From 8d63c983c982f93cc48d3996d6bd097ddeeb327f Mon Sep 17 00:00:00 2001 From: Michael Muré Date: Sun, 3 Jan 2021 23:59:25 +0100 Subject: WIP --- identity/key.go | 187 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 181 insertions(+), 6 deletions(-) (limited to 'identity/key.go') diff --git a/identity/key.go b/identity/key.go index cc948394..8dd5e8c1 100644 --- a/identity/key.go +++ b/identity/key.go @@ -1,18 +1,193 @@ package identity +import ( + "bytes" + "encoding/json" + "fmt" + "io" + "strings" + "time" + + "github.com/pkg/errors" + "golang.org/x/crypto/openpgp" + "golang.org/x/crypto/openpgp/armor" + "golang.org/x/crypto/openpgp/packet" + + "github.com/MichaelMure/git-bug/repository" +) + type Key struct { - // The GPG fingerprint of the key - Fingerprint string `json:"fingerprint"` - PubKey string `json:"pub_key"` + public *packet.PublicKey + private *packet.PrivateKey +} + +// GenerateKey generate a keypair (public+private) +func GenerateKey() *Key { + entity, err := openpgp.NewEntity("", "", "", &packet.Config{ + // The armored format doesn't include the creation time, which makes the round-trip data not being fully equal. + // We don't care about the creation time so we can set it to the zero value. + Time: func() time.Time { + return time.Time{} + }, + }) + if err != nil { + panic(err) + } + return &Key{ + public: entity.PrimaryKey, + private: entity.PrivateKey, + } +} + +// generatePublicKey generate only a public key (only useful for testing) +// See GenerateKey for the details. +func generatePublicKey() *Key { + k := GenerateKey() + k.private = nil + return k +} + +func (k *Key) MarshalJSON() ([]byte, error) { + var buf bytes.Buffer + w, err := armor.Encode(&buf, openpgp.PublicKeyType, nil) + if err != nil { + return nil, err + } + err = k.public.Serialize(w) + if err != nil { + return nil, err + } + err = w.Close() + if err != nil { + return nil, err + } + return json.Marshal(buf.String()) +} + +func (k *Key) UnmarshalJSON(data []byte) error { + var armored string + err := json.Unmarshal(data, &armored) + if err != nil { + return err + } + + block, err := armor.Decode(strings.NewReader(armored)) + if err == io.EOF { + return fmt.Errorf("no armored data found") + } + if err != nil { + return err + } + + if block.Type != openpgp.PublicKeyType { + return fmt.Errorf("invalid key type") + } + + reader := packet.NewReader(block.Body) + p, err := reader.Next() + if err != nil { + return errors.Wrap(err, "failed to read public key packet") + } + + public, ok := p.(*packet.PublicKey) + if !ok { + return errors.New("got no packet.publicKey") + } + + // The armored format doesn't include the creation time, which makes the round-trip data not being fully equal. + // We don't care about the creation time so we can set it to the zero value. + public.CreationTime = time.Time{} + + k.public = public + return nil } func (k *Key) Validate() error { - // Todo + if k.public == nil { + return fmt.Errorf("nil public key") + } + if !k.public.CanSign() { + return fmt.Errorf("public key can't sign") + } + + if k.private != nil { + if !k.private.CanSign() { + return fmt.Errorf("private key can't sign") + } + } return nil } func (k *Key) Clone() *Key { - clone := *k - return &clone + clone := &Key{} + + pub := *k.public + clone.public = &pub + + if k.private != nil { + priv := *k.private + clone.private = &priv + } + + return clone +} + +func (k *Key) EnsurePrivateKey(repo repository.RepoKeyring) error { + if k.private != nil { + return nil + } + + // item, err := repo.Keyring().Get(k.Fingerprint()) + // if err != nil { + // return fmt.Errorf("no private key found for %s", k.Fingerprint()) + // } + // + + panic("TODO") +} + +func (k *Key) Fingerprint() string { + return string(k.public.Fingerprint[:]) +} + +func (k *Key) PGPEntity() *openpgp.Entity { + return &openpgp.Entity{ + PrimaryKey: k.public, + PrivateKey: k.private, + } +} + +var _ openpgp.KeyRing = &PGPKeyring{} + +// PGPKeyring implement a openpgp.KeyRing from an slice of Key +type PGPKeyring []*Key + +func (pk PGPKeyring) KeysById(id uint64) []openpgp.Key { + var result []openpgp.Key + for _, key := range pk { + if key.public.KeyId == id { + result = append(result, openpgp.Key{ + PublicKey: key.public, + PrivateKey: key.private, + }) + } + } + return result +} + +func (pk PGPKeyring) KeysByIdUsage(id uint64, requiredUsage byte) []openpgp.Key { + // the only usage we care about is the ability to sign, which all keys should already be capable of + return pk.KeysById(id) +} + +func (pk PGPKeyring) DecryptionKeys() []openpgp.Key { + result := make([]openpgp.Key, len(pk)) + for i, key := range pk { + result[i] = openpgp.Key{ + PublicKey: key.public, + PrivateKey: key.private, + } + } + return result } -- cgit From dc5059bc3372941e2908739831188768335ac50b Mon Sep 17 00:00:00 2001 From: Michael Muré Date: Sun, 24 Jan 2021 19:45:21 +0100 Subject: entity: more progress on merging and signing --- identity/key.go | 163 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 97 insertions(+), 66 deletions(-) (limited to 'identity/key.go') diff --git a/identity/key.go b/identity/key.go index 8dd5e8c1..daa66b0e 100644 --- a/identity/key.go +++ b/identity/key.go @@ -16,12 +16,15 @@ import ( "github.com/MichaelMure/git-bug/repository" ) +var errNoPrivateKey = fmt.Errorf("no private key") + type Key struct { public *packet.PublicKey private *packet.PrivateKey } // GenerateKey generate a keypair (public+private) +// The type and configuration of the key is determined by the default value in go's OpenPGP. func GenerateKey() *Key { entity, err := openpgp.NewEntity("", "", "", &packet.Config{ // The armored format doesn't include the creation time, which makes the round-trip data not being fully equal. @@ -47,12 +50,53 @@ func generatePublicKey() *Key { return k } +func (k *Key) Public() *packet.PublicKey { + return k.public +} + +func (k *Key) Private() *packet.PrivateKey { + return k.private +} + +func (k *Key) Validate() error { + if k.public == nil { + return fmt.Errorf("nil public key") + } + if !k.public.CanSign() { + return fmt.Errorf("public key can't sign") + } + + if k.private != nil { + if !k.private.CanSign() { + return fmt.Errorf("private key can't sign") + } + } + + return nil +} + +func (k *Key) Clone() *Key { + clone := &Key{} + + pub := *k.public + clone.public = &pub + + if k.private != nil { + priv := *k.private + clone.private = &priv + } + + return clone +} + func (k *Key) MarshalJSON() ([]byte, error) { + // Serialize only the public key, in the armored format. var buf bytes.Buffer w, err := armor.Encode(&buf, openpgp.PublicKeyType, nil) if err != nil { return nil, err } + err = k.public.Serialize(w) if err != nil { return nil, err @@ -65,6 +109,7 @@ func (k *Key) MarshalJSON() ([]byte, error) { } func (k *Key) UnmarshalJSON(data []byte) error { + // De-serialize only the public key, in the armored format. var armored string err := json.Unmarshal(data, &armored) if err != nil { @@ -83,8 +128,7 @@ func (k *Key) UnmarshalJSON(data []byte) error { return fmt.Errorf("invalid key type") } - reader := packet.NewReader(block.Body) - p, err := reader.Next() + p, err := packet.Read(block.Body) if err != nil { return errors.Wrap(err, "failed to read public key packet") } @@ -102,53 +146,74 @@ func (k *Key) UnmarshalJSON(data []byte) error { return nil } -func (k *Key) Validate() error { - if k.public == nil { - return fmt.Errorf("nil public key") +func (k *Key) loadPrivate(repo repository.RepoKeyring) error { + item, err := repo.Keyring().Get(k.public.KeyIdString()) + if err == repository.ErrKeyringKeyNotFound { + return errNoPrivateKey } - if !k.public.CanSign() { - return fmt.Errorf("public key can't sign") + if err != nil { + return err } - if k.private != nil { - if !k.private.CanSign() { - return fmt.Errorf("private key can't sign") - } + block, err := armor.Decode(bytes.NewReader(item.Data)) + if err == io.EOF { + return fmt.Errorf("no armored data found") + } + if err != nil { + return err } - return nil -} - -func (k *Key) Clone() *Key { - clone := &Key{} + if block.Type != openpgp.PrivateKeyType { + return fmt.Errorf("invalid key type") + } - pub := *k.public - clone.public = &pub + p, err := packet.Read(block.Body) + if err != nil { + return errors.Wrap(err, "failed to read private key packet") + } - if k.private != nil { - priv := *k.private - clone.private = &priv + private, ok := p.(*packet.PrivateKey) + if !ok { + return errors.New("got no packet.privateKey") } - return clone + // The armored format doesn't include the creation time, which makes the round-trip data not being fully equal. + // We don't care about the creation time so we can set it to the zero value. + private.CreationTime = time.Time{} + + k.private = private + return nil } -func (k *Key) EnsurePrivateKey(repo repository.RepoKeyring) error { +// ensurePrivateKey attempt to load the corresponding private key if it is not loaded already. +// If no private key is found, returns errNoPrivateKey +func (k *Key) ensurePrivateKey(repo repository.RepoKeyring) error { if k.private != nil { return nil } - // item, err := repo.Keyring().Get(k.Fingerprint()) - // if err != nil { - // return fmt.Errorf("no private key found for %s", k.Fingerprint()) - // } - // - - panic("TODO") + return k.loadPrivate(repo) } -func (k *Key) Fingerprint() string { - return string(k.public.Fingerprint[:]) +func (k *Key) storePrivate(repo repository.RepoKeyring) error { + var buf bytes.Buffer + w, err := armor.Encode(&buf, openpgp.PrivateKeyType, nil) + if err != nil { + return err + } + err = k.private.Serialize(w) + if err != nil { + return err + } + err = w.Close() + if err != nil { + return err + } + + return repo.Keyring().Set(repository.Item{ + Key: k.public.KeyIdString(), + Data: buf.Bytes(), + }) } func (k *Key) PGPEntity() *openpgp.Entity { @@ -157,37 +222,3 @@ func (k *Key) PGPEntity() *openpgp.Entity { PrivateKey: k.private, } } - -var _ openpgp.KeyRing = &PGPKeyring{} - -// PGPKeyring implement a openpgp.KeyRing from an slice of Key -type PGPKeyring []*Key - -func (pk PGPKeyring) KeysById(id uint64) []openpgp.Key { - var result []openpgp.Key - for _, key := range pk { - if key.public.KeyId == id { - result = append(result, openpgp.Key{ - PublicKey: key.public, - PrivateKey: key.private, - }) - } - } - return result -} - -func (pk PGPKeyring) KeysByIdUsage(id uint64, requiredUsage byte) []openpgp.Key { - // the only usage we care about is the ability to sign, which all keys should already be capable of - return pk.KeysById(id) -} - -func (pk PGPKeyring) DecryptionKeys() []openpgp.Key { - result := make([]openpgp.Key, len(pk)) - for i, key := range pk { - result[i] = openpgp.Key{ - PublicKey: key.public, - PrivateKey: key.private, - } - } - return result -} -- cgit