coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

Impact

coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a newly-installed system.

Default installations from ISO or PXE media in Fedora CoreOS, RHEL CoreOS, and RHEL for Edge are not affected, as coreos-installer installs from an OS image shipped as part of the install media.

These flows are affected:

1. Installing with --image-file, --image-url, or coreos.inst.image_url. For example, if a user has a local mirror of installation images, an attacker could replace an image with a gzip-compressed alternative (even if the file extension is .xz). The result:

   $ coreos-installer install --image-url http://localhost:8080/image.xz /dev/loop0
   Downloading image from http://localhost:8080/image.xz
   Downloading signature from http://localhost:8080/image.xz.sig
   > Read disk 749.9 MiB/749.9 MiB (100%)
   gpg: Signature made Mon 20 Sep 2021 02:41:50 PM EDT
   gpg: using RSA key 8C5BA6990BDB26E19F2A1A801161AE6945719A39
   gpg: BAD signature from "Fedora (34) " [ultimate]
   Install complete.
   

   Notice that GPG reports a bad signature, but coreos-installer continues anyway. Automation that relies on coreos-installer's exit status will not notice either.

2. `coreos-installer download --decompress --image-u…