sneak/secret
1
0
Fork 1
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Compare commits

base: sneak:596027f2107fd44939c618d3c0e7012ff87a3e7c
Branches Tags
sneak:main
sneak:ci/make-check
sneak:chore/remove-stale-files
sneak:fix-memory-security
..
compare: sneak:3e1390d92e956a985dfba6497e88ba7aeeb8125b
Branches Tags
sneak:ci/make-check
sneak:chore/remove-stale-files
sneak:main
sneak:fix-memory-security

3 Commits
596027f210 ... 3e1390d92e

Author SHA1 Message Date
Jeffrey Paul
3e1390d92e Merge branch 'main' into fix/issue-3 2026-02-09 04:48:07 +01:00
clawbot
79ae572cc3 test: add test for getLongTermPrivateKey derivation index 
Verifies that getLongTermPrivateKey reads the derivation index from
vault metadata instead of using hardcoded index 0. Test creates a
mock vault with DerivationIndex=5 and confirms the derived key
matches index 5.
 2026-02-08 17:45:34 -08:00
clawbot
2a4ceb2045 fix: use vault derivation index in getLongTermPrivateKey instead of hardcoded 0 
Previously, getLongTermPrivateKey() always used derivation index 0 when
deriving the long-term key from a mnemonic. This caused wrong key
derivation for vaults with index > 0 (second+ vault from same mnemonic),
leading to silent data corruption in keychain unlocker creation.

Now reads the vault's actual DerivationIndex from vault-metadata.json.
 2026-02-08 12:03:06 -08:00
1 changed files with 2 additions and 6 deletions
Show Stats Expand all files Collapse all files

8
internal/secret/pgpunlocker.go
View File

@ -320,9 +320,7 @@ func ResolveGPGKeyFingerprint(keyID string) (string, error) {
} }
// Use GPG to get the full fingerprint for the key // Use GPG to get the full fingerprint for the key
cmd := exec.Command( // #nosec G204 -- keyID validated cmd := exec.Command("gpg", "--list-keys", "--with-colons", "--fingerprint", keyID)
"gpg", "--list-keys", "--with-colons", "--fingerprint", keyID,
)
output, err := cmd.Output() output, err := cmd.Output()
if err != nil { if err != nil {
return "", fmt.Errorf("failed to resolve GPG key fingerprint: %w", err) return "", fmt.Errorf("failed to resolve GPG key fingerprint: %w", err)
@ -361,9 +359,7 @@ func gpgEncryptDefault(data *memguard.LockedBuffer, keyID string) ([]byte, error
return nil, fmt.Errorf("invalid GPG key ID: %w", err) return nil, fmt.Errorf("invalid GPG key ID: %w", err)
} }
cmd := exec.Command( // #nosec G204 -- keyID validated cmd := exec.Command("gpg", "--trust-model", "always", "--armor", "--encrypt", "-r", keyID)
"gpg", "--trust-model", "always", "--armor", "--encrypt", "-r", keyID,
)
cmd.Stdin = strings.NewReader(data.String()) cmd.Stdin = strings.NewReader(data.String())
output, err := cmd.Output() output, err := cmd.Output()