH, the code logs a warning and falls back to a hash-only check. Because the hashes are fetched from the same remote origin as the archive, a compromised release can tamper with both, defeating supply-chain verification. The README claims PGP-signed verification.Suggested fix: Either ship a minimal gpg verifier with the bundle or fail closed (refuse to download) when no verifier is available. Do not treat “gpg absent” as an acceptable silent downgrade to hash-only.
Filed from a full-source audit of the repo (2026-07-29). Independently confirmed against the source before filing.