Commit Graph

1427 Commits

Author SHA1 Message Date
Maxim Slipenko
31cb7ce148 1.0.0-alt2
- Fix build
2024-12-20 11:01:00 +03:00
Maxim Slipenko
5233b9f8e0 change llvm-devel to clang-devel 2024-12-20 10:54:10 +03:00
Maxim Slipenko
e8b114f048 1.0.0-alt1
- Initial build
2024-12-20 09:53:14 +03:00
Justus Winter
7c7837140a
Release 1.0.0. 2024-12-16 18:23:22 +01:00
Justus Winter
382dce428c
Fix NEWS.
- There was no 0.41.0 release.
2024-12-16 15:45:25 +01:00
Justus Winter
792bf62aec
Align sq download with sq verify. 2024-12-16 15:20:05 +01:00
Justus Winter
58a88499ea
Fix displaying preferred user IDs.
- During the refactoring, some `PreferredUserID`s were displayed
    using the debug formatting.  To prevent that, take away the impl
    fmt::Debug, and adjust the format strings.

  - Fixes 367e71722f.
2024-12-16 14:49:11 +01:00
Justus Winter
c528091a88
Write to temporary file first, then persist it under the final name.
- This has two benefits.  First, consumers only see the file once we
    are done writing to it, i.e. they don't see a partial file.

  - Second, we guarantee not to overwrite the file until the operation
    is finished.  Therefore, it is safe to use the same file as input
    and output.

  - Fixes #500.
2024-12-16 14:42:10 +01:00
Justus Winter
34094c21b3
Avoid using absolute paths in name of scratch files.
- On Windows, this resulted in

    --output C:\Users\ContainerAdministrator\AppData\Local\Temp\.tmpKCd1ce\home\scratch\8-certification-1A471885A19D2FD3BE3E81965F010FF9DDC89058--bob-example-org--by-C--Users-ContainerAdministrator-AppData-Local-Temp--tmpKCd1ce-home-scratch-0--alice-example-org--cert

    causing problems with file name lengths or path lengths.
2024-12-16 14:42:09 +01:00
Justus Winter
32e2d7743f
Automatically import certificates from GnuPG's certificate store.
- This improves first impressions, as we'll present the same set of
    certificates that GnuPG knows, and also import the owner's
    certificates that are required to transparently use the keys using
    gpg-agent.

  - We keep it simple: we only do this for the default Sequoia and
    GnuPG state directories.  Further, We don't parse the GnuPG
    configuration file, we just scan GnuPG's default cert stores.

  - Fixes #489.
2024-12-16 14:30:15 +01:00
Justus Winter
367e71722f
Escape user IDs.
- This is attacker controlled data which must be sanitizied.
2024-12-16 14:03:16 +01:00
Justus Winter
676ed78656
Escape preferred keyserver and policy URI.
- This is attacker controlled data which must be sanitizied.
2024-12-16 14:03:16 +01:00
Justus Winter
b29ed59b3b
Escape notation name and data.
- This is attacker controlled data which must be sanitizied.
2024-12-16 14:03:16 +01:00
Justus Winter
b798194808
Escape literal data file name and data prefix.
- This is attacker controlled data which must be sanitizied.
2024-12-16 14:03:16 +01:00
Justus Winter
9b1d122789
Escape all regular expressions.
- This is attacker controlled data which must be sanitizied.
2024-12-16 14:03:16 +01:00
Justus Winter
3692280101
Escape all reason for revocation messages.
- This is attacker controlled data which must be sanitizied.
2024-12-16 14:03:16 +01:00
Justus Winter
13aa81300a
Improve output sanitization. 2024-12-16 14:03:16 +01:00
Justus Winter
535ff24f8a
Use the visual idiom for cert,userid pairs authenticating downloads.
- See #486.
2024-12-16 13:09:56 +01:00
Justus Winter
3f3c32eabb
Use the visual idiom for cert, userid pairs when decrypting.
- See #486.
2024-12-16 13:09:56 +01:00
Justus Winter
f2f09fbc51
Use the visual idiom for cert, userid pairs when importing revs.
- See #486.
2024-12-16 13:09:56 +01:00
Justus Winter
93851b524a
Use the visual idiom for cert, userid pairs when certifying.
- See #486.
2024-12-16 13:09:56 +01:00
Justus Winter
cfc086b5bd
Improve argument and value formatting in hints. 2024-12-16 13:09:56 +01:00
Neal H. Walfield
ef85a4c2db
Improve help output.
- Improve the help output for `sq pki authenticate`, `sq pki
    lookup`, and `sq pki path`.
2024-12-16 12:28:40 +01:00
Neal H. Walfield
12a47e2121
Revert "Refine sq pki {authenticate,lookup}'s user ID designators."
- This reverts commit cc8657f535.

  - The old semantics were better.
2024-12-16 10:17:12 +01:00
Neal H. Walfield
a007a80269
Fix commands embedded in the documentation. 2024-12-15 16:34:43 +01:00
Justus Winter
2f381829f8
Make verifying detached signatures more efficient.
- Now that we depend on sequoia-openpgp 1.22, we can make use of the
    more efficient DetachedVerifier::verify_buffered_reader.
2024-12-15 12:11:04 +01:00
Justus Winter
65b210395f
Require sequoia-openpgp 1.22.
- Fixes c60a2d33fb which changed the
    test to assume the fixed behavior in sequoia-openpgp without
    requiring the new version.

  - Fixes #504.
2024-12-15 11:55:02 +01:00
Neal H. Walfield
3787e0bbca
Fix hint. 2024-12-15 02:39:33 +01:00
Neal H. Walfield
18800cbfcf
Refine sq key userid revoke's user ID designators.
- Change the semantics of `sq key userid revoke --email` to use a
    user ID with just the specified email address, if the email
    address is part of a self-signed user ID.  That is, use the
    `Exact` semantics instead of the `By` semantics.  For example, if
    a certificate has the self-signed user ID "Alice
    <alice@example.org>", then `--email alice@example.org` would have
    selected "Alice <alice@example.org>" for revocation, but now it
    selects "<alice@example.org>".

  - Add `sq key userid revoke --userid-by-email`, which uses the
    self-signed user ID with the specified email address.  For
    example, if a certificate has the self-signed user ID "Alice
    <alice@example.org>", then `--userid-by-email alice@example.org`
    selects "Alice <alice@example.org>" for revocation.

  - Fixes #212.
2024-12-15 02:36:01 +01:00
Neal H. Walfield
d756753950
Refine sq pki vouch {add,authorize}'s user ID designators.
- Change the semantics of `sq pki vouch add --email` and `sq pki
    vouch authorize --email` to use a user ID with just the specified
    email address, if the email address is part of a self-signed user
    ID.  That is, use the `Exact` semantics instead of the `By`
    semantics.  For example, if a certificate has the self-signed user
    ID "Alice <alice@example.org>", then `--email alice@example.org`
    would have selected "Alice <alice@example.org>" for certification,
    but now it selects "<alice@example.org>".

  - Add `sq pki vouch add --userid-by-email`, and `sq pki vouch
    authorize --userid-by-email`, which use the self-signed user ID
    with the specified email address.  For example, if a certificate
    has the self-signed user ID "Alice <alice@example.org>", then
    `--userid-by-email alice@example.org` selects "Alice
    <alice@example.org>" for certification.

  - Fixes #212.
2024-12-15 02:31:21 +01:00
Neal H. Walfield
cc8657f535
Refine sq pki {authenticate,lookup}'s user ID designators.
- Change the semantics of `sq pki authenticate --email` and `sq pki
    lookup --email` to use a user ID with just the specified email
    address.  That is, use the `Exact` semantics instead of the `By`
    semantics.  For example, if a certificate has the user ID "Alice
    <alice@example.org>", then `--email alice@example.org` does not
    select it.

  - Add `sq pki authenticate --userid-by-email`, and `sq pki lookup
    --userid-by-email`, which match user IDs with the specified email
    address.  For example, if a certificate has the user ID "Alice
    <alice@example.org>", then `--userid-by-email alice@example.org`
    selects it.

  - Fixes #212.
2024-12-15 02:31:08 +01:00
Neal H. Walfield
67f8bd2876
Refine sq pki link retract's user ID designators.
- Add `sq pki link retract --userid-by-email`, which selects a
     self-signed user ID with the specified email address.
2024-12-15 01:32:34 +01:00
Neal H. Walfield
18b5cbda4d
Refine sq pki link {add,authorize}'s user ID designators.
- Change the semantics of `sq pki link add --email` and `sq pki
    link authorize --email` to use a user ID with just the specified
    email address, if the email address is part of a self-signed user
    ID.  That is, use the `Exact` semantics instead of the `By`
    semantics.  For example, if a certificate has the self-signed user
    ID "Alice <alice@example.org>", then `--email alice@example.org`
    would have selected "Alice <alice@example.org>" to link, but now
    it selects "<alice@example.org>".

  - Add `sq pki link add --userid-by-email`, and `sq pki link
    authorize --userid-by-email`, which use the self-signed user ID
    with the specified email address.  For example, if a certificate
    has the self-signed user ID "Alice <alice@example.org>", then
    `--userid-by-email alice@example.org` selects "Alice
    <alice@example.org>" to link.

  - Fixes #212.
2024-12-15 01:32:33 +01:00
Neal H. Walfield
4155dcc22d
Add sq pki path --userid-by-email.
- Add `sq pki path --userid-by-email`, which selects the self-signed
    user ID with the specified email address.  This is different from
    `--email`, which simply uses the argument's value as a user ID.

  - Fixes #212.
2024-12-15 01:32:33 +01:00
Justus Winter
b85dc35f5d
Gracefully handle unencrypted Autocrypt messages.
- Only show the warnings in verbose mode, and turn the error into a
    warning.

  - Fixes #503.
2024-12-14 19:12:19 +01:00
Justus Winter
b5ca6e27fe
Align output emitted when importing certificates.
- See #503.
2024-12-14 19:06:53 +01:00
Justus Winter
81037e50d4
Don't unconditionally show provenance messages. 2024-12-14 19:01:57 +01:00
Justus Winter
16b0f1ec85
Fix importing unencrypted Autocrypt messages. 2024-12-14 18:39:41 +01:00
Justus Winter
90cb8d4ef2
Improve error handling opening the cert store.
- Improvements similar to the one in the previous commit.

  - See #492.
2024-12-14 17:09:49 +01:00
Julian Andres Klode
5adb325f88
Do not hide errors from keyrings in verify.
- Fixes #492.

Signed-off-by: Julian Andres Klode <jak@debian.org>
2024-12-14 16:12:15 +01:00
franzi
f1c30786d7
Refactor packet and keyring files in /cli to new example framework.
- No content changes.
2024-12-14 13:18:44 +01:00
franzi
aba6fb6104
Refactor files in /cli/network to new example framework.
- No content changes.
2024-12-14 13:05:40 +01:00
franzi
2b53605dd7
Refactor files in /cli/pki to new example framework.
- No content changes.
2024-12-14 12:53:14 +01:00
franzi
b5b211fb9b
Refactor files in /cli to new example framework.
- no content changes
2024-12-14 12:29:49 +01:00
Justus Winter
69e21afd60
Remove the unstable CLI warning. 2024-12-14 12:21:04 +01:00
Neal H. Walfield
68e355690b
Don't make impossible recommendations.
- Only recommend that they user try `--add-userid` if the command
    actually supports it.
2024-12-14 00:00:47 +01:00
Neal H. Walfield
201ce8f874
Remove useless code.
- There is no need for `--all` to require itself.  Drop it.
2024-12-14 00:00:47 +01:00
Neal H. Walfield
9b434cd888
Disable the --name and --add-name arguments.
- Disable the `--name` argument from `sq key approvals list`, `sq
    key approvals update`, `sq key userid revoke` and `sq pki path`,
    and disable the `--add-name` argument from `sq key userid
    revoke`.

  - These arguments are of uncertain value.  Disable them until there
    is clear demand.

  - Fixes #487.
2024-12-14 00:00:46 +01:00
Neal H. Walfield
8ccb13db20
Rename --userid-or-add to --add-userid, etc.
- Rename `--userid-or-add`, `--email-or-add`, and `--name-or-add`
    respectively to `--add-userid`, `--add-email`, and `--add-name`.

  - These names more closely match their new semantics: they don't
    first try and match a self-signed user ID, but just use a user ID
    consisting of the argument's value.
2024-12-14 00:00:46 +01:00
Neal H. Walfield
c0ef0f5dbd
Extend and adjust the set of user ID designators.
- Rename the `Exact` designator semantics to `By`.  By default, the
    `By` arguments are called `--userid`, `--userid-by-email`, and
    `--userid-by-name`.

  - Add a new set of designators called `Exact` for the arguments
    `--userid`, `--email`, and `--name`.  The semantics of `Exact`
    are: the value must match a self-signed user ID, however, the
    returned user ID is just the value, not the matching self-signed
    user ID.  That is, if there is a self-signed user ID `Alice
    <alice@example.org>`, `--email alice@example.org` matches and
    returns the user ID `<alice@example.org>`, and `--name Alice`
    returns the user ID `Alice`.

  - Change the semantics of `Add` user ID designators (by default,
    `--userid-or-add`, `--email-or-add`, and `--name-or-add`) so that
    they just return a user ID with just the specified value.  That is
    `--email alice@example.org` returns the user ID
    `<alice@example.org>`.

  - The following commands use user ID designators and their semantics
    are unchanged:

    - `sq key approvals list`: Unchanged.
    - `sq key approvals update`: Unchanged.
    - `sq pki authenticate`: Unchanged.
    - `sq pki lookup`: Unchanged.
    - `sq pki path`: Unchanged.

  - The following commands use user ID designators and their semantics
    changed as follows:

    - `sq pki link add`: `--email-or-add` had the old `Add` semantics
      and now has the new `Add` semantics.

    - `sq pki link authorize`: `--email-or-add` had the old `Add`
      semantics and now has the new `Add` semantics.

    - `sq pki link retract`: `--email` had the old `Add` semantics and
      now has the new `Add` semantics.

    - `sq key userid revoke`: `--email-or-add` had the old `Add` semantics and
      now has the new `Add` semantics.

    - `sq key vouch add`: `--email-or-add` had the old `Add` semantics and
      now has the new `Add` semantics.

    - `sq key vouch authorize --email-or-add` had the old `Add`
      semantics and now has the new `Add` semantics.
2024-12-13 22:53:00 +01:00