secret unlocker add pgp without --keyid failed for anyone with default-key in gpg.conf. The key ID was read from gpgconf --list-options gpg, which prints a string value with a leading " and percent-escapes it (gpgconf(1), the value field), and it went to gpg undecoded.
The parsing of that output moved out of getDefaultGPGKey into parseDefaultGPGKey, so a unit test can feed it a line. It drops the leading " and percent-decodes the rest with url.PathUnescape, the standard library's percent-decoder; url.QueryUnescape would have turned + into a space. With no default-key set, the first secret key is still used.
TestParseDefaultGPGKey feeds the parser a fingerprint and a user ID with an escaped comma. TestAddPGPUnlockerDefaultKey writes default-key into the test keyring's gpg.conf and adds a PGP unlocker with no --keyid. Both failed before the fix.
Judgement call: a default-key value that does not percent-decode is an error, so a key the user did not name is never picked in its place.
Beyond the plan: the end-to-end test, next to the unit test the issue asks for.
Rule suppressed: gosec G703 on that test's write of gpg.conf into the GNUPGHOME directory newTestGPGKey made.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/secret/issues/141.
`secret unlocker add pgp` without `--keyid` failed for anyone with `default-key` in `gpg.conf`. The key ID was read from `gpgconf --list-options gpg`, which prints a string value with a leading `"` and percent-escapes it (gpgconf(1), the value field), and it went to gpg undecoded.
The parsing of that output moved out of `getDefaultGPGKey` into `parseDefaultGPGKey`, so a unit test can feed it a line. It drops the leading `"` and percent-decodes the rest with `url.PathUnescape`, the standard library's percent-decoder; `url.QueryUnescape` would have turned `+` into a space. With no `default-key` set, the first secret key is still used.
`TestParseDefaultGPGKey` feeds the parser a fingerprint and a user ID with an escaped comma. `TestAddPGPUnlockerDefaultKey` writes `default-key` into the test keyring's `gpg.conf` and adds a PGP unlocker with no `--keyid`. Both failed before the fix.
- Judgement call: a `default-key` value that does not percent-decode is an error, so a key the user did not name is never picked in its place.
- Beyond the plan: the end-to-end test, next to the unit test the issue asks for.
- Rule suppressed: gosec G703 on that test's write of `gpg.conf` into the `GNUPGHOME` directory `newTestGPGKey` made.
Model: opus-5-5
getDefaultGPGKey took the default-key value from `gpgconf --list-options
gpg` as printed. gpgconf prints a string value with a leading `"` and
percent-escaped, so gpg rejected the key ID. The parsing moved into
parseDefaultGPGKey, which drops the `"` and percent-decodes the rest with
url.PathUnescape, which leaves `+` alone. A value that does not decode is
an error, not a fallback to the first secret key.
Rule suppressed: gosec G703 on the test's write of gpg.conf into the
GNUPGHOME directory newTestGPGKey made.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #141.
secret unlocker add pgpwithout--keyidfailed for anyone withdefault-keyingpg.conf. The key ID was read fromgpgconf --list-options gpg, which prints a string value with a leading"and percent-escapes it (gpgconf(1), the value field), and it went to gpg undecoded.The parsing of that output moved out of
getDefaultGPGKeyintoparseDefaultGPGKey, so a unit test can feed it a line. It drops the leading"and percent-decodes the rest withurl.PathUnescape, the standard library's percent-decoder;url.QueryUnescapewould have turned+into a space. With nodefault-keyset, the first secret key is still used.TestParseDefaultGPGKeyfeeds the parser a fingerprint and a user ID with an escaped comma.TestAddPGPUnlockerDefaultKeywritesdefault-keyinto the test keyring'sgpg.confand adds a PGP unlocker with no--keyid. Both failed before the fix.default-keyvalue that does not percent-decode is an error, so a key the user did not name is never picked in its place.gpg.confinto theGNUPGHOMEdirectorynewTestGPGKeymade.Model: opus-5-5
0e4f7fe72ctoafd1335e48afd1335e48to9ae4b74ee7Review passed.
Model: opus-5-5
9ae4b74ee7tof40f3f4041