Ban unarmored GPG keys
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start by reading issue #329 and the existing ASCII-armored GPG private-key ban. Compare the proposed file, python-magic, and self-implemented MIME matching approaches, then define a portable detection behavior and verify that unarmored private keys are rejected without incorrectly banning ordinary binary data.
Written by the indexing model from the issue text.
Description
In #329 we added a ban for ASCII-armored GPG private keys. But as far as I can tell we don't have a method for detecting un-armored private keys, since they resemble unstructured binary data.
$ gpg --export-secret-keys > secrets
$ file -I secrets
secrets: application/octet-stream; charset=binary
However, that doesn't mean they can't be identified (evidently):
$ file secrets
secrets: PGP Secret Key - 4096b created on Sun Nov 17 19:37:04 2013 - RSA (Encrypt or Sign) e=65537 hashed AES with 128-bit key Salted&Iterated S2K SHA-11
It looks like the mime-type for PGP keys is defined here: https://tools.ietf.org/html/rfc3156
This leads to a fork in the road for implementation:
We could make a subprocess call to file.
I don't like this for portability reasons. We don't know that file exists and behaves consistently everywhere pre-commit will be deployed.
We could use the magic library.
This works:
$ python3
Python 3.7.1 (default, Nov 6 2018, 18:45:35)
[Clang 10.0.0 (clang-1000.11.45.5)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import magic
>>> mime = magic.Magic()
>>> mime.from_file('secrets')
'PGP\\011Secret Key - 4096b created on Sun Nov 17 19:37:04 2013 - RSA (Encrypt or Sign) e=65537 hashed AES with 128-bit key Salted&Iterated S2K SHA-1'
But it adds a dependency on a non-standard library: python-magic.
We could try to emulate the mimetype matching ourselves.
Reinvents a wheel and the consequences of getting it wrong when users trust us to get it right could be bad.
What do you think?
- Dominant language
- Python
- Stars
- 6.7k
- Forks
- 800
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from pre-commit/pre-commit-hooks
-
Immutable Releases Open
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
pre-commit/pre-commit-hooks#1218 · 4 comments · 2 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
pre-commit/pre-commit-hooks#1020 · 8 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
pre-commit/pre-commit-hooks#780 · 5 comments · 2 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
pre-commit/pre-commit-hooks#749 · 1 reaction ·
-
enhancement good-first-issue
Difficulty 3/5 1-2 days Newbie friendliness 55/100
pre-commit/pre-commit-hooks#612 · 13 comments ·
All issues in pre-commit/pre-commit-hooks
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100