mirrors/age
1
0
Fork 0
mirror of https://github.com/FiloSottile/age.git synced 2026-09-04 07:07:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
422 Commits 5 Branches 19 Tags
eb706087c6cd622a5a31e45e915e31506ad7f904
Commit Graph
422 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Filippo Valsorda eb706087c6 internal/format: validate stanza fields when marshaling 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda bebcffc2f3 plugin: always canonicalize plugin names 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 572b47c3e7 agessh: enforce the RSA key size when wrapping 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda b030f04671 armor: enforce writer lifecycle 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 352cb3e133 plugin: reject negative file indexes 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda e8d1b2f216 armor,internal/format: restore CCTV fuzz seed corpora 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 6424047654 armor: reject embedded carriage returns 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 88299a50e4 cmd/age-inspect: classify unknown recipient stanzas 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda ec60cb56b4 internal/format: reject headers without recipient stanzas 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda aaadae2d85 cmd/age-keygen,extra/age-plugin-pq: buffer identity conversion output 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 019df184df .github/workflows: include compatibility plugins in release archives 2026-08-29 19:30:10 +02:00
Filippo Valsorda e0ffaca260 agessh: don't cache mismatched encrypted identities 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 86c6cc24c0 internal/term: sanitize terminal prompts 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda fb6bef07c3 age: don't reorder caller identities 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 45445f91cf cmd/age-keygen: report output write failures 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 343dda9aa4 cmd/age: reject malformed supported SSH recipients 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 418c7ac33b age,cmd/age: reject oversized key files 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda c45ccfd215 age,internal/format: avoid echoing private keys in errors 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 366cc58ca8 internal/bech32: avoid panic on Unicode input 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 7a8f500567 cmd/age: delay output creation until payload authentication 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda dbe5773864 cmd/age: reject output aliases of input files 
Reported by Joe Doyle of Trail of Bits.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 20f9e8574f agessh,tag/tagtest: handle recipient hint collisions 
The four-byte SSH fingerprints (and tagged recipient tags) are hints to
avoid unnecessary password prompts or hardware interactions. Treat an
authenticated unwrap failure after a hint match as a false positive and
continue looking for a matching stanza.

Without this, a colliding recipient stanza that appears before the
valid stanza makes decryption fail even though the file is correctly
encrypted to the identity. Any password prompt or hardware interaction
has already happened by then.

Reported by Claude, Anthropic's AI assistant, and triaged by the
Anthropic security team in collaboration with Anthropic Research,
as ANT-2026-S9C25K8W.
 2026-08-29 19:30:10 +02:00
Filippo Valsorda 27188e780b internal/format: limit header size and memory use 
The application has no way to limit the header separately from the body,
so we have to enforce some sanity limits to prevent excessive memory use.

To relax the limits somewhat, make the parsing more efficient.

New limits are:

  * 2 MiB total header size (enough for > 1024 PQ recipients)
  * 1024 recipient stanzas
  * 128 arguments per stanza

Fixes #701
 2026-08-29 19:30:10 +02:00
Filippo Valsorda c083f6045f internal/stream: detect trailing data returned alongside io.EOF 
The trailing data check after a full-length final chunk ignored the
byte count, so a reader returning (1, io.EOF), as io.Reader permits,
would have its trailing data silently accepted, and a transient
(0, nil) return would be misreported as trailing data. io.ReadFull
handles both.
 2026-08-29 14:31:26 +02:00
Filippo Valsorda 91bc452b9a internal/stream: reject negative and overflowing encrypted sizes 2026-08-29 14:26:05 +02:00
Filippo Valsorda 04f65ea9fc internal/stream: extract readFullAt and clean up tests 2026-08-29 14:24:43 +02:00
Arpit GuptaGitHubArpit Gupta
 		b155aff565 stream: fix NewDecryptReaderAt EOF handling (#708) 
Co-authored-by: Arpit Gupta <arpitb.lgupta1@gmail.com>
 2026-08-29 13:45:51 +02:00
Ziad YahyaandGitHub 2313f65737 README: add --version flag to usage section (#739) 2026-08-29 12:52:26 +02:00
Richard UlmerandGitHub d16b021305 README: add syntax highlighting to code blocks (#713) 2026-08-29 00:37:00 +02:00
GitHub Actions e65b40fc99 doc: regenerate groff and html man pages 2026-08-28 22:24:16 +00:00
Filippo Valsorda ac0ed948b4 .github/workflows: remove expired Windows code signing certificate 
Closes #715
 2026-08-29 00:22:02 +02:00
itsVentieandFilippo Valsorda 933c44d4d5 internal/inspect: handle reads after EOF in trackReader 
trackReader.Read panicked if called again after a read returned io.EOF,
which can happen with readers that do not return EOF consistently, such
as a terminal after Ctrl-D. Latch the EOF instead, per the io.Reader
contract, so count stays consistent with the file size.

Fixes #719

Co-authored-by: Filippo Valsorda <hi@filippo.io>
 2026-08-29 00:22:02 +02:00
Filippo Valsorda 6d29a923f3 .github/workflows: add windows/arm64 build 
Fixes #733
 2026-08-29 00:22:02 +02:00
Filippo Valsorda 3cfb3adc2a all: update dependencies and GitHub Actions 
Closes #736
Fixes #731
 2026-08-29 00:22:02 +02:00
Mohamed MoumniandGitHub 72586cd449 cmd/age: add --version to usage text (#694) 2026-08-29 00:20:37 +02:00
udf2457andGitHub 7c7978c12e ‎internal/stream: simplify a min() computation in tests (#727) 2026-08-28 23:28:31 +02:00
Filippo Valsorda a68b8e921b README: add dependencies badge 2026-08-28 23:06:33 +02:00
Steve WeisGitHubClaude
 		706dfc1e79 all: minor cleanups (#700) 
Replace two hand-rolled slicesEqual helpers with slices.Equal from
the standard library, which is already imported in age.go.
(age.go:211-221, plugin/plugin.go:666-676)

Fix godoc link typo [Indentity] -> [Identity].
(plugin/plugin.go:3)

Fix comment typo "not MinPayload" -> "so MinPayload".
(internal/inspect/inspect.go:25)

Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-20 22:12:32 +01:00
Steve WeisGitHubClaude
 		4c86929a84 internal/format: return correct byte count from writeWrapped (#698) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-20 22:02:09 +01:00
Steve WeisGitHubClaude
 		db09cd66d1 internal/inspect: fix tag stanza type names in post-quantum classifier (#695) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-20 21:49:27 +01:00
Filippo ValsordaandGitHub 4a3a4ef00a SIGSUM.md: extend release playbook 2026-02-02 17:31:01 +01:00
Filippo Valsorda 10561a774f .github/workflows: remove one-off darwin/amd64 backfill workflow 
Updates #676
 2026-01-21 18:56:39 +01:00
Filippo Valsorda c918a2c113 .github/workflows: add darwin/amd64 backfill workflow 
Updates #676
 2026-01-21 18:49:52 +01:00
Filippo Valsorda beb5dfa28c .github/workflows: add darwin/amd64 build target 
Closes #676
 2026-01-21 18:49:46 +01:00
Filippo Valsorda 0293aca1d7 SIGSUM.md: add release playbook 
Updates #617
 2025-12-31 16:19:37 +01:00
GitHub Actions e7601d8a67 doc: regenerate groff and html man pages 2025-12-31 11:05:09 +00:00
brettwhiteincandGitHub acfa73142b doc: fix post-quantum example in age-keygen manpage (#675) 2025-12-31 12:03:49 +01:00
Filippo Valsorda b8564adb6d .github/workflows: inject version into source release artifact 
Updates #671
Updates golang/go#77020
v1.3.1 		2025-12-28 13:00:23 +01:00
Filippo Valsorda e4c611f778 cmd,extra: restore the Version link-time variable 
We don't need it in our builds, but it's useful for downstream packagers.

Fixes #671
Updates NixOS/nixpkgs#474666
Updates golang/go#77020
 2025-12-28 12:49:37 +01:00
Filippo Valsorda 6a8065f2da SIGSUM.md: update policy for v1.3.0 
Updates #617
v1.3.0 		2025-12-27 15:59:06 +01:00