Skip to content

Commit 517a367

Browse files
wxiaoguangwxiaoguang
authored
Use ProtonMail/go-crypto to replace keybase/go-crypto (#33402)
Fix #33400 The keybase/go-crypto is no longer maintained and it generates malformed signatures, ProtonMail/go-crypto is the actively maintained fork.
1 parent fae69bc commit 517a367

File tree

12 files changed

+55
-39
lines changed

12 files changed

+55
-39
lines changed

‎assets/go-licenses.json‎

Lines changed: 0 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go.mod‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,6 @@ require (
7878
github.com/jhillyerd/enmime v1.3.0
7979
github.com/json-iterator/go v1.1.12
8080
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
81-
github.com/keybase/go-crypto v0.0.0-20200123153347-de78d2cb44f4
8281
github.com/klauspost/compress v1.17.11
8382
github.com/klauspost/cpuid/v2 v2.2.8
8483
github.com/lib/pq v1.10.9

‎go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -506,8 +506,6 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU
506506
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
507507
github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
508508
github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
509-
github.com/keybase/go-crypto v0.0.0-20200123153347-de78d2cb44f4 h1:cTxwSmnaqLoo+4tLukHoB9iqHOu3LmLhRmgUxZo6Vp4=
510-
github.com/keybase/go-crypto v0.0.0-20200123153347-de78d2cb44f4/go.mod h1:ghbZscTyKdM07+Fw3KSi0hcJm+AlEUWj8QLlPtijN/M=
511509
github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
512510
github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
513511
github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=

‎models/asymkey/gpg_key.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ import (
1313
user_model "code.gitea.io/gitea/models/user"
1414
"code.gitea.io/gitea/modules/timeutil"
1515

16-
"github.com/keybase/go-crypto/openpgp"
17-
"github.com/keybase/go-crypto/openpgp/packet"
16+
"github.com/ProtonMail/go-crypto/openpgp"
17+
"github.com/ProtonMail/go-crypto/openpgp/packet"
1818
"xorm.io/builder"
1919
)
2020

@@ -141,7 +141,11 @@ func parseGPGKey(ctx context.Context, ownerID int64, e *openpgp.Entity, verified
141141
// Parse Subkeys
142142
subkeys := make([]*GPGKey, len(e.Subkeys))
143143
for i, k := range e.Subkeys {
144-
subs, err := parseSubGPGKey(ownerID, pubkey.KeyIdString(), k.PublicKey, expiry)
144+
subkeyExpiry := expiry
145+
if k.Sig.KeyLifetimeSecs != nil {
146+
subkeyExpiry = k.PublicKey.CreationTime.Add(time.Duration(*k.Sig.KeyLifetimeSecs) * time.Second)
147+
}
148+
subs, err := parseSubGPGKey(ownerID, pubkey.KeyIdString(), k.PublicKey, subkeyExpiry)
145149
if err != nil {
146150
return nil, ErrGPGKeyParsing{ParseError: err}
147151
}
@@ -156,7 +160,7 @@ func parseGPGKey(ctx context.Context, ownerID int64, e *openpgp.Entity, verified
156160

157161
emails := make([]*user_model.EmailAddress, 0, len(e.Identities))
158162
for _, ident := range e.Identities {
159-
if ident.Revocation != nil {
163+
if ident.Revoked(time.Now()) {
160164
continue
161165
}
162166
email := strings.ToLower(strings.TrimSpace(ident.UserId.Email))

‎models/asymkey/gpg_key_add.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
"code.gitea.io/gitea/models/db"
1111
"code.gitea.io/gitea/modules/log"
1212

13-
"github.com/keybase/go-crypto/openpgp"
13+
"github.com/ProtonMail/go-crypto/openpgp"
1414
)
1515

1616
// __________________ ________ ____ __.
@@ -83,12 +83,12 @@ func AddGPGKey(ctx context.Context, ownerID int64, content, token, signature str
8383
verified := false
8484
// Handle provided signature
8585
if signature != "" {
86-
signer, err := openpgp.CheckArmoredDetachedSignature(ekeys, strings.NewReader(token), strings.NewReader(signature))
86+
signer, err := openpgp.CheckArmoredDetachedSignature(ekeys, strings.NewReader(token), strings.NewReader(signature), nil)
8787
if err != nil {
88-
signer, err = openpgp.CheckArmoredDetachedSignature(ekeys, strings.NewReader(token+"\n"), strings.NewReader(signature))
88+
signer, err = openpgp.CheckArmoredDetachedSignature(ekeys, strings.NewReader(token+"\n"), strings.NewReader(signature), nil)
8989
}
9090
if err != nil {
91-
signer, err = openpgp.CheckArmoredDetachedSignature(ekeys, strings.NewReader(token+"\r\n"), strings.NewReader(signature))
91+
signer, err = openpgp.CheckArmoredDetachedSignature(ekeys, strings.NewReader(token+"\r\n"), strings.NewReader(signature), nil)
9292
}
9393
if err != nil {
9494
log.Error("Unable to validate token signature. Error: %v", err)

‎models/asymkey/gpg_key_commit_verification.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616
"code.gitea.io/gitea/modules/log"
1717
"code.gitea.io/gitea/modules/setting"
1818

19-
"github.com/keybase/go-crypto/openpgp/packet"
19+
"github.com/ProtonMail/go-crypto/openpgp/packet"
2020
)
2121

2222
// __________________ ________ ____ __.

‎models/asymkey/gpg_key_common.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ import (
1313
"strings"
1414
"time"
1515

16-
"github.com/keybase/go-crypto/openpgp"
17-
"github.com/keybase/go-crypto/openpgp/armor"
18-
"github.com/keybase/go-crypto/openpgp/packet"
16+
"github.com/ProtonMail/go-crypto/openpgp"
17+
"github.com/ProtonMail/go-crypto/openpgp/armor"
18+
"github.com/ProtonMail/go-crypto/openpgp/packet"
1919
)
2020

2121
// __________________ ________ ____ __.
@@ -80,20 +80,20 @@ func base64DecPubKey(content string) (*packet.PublicKey, error) {
8080
return pkey, nil
8181
}
8282

83-
// getExpiryTime extract the expire time of primary key based on sig
83+
// getExpiryTime extract the expiry time of primary key based on sig
8484
func getExpiryTime(e *openpgp.Entity) time.Time {
8585
expiry := time.Time{}
8686
// Extract self-sign for expire date based on : https://github.com/golang/crypto/blob/master/openpgp/keys.go#L165
8787
var selfSig *packet.Signature
8888
for _, ident := range e.Identities {
8989
if selfSig == nil {
9090
selfSig = ident.SelfSignature
91-
} else if ident.SelfSignature.IsPrimaryId != nil && *ident.SelfSignature.IsPrimaryId {
91+
} else if ident.SelfSignature != nil && ident.SelfSignature.IsPrimaryId != nil && *ident.SelfSignature.IsPrimaryId {
9292
selfSig = ident.SelfSignature
9393
break
9494
}
9595
}
96-
if selfSig.KeyLifetimeSecs != nil {
96+
if selfSig != nil && selfSig.KeyLifetimeSecs != nil {
9797
expiry = e.PrimaryKey.CreationTime.Add(time.Duration(*selfSig.KeyLifetimeSecs) * time.Second)
9898
}
9999
return expiry

‎models/asymkey/gpg_key_test.go‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ import (
1313
"code.gitea.io/gitea/modules/timeutil"
1414
"code.gitea.io/gitea/modules/util"
1515

16-
"github.com/keybase/go-crypto/openpgp/packet"
16+
"github.com/ProtonMail/go-crypto/openpgp"
17+
"github.com/ProtonMail/go-crypto/openpgp/packet"
1718
"github.com/stretchr/testify/assert"
1819
"github.com/stretchr/testify/require"
1920
)
@@ -403,3 +404,25 @@ func TestTryGetKeyIDFromSignature(t *testing.T) {
403404
IssuerFingerprint: []uint8{0xb, 0x23, 0x24, 0xc7, 0xe6, 0xfe, 0x4f, 0x3a, 0x6, 0x26, 0xc1, 0x21, 0x3, 0x8d, 0x1a, 0x3e, 0xad, 0xdb, 0xea, 0x9c},
404405
}))
405406
}
407+
408+
func TestParseGPGKey(t *testing.T) {
409+
assert.NoError(t, unittest.PrepareTestDatabase())
410+
assert.NoError(t, db.Insert(db.DefaultContext, &user_model.EmailAddress{UID: 1, Email: "[email protected]", IsActivated: true}))
411+
412+
// create a key for test email
413+
e, err := openpgp.NewEntity("name", "comment", "[email protected]", nil)
414+
require.NoError(t, err)
415+
k, err := parseGPGKey(db.DefaultContext, 1, e, true)
416+
require.NoError(t, err)
417+
assert.NotEmpty(t, k.KeyID)
418+
assert.NotEmpty(t, k.Emails) // the key is valid, matches the email
419+
420+
// then revoke the key
421+
for _, id := range e.Identities {
422+
id.Revocations = append(id.Revocations, &packet.Signature{RevocationReason: util.ToPointer(packet.KeyCompromised)})
423+
}
424+
k, err = parseGPGKey(db.DefaultContext, 1, e, true)
425+
require.NoError(t, err)
426+
assert.NotEmpty(t, k.KeyID)
427+
assert.Empty(t, k.Emails) // the key is revoked, matches no email
428+
}

‎routers/web/user/home.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@ import (
4141
issue_service "code.gitea.io/gitea/services/issue"
4242
pull_service "code.gitea.io/gitea/services/pull"
4343

44-
"github.com/keybase/go-crypto/openpgp"
45-
"github.com/keybase/go-crypto/openpgp/armor"
44+
"github.com/ProtonMail/go-crypto/openpgp"
45+
"github.com/ProtonMail/go-crypto/openpgp/armor"
4646
"xorm.io/builder"
4747
)
4848

‎services/packages/arch/repository.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ import (
2626
"code.gitea.io/gitea/modules/util"
2727
packages_service "code.gitea.io/gitea/services/packages"
2828

29-
"github.com/keybase/go-crypto/openpgp"
30-
"github.com/keybase/go-crypto/openpgp/armor"
31-
"github.com/keybase/go-crypto/openpgp/packet"
29+
"github.com/ProtonMail/go-crypto/openpgp"
30+
"github.com/ProtonMail/go-crypto/openpgp/armor"
31+
"github.com/ProtonMail/go-crypto/openpgp/packet"
3232
)
3333

3434
const (

0 commit comments

Comments
 (0)