Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vendor pretty-bad-protocol and strip it down to what is needed #6807

Closed
Tracked by #6399
legoktm opened this issue May 17, 2023 · 0 comments · Fixed by #6836
Closed
Tracked by #6399

Vendor pretty-bad-protocol and strip it down to what is needed #6807

legoktm opened this issue May 17, 2023 · 0 comments · Fixed by #6836
Assignees
@legoktm @eaon

Comments

@legoktm
Copy link
Member

legoktm commented May 17, 2023 •
edited
Loading

https://github.com/isislovecruft/python-gnupg is unmaintained these days and we've monkeypatched it a bit. Part of migrating to Sequoia is to move away from this library. But we will need bits of it around for the online migration of secret keys (#6802), so we should simply vendor it and strip it down to only what we need.

We can also get rid of the monkeypatching at this time and treat it as SecureDrop-owned code instead of upstream.
@legoktm legoktm mentioned this issue May 17, 2023
Closed
14 tasks
@legoktm legoktm changed the title Vendor pretty_bad_privacy and strip it down to what is needed Vendor pretty-bad-protocol and strip it down to what is needed May 17, 2023
@zenmonkeykstop zenmonkeykstop moved this to Cycle Backlog in SecureDrop dev cycle May 19, 2023
@legoktm legoktm self-assigned this Jun 6, 2023
@zenmonkeykstop zenmonkeykstop moved this from Cycle Backlog to In Progress in SecureDrop dev cycle Jun 8, 2023
legoktm added a commit that referenced this issue Jun 12, 2023
@legoktm
Vendor pretty_bad_protocol
a67420b 
pretty_bad_protocol is unmaintained upstream, not seeing any commits
since the 3.1.1 release in August 2018. As part of our shift to Sequoia,
we will just need a small part of this library during the migration, so
let's fork/vendor it and remove the parts we don't need. This will also
let us get rid of the monkey-patching that's accumulated over the years.

This is a direct copy of the 3.1.1 source tree:
 $ wget https://files.pythonhosted.org/packages/84/0d/814c6c96f64f9cfc235fe102024b00ee77d107977e32996c59aed8f27ec0/pretty-bad-protocol-3.1.1.tar.gz
 $ tar xvf pretty-bad-protocol-3.1.1.tar.gz
 $ cp -Rv pretty-bad-protocol-3.1.1/pretty_bad_protocol freedomofpress/securedrop/securedrop/

Follow-up commits will reformat it per our coding standards and other
necessary fixes.

Refs #6807.
legoktm added a commit that referenced this issue Jun 12, 2023
@legoktm
Get rid of pretty_bad_protocol monkey-patching
d60d89b 
And just implement them in the code directly now. We still set
the `USERNAME` environment variable via encryption.py since there's
not really a logical place for it in pretty_bad_protocol.

Fixes #6807.
@legoktm legoktm mentioned this issue Jun 12, 2023
Merged
7 tasks
@legoktm legoktm moved this from In Progress to Ready For Review in SecureDrop dev cycle Jun 12, 2023
@github-project-automation github-project-automation bot moved this from Ready For Review to Done in SecureDrop dev cycle Jun 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@legoktm legoktm

@eaon eaon

Labels
None yet
Projects
SecureDrop dev cycle
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Vendor pretty_bad_protocol freedomofpress/securedrop
2 participants
@legoktm @eaon