f27ec770fc
Observed on the operator's machine 2026-10-30 while reinstalling to put the app to use. Four months after the package was purged, a fresh install found ~/.config/Signal/sql/db.sqlite (54,214,656 bytes, mtime 2026-06-21), tried to open it, and aborted before the linking screen: MainSQL: sqlite(SQLITE_NOTADB): file is not a database in PRAGMA journal_mode = WAL MainSQL: migrateDatabase: Migration without cipher change failed sql.initialize was unsuccessful; returning early The SQLCipher key in config.json no longer resolved. The UI named nothing and offered only 'Delete data and restart', which discards the history. Moving the config directory aside fixes it; nothing in the product says so. Recorded as a medium finding, status open. The score does not move: 76.4 / B. local_data_exposure was already 5 for exactly this behaviour, and a finding is evidence, not a point. What changes is that the number now has a receipt instead of a rationale. Artifact: Servetus/00-Artifacts/2026/10-Oct/30/clu-signal-startup-failure/ main.log.excerpt - the failing run, verbatim 00-provenance.txt - package version, file sizes, sha256 of the retained db Retained state moved to ~/Signal-backup-2026-10-30-0026, not deleted.
34 lines
2 KiB
SQL
34 lines
2 KiB
SQL
-- =====================================================================
|
|
-- 0005 — Signal Desktop: the uninstall does not uninstall
|
|
--
|
|
-- Observed on the operator's own machine, 2026-10-30 00:24 CDT, while trying
|
|
-- to use the product for the first time since June.
|
|
--
|
|
-- This is a FINDING, not a score change. It does not move any dimension,
|
|
-- because local_data_exposure is already at 5 for the plaintext attachment
|
|
-- behaviour. What it does is replace a rationale with a demonstrated failure.
|
|
--
|
|
-- Artifact: 00-Artifacts/2026/10-Oct/30/clu-signal-startup-failure/
|
|
-- =====================================================================
|
|
|
|
INSERT INTO finding (assessment_id, severity, title, detail, status, disclosed_on)
|
|
VALUES (
|
|
'A-2026-10-29-SIGNAL-DESKTOP',
|
|
'medium',
|
|
'Purging the package leaves the database behind, and the next install then fails to start',
|
|
|
|
'On Linux, Signal keeps its state in ~/.config/Signal. Removing the signal-desktop package does not remove '
|
|
|| 'that directory. Reinstalling on 2026-10-30 found a 54,214,656-byte sql/db.sqlite last written 2026-06-21 '
|
|
|| 'and tried to open it. The SQLCipher key recorded in config.json no longer resolved, so every startup '
|
|
|| 'aborted with SQLITE_NOTADB before the app could reach the linking screen: '
|
|
|| '"MainSQL: sqlite(SQLITE_NOTADB): file is not a database in PRAGMA journal_mode = WAL", then '
|
|
|| '"MainSQL: migrateDatabase: Migration without cipher change failed", then '
|
|
|| '"sql.initialize was unsuccessful; returning early". The user sees a "Can''t Open Signal" dialog '
|
|
|| 'whose only working option is "Delete data and restart", which discards the retained history. '
|
|
|| 'The same directory also held 355 received attachments (25 MB) in plaintext, 25 stickers, 189 badge '
|
|
|| 'files and an encryptedKey, all surviving a four-month-old uninstall. '
|
|
|| 'The failure is recoverable by moving the configuration directory aside, but nothing in the product '
|
|
|| 'tells the user that the old database is the cause, and the offered remedy is data loss.',
|
|
'open',
|
|
'2026-10-30'
|
|
);
|