Age | Commit message (Collapse) | Author |
|
- If OpenSSL is built with the `OPENSSL_NO_OCB` directive it will
not have OCB.
- Stop advertising OCB as supported in that case.
- Use GCM as the default algorithm if OCB is not available.
- Tested by appending `println!("cargo:rustc-cfg=osslconf=\"{}\"",
"OPENSSL_NO_OCB");` to build.rs.
- See https://github.com/sfackler/rust-openssl/pull/1952
|
|
|
|
zbase32 is distributed under LGPL-3+ which is incompatible with some projects.
Use the MIT licensed implementation z-base-32 instead.
Signed-off-by: Dylan Aïssi <dylan.aissi@collabora.com>
|
|
- The Galois/Counter mode for block ciphers is a FIPS-approved AEAD
mode. It will be added to the upcoming OpenPGP standard so that
we have a FIPS-compliant subset of OpenPGP.
|
|
- Nettle 3.9 and up support the authenticated encryption mode OCB.
|
|
* Notable fixes
- A parser bug was fixed. We classify this as a low-severity
issue, because Rust correctly detects the out-of-bounds access
and panics. If an attacker controls the input, they may be able
to use this bug to cause a denial of service.
|
|
* Changes in 1.2.0
** Notable changes
- BufferedReader::copy is like std::io::copy, but more efficient.
* Notable fixes
- A parser bug was fixed. We classify this as a low-severity
issue, because Rust correctly detects the out-of-bounds access
and panics. If an attacker controls the input, they may be able
to use this bug to cause a denial of service.
|
|
|
|
|
|
- Upgrade base64 to version 0.21.
|
|
- Upgrade base64 to version 0.21.
|
|
- Upgrade base64 to version 0.21.
|
|
|
|
- It's not used.
|
|
|
|
|
|
- Note: `x25519-dalek` is broken. It depends on zeroize `=1.3`, but
crates like rsa depend on newer versions of zeroize.
- See https://github.com/WebAssembly/wasi-crypto/issues/63 ,
https://github.com/dalek-cryptography/x25519-dalek/issues/92 .
- Resolve this by using `x25519-dalek-ng`, which fixes this issue.
This is a common workaround, and is also used by, for instance
OpenMLS:
https://github.com/openmls/openmls/blob/3ff090fd4881cb796d4688f7f174929a7521dbf1/openmls_rust_crypto/README.md?plain=1#L3
- Fixes #910.
|
|
- Fixes #1014
|
|
- Also bump syn so that we can get bindgen 0.63.
- This fixes a build error that we have seen on mingw builds:
https://gitlab.com/sequoia-pgp/sequoia/-/jobs/4122192520
|
|
|
|
|
|
|
|
- Fixes #645.
|
|
- OpenSSL can be compiled with no support for CAST5.
- This will be indicated by setting `osslconf` variable to
`OPENSSL_NO_CAST`.
- See https://github.com/sfackler/rust-openssl/pull/1786
|
|
- Notably, this zeros symmetric encryption keys in memory once we're
done encrypting or decrypting.
|
|
|
|
|
|
- From now on, development will take place in its own repository at
https://gitlab.com/sequoia-pgp/sequoia-sq. The first commit there
is b89c172c1d6a2a78b4b4807ce6c4af14d418f0a6.
|
|
- This is the last release of the sq frontend from this repository.
Development will continue here:
https://gitlab.com/sequoia-pgp/sequoia-sq
|
|
- Also bump chrono to 0.4.23 so that we can use
DateTime::date_naive.
- The bump was necessary because cargo publish will use the newest
version as opposed to the one recorded in Cargo.lock. The locked
version neither has DateTime::date_naive, nor does it deprecate
the old interface.
|
|
|
|
|
|
|
|
|
|
|
|
- See if we are executing under a tokio async runtime, and if so,
start a new one on a different thread.
- This works around a design problem with the
openpgp::crypto::{Signer, Decryptor} traits that use sync functions,
but our implementation of the traits is async. We used to
unconditionally start a tokio runtime and block to hide the async
nature of the implementation, but that leads to panics if the
current thread is already managed by a tokio runtime. This is a
really easy mistake to make, and is not detected by the type
system.
|
|
|
|
|
|
- If the environment variable `SEQUOIA_BUFFERED_READER_BUFFER` is
set, and we are able to parse it as a usize, use it as the default
buffer size.
|
|
|
|
- Adds the backend behind `crypto-openssl` feature.
- Add CI configuration to run tests with the new backend.
- See #333.
|
|
|
|
|
|
|
|
- rpassword underwent some rework. The successor of
read_password_from_tty seems to be prompt_password, relevant commits
to rpassword:
- e6023757df00a67a1e16796db50c5ffad41b6268
- 2edf6cee07573ec4aa86531e6177ee90331d5c60
|
|
Generate an all-in-one manual page sq.1, and a separate manual page
for each leaf level subcommand: sq-armor.1, seq-key-generate.1, etc.
We've previously had a grouping of subcommands per top level
subcommand: all sub-subcommands of "sq key" would go into sq-key.1.
However, I found that to be hard to follow, as a reader. I prefer
either all in one, or just the one subcommand in a page.
Use custom code to generate the manual page, in sq/src/man.rs, because
I wasn't happy with clap_mangen output, and wanted something more
idiomatic. The custom code is a little specific for sq, and may or may
not be possible to use for other programs.
To trigger manual page generation, run sq with SQ_MAN set to the name
of a directory where the manual pages should be written, when running
sq. This was an easier way to do this than a new, hidden
subcommand ("sq generate-man" or something like that).
Add the roff crate as a dependency. It's used to generate troff source
code for manual pages. Generating correct troff is tricky enough that
there's no point in doing it manually.
Move the "SEE ALSO" section in the "after_help" text for "sq verify"
into the "before_help" so that it doesn't end up as plain text in the
manual page. This was an easier change than making the "sq help text
markup" parser in sq/src/man.rs understand the SEE ALSO heading.
Sponsored-by: pep.foundation
|
|
Update the dependency on Subplot to 0.5.0.
Subplot 0.5.0 requires document metadata (title, bindings files, etc)
to be in its own YAML file, where previous versions required it to be
embedded in Markdown (still as YAML). Move the metadata to sq.subplot
and fix what breaks.
Sponsored-by: pep.foundation
|
|
- Add dane::get.
- Make EmailAddress functions pub(crate) to use them from the DANE
module.
- Add tests for generating correct FQDN.
- See #865.
|
|
This will let `sq` not depend on `clap` version 2, even transitively.
Sponsored-by: pep.foundation
|
|
|