contrib/make_download: invert GPG name trickery
What the developer wrote
Authored by SomberNight
contrib/make_download: invert GPG name trickery
if I ran the script with the *.sombernight_releasekey.asc sigs present in dist/,
"SomberNight" and "sombernight_releasekey" were both included as signers
What changed, and why it matters
This commit fixes a small script that builds Electrum's download webpage. Previously, the script could list the same person twice under slightly different names if certain signature files were present. The change makes the script consistently use the key file name internally while still showing the friendly display name to users. It is a cosmetic/integrity cleanup, not a fix for an exploitable vulnerability.
No urgent action required. Treat as a minor quality fix. If backporting release-page generation scripts, include this change to avoid confusing signer listings.
Security signals we found
Prevents duplicate signer entries on the release download page
Improves consistency between displayed signer names and actual GPG key file references
Reduces risk of misleading users about which keys signed a release
Evidence from the diff
The contrib/make_download script generates the download page’s signer list. Before the patch, the default signers list contained ‘SomberNight’ and a lambda mapped that to the key file ‘sombernight_releasekey’. If *.sombernight_releasekey.asc signature files were also present in dist/, the detection logic added ‘sombernight_releasekey’ as an extra signer, causing both ‘SomberNight’ and ‘sombernight_releasekey’ to appear in the output. The patch inverts the mapping: the default signer is now ‘sombernight_releasekey’ (the key identifier), and a friendly_nick lambda converts it to ‘SomberNight’ only for display. The hyperlink now correctly points to the key file while the visible text remains the friendly name, eliminating duplicate signer entries.
Changed components
contrib/make_downloadInspect captured patch +3 / −3
diff --git a/contrib/make_download b/contrib/make_download
index 96a8f32..d3c9937 100755
--- a/contrib/make_download
+++ b/contrib/make_download
@@ -54,7 +54,7 @@ files = {
}
# default signers
-signers = ['ThomasV', 'SomberNight']
+signers = ['ThomasV', 'sombernight_releasekey']
# detect extra signers
list_dir = os.listdir('dist')
@@ -72,8 +72,8 @@ for k, v in detected_sigs.items():
print(f"signers: {signers}", file=sys.stderr)
-gpg_name = lambda x: 'sombernight_releasekey' if x=='SomberNight' else x
-signers_list = ', '.join("<a href=\"https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/%s.asc\">%s</a>"%(gpg_name(x), x) for x in signers)
+friendly_nick = lambda x: 'SomberNight' if x=='sombernight_releasekey' else x
+signers_list = ', '.join("<a href=\"https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/%s.asc\">%s</a>"%(x, friendly_nick(x)) for x in signers)
download_page_str = download_page_str.replace("##signers_list##", signers_list)
for k, filename in files.items():
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.