internal/auditpush/pubkey.go at b663803169, reviewed by codex:gpt-6-astra, verified by claude-code:claude-fable-5-1.
Whitespace-only key values are treated as absent instead of malformed, so CORRALAI_LEDGER_PUBKEY=' ' with no flag disables signature checking without an error, while --pub=' ' falls through to the environment key.
The behavioural claim is correct on the named inputs. pubkey.go:26 and :29 trim the flag and the environment variable before comparing to the empty string, so a flag of ' ' falls through to the environment and an environment value of ' ' with an empty flag returns nil, "", nil at line 32; parseLedgerPubKey, the sole source of the malformed-key error, is never invoked for either. I tried to refute it on consequence instead: the nil key is not a quiet downgrade, because runVerifyLedger at cmd/corral/verify_attest.go:544-545 annotates every signed entry with 'unverified, signature NOT CHECKED (no --pub, no CORRALAI_LEDGER_PUBKEY)', and the same trim-then-empty idiom is the repository's standing convention for optional env/flag inputs, which makes 'whitespace means unset' a defensible design rather than an obvious bug. Those narrow the severity but do not falsify the finding as stated, so it stands.
confirmed by pdbethke — real, low not medium, checked by reading main b6638031: pubkey.go:26/:29 TrimSpace before the emptiness test, so CORRALAI_LEDGER_PUBKEY=' ' resolves to no key and never reaches parseLedgerPubKey — against the function's own doc ('a malformed key from either source is an error … whoever set it meant to check'). Severity lowered because the downgrade is not silent: verify prints 'signature NOT CHECKED' on every signed entry.
ref e5fd4c8d1b5091468866ade60a0d5d9627034a5e401ed98dece90fb6318791d7#R1
Recorded so that "found nothing here" can be told apart from "never looked here".
Finding 1 identifies a whitespace-only configuration that bypasses the documented malformed-key refusal. This review was limited to source inspection; no code or tests were executed.
R1 describes the code accurately: ResolveLedgerPubKey (internal/auditpush/pubkey.go:26 and :29) runs strings.TrimSpace on both the flag and the environment value before the emptiness test, so a value consisting only of whitespace is indistinguishable from an unset one and never reaches parseLedgerPubKey, which is the only place the malformed-key error is raised. I could not make that false. What the finding overstates is the consequence: the fallthrough is not silent. runVerifyLedger (cmd/corral/verify_attest.go:544-545) prints 'signed by … — unverified, signature NOT CHECKED (no --pub, no CORRALAI_LEDGER_PUBKEY)' on every signed entry when the resolved key is nil, so an operator who exported a blank key sees on each line that no check happened. Whether a whitespace-only value should count as 'set and malformed' rather than 'unset' is also a convention question — the same TrimSpace-then-empty idiom is used for env and flag inputs elsewhere in the repository (e.g. scripts/criticbench/main.go:323, cmd/corral-recordings-import/main.go:91-93), and the doc comment's 'malformed' plausibly means a non-empty value that fails to parse. Neither point refutes the stated behaviour, so the finding stands, with medium severity looking high for a visibly-reported downgrade.