Merge pull request str4d#544 from str4d/pre-release-changes

Pre-release changes

Author: str4d

Cargo.lock

@@ -48,8 +48,8 @@ cookie-factory = "0.3.1"
 nom = { version = "7", default-features = false, features = ["alloc"] }
 
 # Secret management
-pinentry = "0.5"
-secrecy = "0.8"
+pinentry = "0.6"
+secrecy = "0.10"
 subtle = "2"
 zeroize = "1"
 

Cargo.toml

@@ -8,9 +8,14 @@ to 1.0.0 are beta releases.
 
 ## [Unreleased]
 ### Added
-- `age_core::format::is_arbitrary_string`
+- `age_core::format`:
+  - `FileKey::new`
+  - `FileKey::init_with_mut`
+  - `FileKey::try_init_with_mut`
+  - `is_arbitrary_string`
 
 ### Changed
+- Migrated to `secrecy 0.10`.
 - `age::plugin::Connection::unidir_receive` now takes an additional argument to
   enable handling an optional fourth command.
 

age-core/CHANGELOG.md

@@ -5,7 +5,7 @@ use rand::{
     distributions::{Distribution, Uniform},
     thread_rng, RngCore,
 };
-use secrecy::{ExposeSecret, Secret};
+use secrecy::{ExposeSecret, ExposeSecretMut, SecretBox};
 
 /// The prefix identifying an age stanza.
 const STANZA_TAG: &str = "-> ";
@@ -14,11 +14,26 @@ const STANZA_TAG: &str = "-> ";
 pub const FILE_KEY_BYTES: usize = 16;
 
 /// A file key for encrypting or decrypting an age file.
-pub struct FileKey(Secret<[u8; FILE_KEY_BYTES]>);
+pub struct FileKey(SecretBox<[u8; FILE_KEY_BYTES]>);
 
-impl From<[u8; FILE_KEY_BYTES]> for FileKey {
-    fn from(file_key: [u8; FILE_KEY_BYTES]) -> Self {
-        FileKey(Secret::new(file_key))
+impl FileKey {
+    /// Creates a file key using a pre-boxed key.
+    pub fn new(file_key: Box<[u8; FILE_KEY_BYTES]>) -> Self {
+        Self(SecretBox::new(file_key))
+    }
+
+    /// Creates a file key using a function that can initialize the key in-place.
+    pub fn init_with_mut(ctr: impl FnOnce(&mut [u8; FILE_KEY_BYTES])) -> Self {
+        Self(SecretBox::init_with_mut(ctr))
+    }
+
+    /// Same as [`Self::init_with_mut`], but the constructor can be fallible.
+    pub fn try_init_with_mut<E>(
+        ctr: impl FnOnce(&mut [u8; FILE_KEY_BYTES]) -> Result<(), E>,
+    ) -> Result<Self, E> {
+        let mut file_key = SecretBox::new(Box::new([0; FILE_KEY_BYTES]));
+        ctr(file_key.expose_secret_mut())?;
+        Ok(Self(file_key))
     }
 }
 

age-core/src/format.rs

@@ -4,7 +4,7 @@
 //! implementations built around the `age-plugin` crate.
 
 use rand::{thread_rng, Rng};
-use secrecy::Zeroize;
+use secrecy::zeroize::Zeroize;
 use std::env;
 use std::fmt;
 use std::io::{self, BufRead, BufReader, Read, Write};

age-core/src/plugin.rs

@@ -175,9 +175,14 @@ impl IdentityPluginV1 for IdentityPlugin {
                     // identities.
                     let _ = callbacks.message("This identity does nothing!")?;
                     file_keys.entry(file_index).or_insert_with(|| {
-                        Ok(FileKey::from(
-                            TryInto::<[u8; 16]>::try_into(&stanza.body[..]).unwrap(),
-                        ))
+                        FileKey::try_init_with_mut(|file_key| {
+                            if stanza.body.len() == file_key.len() {
+                                file_key.copy_from_slice(&stanza.body);
+                                Ok(())
+                            } else {
+                                panic!("File key is wrong length")
+                            }
+                        })
                     });
                     break;
                 }

age-plugin/examples/age-plugin-unencrypted.rs

@@ -135,7 +135,7 @@ impl<'a, 'b, R: io::Read, W: io::Write> Callbacks<Error> for BidirCallbacks<'a,
             .and_then(|res| match res {
                 Ok(s) => String::from_utf8(s.body)
                     .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "secret is not UTF-8"))
-                    .map(|s| Ok(SecretString::new(s))),
+                    .map(|s| Ok(SecretString::from(s))),
                 Err(e) => Ok(Err(e)),
             })
     }

age-plugin/src/identity.rs

@@ -1,7 +1,7 @@
 //! Recipient plugin helpers.
 
 use age_core::{
-    format::{is_arbitrary_string, FileKey, Stanza, FILE_KEY_BYTES},
+    format::{is_arbitrary_string, FileKey, Stanza},
     plugin::{self, BidirSend, Connection},
     secrecy::SecretString,
 };
@@ -81,8 +81,12 @@ pub trait RecipientPluginV1 {
     /// Wraps each `file_key` to all recipients and identities previously added via
     /// `add_recipient` and `add_identity`.
     ///
-    /// Returns either one stanza per recipient and identity for each file key, or any
-    /// errors if one or more recipients or identities could not be wrapped to.
+    /// Returns a set of stanzas per file key that wrap it to each recipient and identity.
+    /// Plugins may return more than one stanza per "actual recipient", e.g. to support
+    /// multiple formats, to build group aliases, or to act as a proxy.
+    ///
+    /// If one or more recipients or identities could not be wrapped to, no stanzas are
+    /// returned for any of the file keys.
     ///
     /// `callbacks` can be used to interact with the user, to have them take some physical
     /// action or request a secret value.
@@ -183,7 +187,7 @@ impl<'a, 'b, R: io::Read, W: io::Write> Callbacks<Error> for BidirCallbacks<'a,
             .and_then(|res| match res {
                 Ok(s) => String::from_utf8(s.body)
                     .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "secret is not UTF-8"))
-                    .map(|s| Ok(SecretString::new(s))),
+                    .map(|s| Ok(SecretString::from(s))),
                 Err(e) => Ok(Err(e)),
             })
     }
@@ -281,11 +285,16 @@ pub(crate) fn run_v1<P: RecipientPluginV1>(mut plugin: P) -> io::Result<()> {
             }),
             (Some(WRAP_FILE_KEY), |s| {
                 // TODO: Should we ignore file key commands with unexpected metadata args?
-                TryInto::<[u8; FILE_KEY_BYTES]>::try_into(&s.body[..])
-                    .map_err(|_| Error::Internal {
-                        message: "invalid file key length".to_owned(),
-                    })
-                    .map(FileKey::from)
+                FileKey::try_init_with_mut(|file_key| {
+                    if s.body.len() == file_key.len() {
+                        file_key.copy_from_slice(&s.body);
+                        Ok(())
+                    } else {
+                        Err(Error::Internal {
+                            message: "invalid file key length".to_owned(),
+                        })
+                    }
+                })
             }),
             (Some(EXTENSION_LABELS), |_| Ok(())),
         )?;

age-plugin/src/recipient.rs

@@ -26,7 +26,7 @@ to 1.0.0 are beta releases.
 - Partial French translation!
 
 ### Changed
-- Migrated to `i18n-embed 0.15`.
+- Migrated to `i18n-embed 0.15`, `secrecy 0.10`.
 - `age::Encryptor::with_recipients` now takes recipients by reference instead of
   by value. This aligns it with `age::Decryptor` (which takes identities by
   reference), and also means that errors with recipients are reported earlier.

age/CHANGELOG.md

@@ -37,7 +37,7 @@ futures = { version = "0.3", optional = true }
 pin-project = "1"
 
 # Common CLI dependencies
-pinentry = { version = "0.5", optional = true }
+pinentry = { workspace = true, optional = true }
 
 # Dependencies used internally:
 # (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)