sneak/keyfunc
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

age decrypt refuses a text-form file with a blank line before its first line; age reads it #77

New Issue
Closed
opened 2026-10-13 00:50:53 +02:00 by clawbot · 2 comments
clawbot commented 2026-10-13 00:50:53 +02:00
Collaborator
Copy Link
Copy Source

age decrypt recognises the text form (--armor output) only when the file begins exactly with -----BEGIN AGE ENCRYPTED FILE-----. A text-form file with a blank line or spaces in front, as pasted from mail or a terminal, is taken for the binary form and refused with decrypting: failed to read header: parsing age header: unexpected intro: "\n". The reference age tool (v1.3.2, cmd/age/age.go, decrypt) trims up to 1024 bytes of leading whitespace before looking for that line and decrypts the same file.

Where: internal/agekey/agekey.go:194-203 (unarmored).

How to see:

export KEYFUNC_MNEMONIC='abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
echo hi | ./keyfunc age encrypt --armor -o a.age
sed '1s/^/\n/' a.age | ./keyfunc age decrypt
./keyfunc age priv | tee id | sed d
sed '1s/^/\n/' a.age | age -d -i id

The third line is refused; the fifth prints hi.

Definition of done: a text-form file preceded by blank lines or spaces decrypts, as with age. A test in internal/agekey/agekey_test.go or internal/cli/age_test.go puts a newline and two spaces in front of an armored file and expects the plaintext.

Severity: minor. The file is intact and the reference tool reads it; the message does not say what to fix.

Model: fable-5-1

`age decrypt` recognises the text form (`--armor` output) only when the file begins exactly with `-----BEGIN AGE ENCRYPTED FILE-----`. A text-form file with a blank line or spaces in front, as pasted from mail or a terminal, is taken for the binary form and refused with `decrypting: failed to read header: parsing age header: unexpected intro: "\n"`. The reference `age` tool (v1.3.2, `cmd/age/age.go`, `decrypt`) trims up to 1024 bytes of leading whitespace before looking for that line and decrypts the same file. Where: `internal/agekey/agekey.go:194-203` (`unarmored`). How to see: export KEYFUNC_MNEMONIC='abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about' echo hi | ./keyfunc age encrypt --armor -o a.age sed '1s/^/\n/' a.age | ./keyfunc age decrypt ./keyfunc age priv | tee id | sed d sed '1s/^/\n/' a.age | age -d -i id The third line is refused; the fifth prints `hi`. **Definition of done**: a text-form file preceded by blank lines or spaces decrypts, as with `age`. A test in `internal/agekey/agekey_test.go` or `internal/cli/age_test.go` puts a newline and two spaces in front of an armored file and expects the plaintext. Severity: minor. The file is intact and the reference tool reads it; the message does not say what to fix. Model: fable-5-1
clawbot commented 2026-10-14 19:40:25 +02:00
Author
Collaborator
Copy Link
Copy Source

Plan: as written: skip up to 1024 bytes of leading whitespace before looking for the text form's first line, as age does. It starts after #79 lands, which changes internal/agekey/agekey.go too.

Model: opus-5-5

Plan: as written: skip up to 1024 bytes of leading whitespace before looking for the text form's first line, as `age` does. It starts after https://git.eeqj.de/sneak/keyfunc/issues/79 lands, which changes `internal/agekey/agekey.go` too. Model: opus-5-5
clawbot commented 2026-10-14 21:20:52 +02:00
Author
Collaborator
Copy Link
Copy Source

Fix in #88: age decrypt looks for the text form past up to 1024 bytes of whitespace, as age does. Spaces in front of -----BEGIN AGE ENCRYPTED FILE----- on that same line are still refused, as age refuses them, so the test puts its two spaces on a line of their own.

Model: opus-5-5

Fix in https://git.eeqj.de/sneak/keyfunc/pulls/88: `age decrypt` looks for the text form past up to 1024 bytes of whitespace, as `age` does. Spaces in front of `-----BEGIN AGE ENCRYPTED FILE-----` on that same line are still refused, as `age` refuses them, so the test puts its two spaces on a line of their own. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
reviewed and ready to merge
 needs-checks
waiting for checks to pass
 needs-rebase
Conflicts with the current next; rebase before review
 needs-review
waiting for review
 needs-rework
review found things to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/keyfunc#77