hopenpgp-tools 0.26 → 0.26.1
raw patch · 2 files changed
+37/−20 lines, 2 filesdep ~aeson
Dependency ranges changed: aeson
Files
- hop.hs +35/−18
- hopenpgp-tools.cabal +2/−2
hop.hs view
@@ -337,6 +337,7 @@ import qualified Crypto.PubKey.RSA.PKCS15 as P15 import Crypto.Random.Types (getRandomBytes) import qualified Data.Aeson as A+import qualified Data.Aeson.Key as AK import Data.Bifunctor (first) import qualified Data.Binary as Bin import Data.Binary.Get (runGet)@@ -4625,7 +4626,7 @@ doVerify :: POSIXTime -> VerifyOptions -> IO () doVerify cpt VerifyOptions {..} = do- (krs, verifyTks) <- loadVerifyContext cpt verifyCertFiles+ (krs, certTkPairs) <- loadVerifyContext cpt verifyCertFiles signatureInput <- loadInputFromFile "verify" "signature file" verifySigFile sigPkts <- decodeLikeSignaturePackets signatureInput@@ -4657,7 +4658,7 @@ let decodedVerifications = map (first show) verifications signerPolicyAdjusted = map- (enforceVerificationSignerPolicy cpt verifyTks)+ (enforceVerificationSignerPolicy cpt (concatMap snd certTkPairs)) decodedVerifications let filtered = filterByVerificationBounds@@ -4667,7 +4668,7 @@ policyFiltered = filter (not . verificationResultUsesDeprecatedHash) filtered mapM_- (putStrLn . renderSOPVerificationLine verifyTks)+ (putStrLn . renderSOPVerificationLine certTkPairs) (rights policyFiltered) case any isRight policyFiltered of True -> exitSuccess@@ -4897,7 +4898,7 @@ doInlineVerify :: POSIXTime -> InlineVerifyOptions -> IO () doInlineVerify cpt InlineVerifyOptions {..} = do- (krs, verifyTks) <- loadVerifyContext cpt inlineCertFiles+ (krs, certTkPairs) <- loadVerifyContext cpt inlineCertFiles signedInput <- runConduitRes $ CB.sourceHandle stdin .| CC.sinkLazy upperBound <- verificationUpperBound cpt inlineNotAfter@@ -4911,7 +4912,7 @@ let verifications = map (first show) (verifyPacketsBatch krs upperBound packets) filtered = filterByVerificationBounds lowerBound upperBound verifications- successLines = map (renderSOPVerificationLine verifyTks) (rights filtered)+ successLines = map (renderSOPVerificationLine certTkPairs) (rights filtered) renderedOut = if null successLines then ""@@ -6092,7 +6093,7 @@ failWith IncompleteVerification "decrypt: verification requires at least one --verify-with cert"- (krs, verifyTks) <- loadVerifyContext cpt certFiles+ (krs, certTkPairs) <- loadVerifyContext cpt certFiles upperBound <- verificationUpperBound cpt notAfterArg lowerBound <- verificationLowerBound cpt notBeforeArg verificationPkts <-@@ -6103,7 +6104,7 @@ (verifyPacketsBatch krs upperBound verificationPkts) filtered = filterByVerificationBounds lowerBound upperBound verifications successLines =- map (renderSOPVerificationLine verifyTks) (rights filtered)+ map (renderSOPVerificationLine certTkPairs) (rights filtered) renderedOut = if null successLines then ""@@ -6129,8 +6130,8 @@ "decrypt failed: malformed signed message structure (multiple literal payloads)" renderSOPVerificationLine- :: [SomeTK] -> Verification -> String-renderSOPVerificationLine verifyTks v =+ :: [(String, [SomeTK])] -> Verification -> String+renderSOPVerificationLine certTkPairs v = ts ++ " " ++ signerFp@@ -6147,7 +6148,7 @@ signerFp = hexEncodeBytes (unFingerprint signer) modeLabel = signatureModeField sig certFp =- case find (\tk -> keyMatchesFingerprint True tk signer) verifyTks of+ case find (\tk -> keyMatchesFingerprint True tk signer) (concatMap snd certTkPairs) of Just tk -> hexEncodeBytes ( ( unFingerprint@@ -6157,7 +6158,17 @@ ) ) Nothing -> signerFp- jsonTrailer = "{\"signers\":[{\"fingerprint\":\"" ++ signerFp ++ "\"}]}"+ signerNames =+ [ certName+ | (certName, tks) <- certTkPairs+ , any (\tk -> keyMatchesFingerprint True tk signer) tks+ ]+ jsonTrailer = BLC8.unpack+ ( A.encode+ ( A.object+ [ AK.fromString "signers" A..= signerNames ]+ )+ ) signatureModeField :: SignaturePayload -> String signatureModeField sig =@@ -6418,13 +6429,19 @@ Nothing -> pure path loadVerifyContext- :: POSIXTime -> [String] -> IO (PublicKeyring, [SomeTK])+ :: POSIXTime -> [String] -> IO (PublicKeyring, [(String, [SomeTK])]) loadVerifyContext _ certFiles = do- allTks <-- mapMaybe enforceVerifyPrimaryKeyPolicy- . map sanitizeVerifyTK- . concat- <$> mapM (loadCertTKsFromFile "verify") certFiles+ certTkPairs <-+ mapM+ ( \certFile -> do+ tks <-+ mapMaybe enforceVerifyPrimaryKeyPolicy+ . map sanitizeVerifyTK+ <$> loadCertTKsFromFile "verify" certFile+ pure (certFile, tks)+ )+ certFiles+ let allTks = concatMap snd certTkPairs let publicTks = mapMaybe ( \tk ->@@ -6435,7 +6452,7 @@ allTks keyring <- runConduitRes $ CL.sourceList publicTks .| sinkPublicKeyringMap- pure (keyring, allTks)+ pure (keyring, certTkPairs) loadVerifyTKsFromFile :: String -> String -> IO [SomeTK] loadVerifyTKsFromFile context path = do
hopenpgp-tools.cabal view
@@ -1,6 +1,6 @@ cabal-version: 3.0 name: hopenpgp-tools-version: 0.26+version: 0.26.1 synopsis: hOpenPGP-based command-line tools description: command-line tools for performing some OpenPGP-related operations homepage: https://salsa.debian.org/clint/hOpenPGP-tools@@ -19,7 +19,7 @@ common deps autogen-modules: Paths_hopenpgp_tools build-depends: base >= 4.15 && < 5- , aeson+ , aeson >= 2 && < 3 , binary >= 0.6.4 , binary-conduit , bytestring