dcg v0.12.2 — security release
Upgrade recommended for every v0.11.0 – v0.12.1 install.
Security
-
Three redirect / stdin-device bypass siblings of the v0.12.1
heredoc-pipeline fix. A shell consuming piped or process-substituted
source reads its program from stdin (or the substitution file), but a
redirection operator on that consumer was tokenized as a script-file operand
and flipped the verdict to "the shell runs nothing", allowing the payload:… | bash 2>/dev/null/… | bash >log 2>&1— an output redirect on the
piped shell;… | bash /dev/stdin/bash /dev/fd/0— the shell reads the pipe as a
file through the stdin device;bash 2>/dev/null <(echo …)— the same on a process-substitution consumer
(bash and interpreter forms).
Redirection operators are now classified and skipped when scanning a
consumer's arguments; stdin devices are recognized as reading the pipe, and a
genuine stdin reassignment (bash < file) fails closed. Legit pipelines
whose consumer runs a real script file (… | bash deploy.sh) or a data tool
(… | grep,… | wc) are unchanged. This completes the heredoc/pipeline
executing-sink hardening begun in v0.12.1.
Verification
Every archive has .sha256, .minisig (key ID 69B3955C8D2E62A8),
.sigstore.json (local-release cosign key, DER SHA256
0e6947743daf39d6413cb25f6c96601427e38885f3a756e9f98f37d66e6df7a4) and SLSA
.intoto.jsonl provenance sidecars. install.sh --require-minisign /
install.ps1 -RequireMinisign -Verify enforce them.