chore: upgrade to rpgp v0.17

alexng353 · alexng353 · commit 03b4ebd91e29 · 2025-10-27T00:48:25.000+07:00
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -45,7 +45,7 @@ rand = "0.8.5"
 regex = "1"
 reqwest = { version = "0.12.7", features = ["json"] }
 
-pgp = "0.15"
+pgp = "0.17"
 
 serde = { version = "1.0.208", features = ["derive"] }
 serde_json = "1.0"
diff --git a/src/commands/gen.rs b/src/commands/gen.rs
@@ -10,8 +10,8 @@ use crate::utils::prompt::{prompt_password, prompt_text};
 use crate::utils::rpgp::{generate_key_pair, get_vault_location, user_id};
 use crate::utils::vecu8::ToHex;
 use anyhow::{bail, Context};
-use pgp::types::PublicKeyTrait;
-use pgp::ArmorOptions;
+use pgp::composed::ArmorOptions;
+use pgp::types::KeyDetails;
 use std::fs;
 
 extern crate keyring;
diff --git a/src/commands/get/keys.rs b/src/commands/get/keys.rs
@@ -1,5 +1,4 @@
 use super::*;
-use crate::utils::config::Config;
 
 /// List all keys in the config
 #[derive(Parser)]
diff --git a/src/commands/import.rs b/src/commands/import.rs
@@ -5,11 +5,14 @@ use crate::utils::prompt::prompt_text;
 use crate::utils::rpgp::get_vault_location;
 use crate::utils::vecu8::ToHex;
 use clap::Subcommand;
-use pgp::ArmorOptions;
-use pgp::{types::PublicKeyTrait, Deserializable};
 use std::fs;
 use std::io::Cursor;
 
+use pgp::{
+    composed::{ArmorOptions, Deserializable},
+    types::KeyDetails,
+};
+
 /// Import ascii armored keys from a file
 #[derive(Parser, Debug)]
 pub struct Args {
@@ -46,7 +49,7 @@ pub async fn command(args: Args, _config: Config) -> Result<()> {
                 .context("Failed to get user id from key")?
                 .id
                 .id()
-                .to_string();
+                .to_hex();
 
             // TODO: fix this
             let primary_user_id = if only_hex(&first_user_id)
diff --git a/src/commands/mod.rs b/src/commands/mod.rs
@@ -5,11 +5,13 @@ pub(super) use colored::Colorize;
 // With subcommands
 pub mod config;
 pub mod get;
+pub mod invite;
 pub mod keyring;
 pub mod project;
 
 // No subcommands
 pub mod auth;
+pub mod completion;
 pub mod export;
 pub mod gen;
 pub mod import;
@@ -26,4 +28,3 @@ pub mod upload;
 pub mod variables;
 pub mod version;
 pub mod whoami;
-pub mod completion;
diff --git a/src/commands/project/add_users.rs b/src/commands/project/add_users.rs
@@ -9,7 +9,7 @@ use crate::{
         variable::{EncryptedVariable, ToKVPair},
     },
 };
-use pgp::{Deserializable, SignedPublicKey};
+use pgp::composed::{Deserializable, SignedPublicKey};
 use rayon::iter::{IntoParallelRefIterator, ParallelIterator};
 use reqwest::header;
 use serde_json::json;
diff --git a/src/commands/project/remove_user.rs b/src/commands/project/remove_user.rs
@@ -3,7 +3,7 @@ use std::{collections::HashSet, fmt::Display};
 use anyhow::Result;
 use clap::Parser;
 use envx_sdk::models::RemoveUserBody;
-use pgp::{Deserializable, SignedPublicKey};
+use pgp::composed::{Deserializable, SignedPublicKey};
 use rayon::iter::{IntoParallelRefIterator, ParallelIterator};
 use reqwest::header;
 use serde_json::json;
diff --git a/src/main.rs b/src/main.rs
@@ -52,7 +52,8 @@ commands_enum!(
     config,
     get,
     keyring,
-    project
+    project,
+    invite
 );
 
 fn spawn_update_task() -> tokio::task::JoinHandle<anyhow::Result<String>> {
diff --git a/src/sdk.rs b/src/sdk.rs
@@ -10,7 +10,7 @@ use crate::{
     },
 };
 use anyhow::bail;
-use pgp::{Deserializable, SignedPublicKey};
+use pgp::composed::{Deserializable, SignedPublicKey};
 use rayon::iter::{IntoParallelRefIterator, ParallelIterator};
 use reqwest::{header, StatusCode};
 use serde::{Deserialize, Serialize};
diff --git a/src/utils/key.rs b/src/utils/key.rs
@@ -1,6 +1,12 @@
 use super::{auth::AuthToken, rpgp::get_vault_location};
 use anyhow::{bail, Context, Result};
-use pgp::{crypto, ArmorOptions, Deserializable, Message};
+use pgp::{
+    composed::{
+        ArmorOptions, Deserializable, MessageBuilder, SignedPublicKey,
+        SignedSecretKey,
+    },
+    crypto::hash::HashAlgorithm,
+};
 use serde::{Deserialize, Serialize};
 use std::{fmt::Display, fs};
 use thiserror::Error;
@@ -30,36 +36,34 @@ impl UnlockedKey {
             .signed_secret_key()
             .context("Failed to get secret key")?;
 
-        let msg = Message::new_literal("none", &chrono::Utc::now().to_string());
+        let mut rng = rand::rngs::OsRng;
 
-        let pw = || self.password.to_string();
-
-        let rng = rand::rngs::OsRng;
+        let ts = chrono::Utc::now().to_string();
+        let mut builder = MessageBuilder::from_bytes("", ts);
+        builder.sign(
+            &key.primary_key,
+            self.password.clone().into(),
+            HashAlgorithm::Sha3_512,
+        );
         let signature =
-            msg.sign(rng, &key, pw, crypto::hash::HashAlgorithm::SHA3_512);
+            builder.to_armored_string(&mut rng, ArmorOptions::default());
 
+        // TODO: check to make sure the password is correct
         let signature = match signature {
             Ok(s) => s,
             Err(e) => {
                 eprintln!("Failed to sign API authentication challenge: {}", e);
-                if let pgp::errors::Error::Incomplete(_) = e {
-                    eprintln!("This is most likely due to a missing or incorrect passphrase.");
-                    println!(
+
+                eprintln!("This is most likely due to a missing or incorrect passphrase.");
+                println!(
                     "You can view the saved passphrase with 'envx keyring view [fingerprint]'"
                 );
-                    println!("This command is interactive");
-                    // println!("Or you can check against the saved passphrase with 'envx keyring check -k <fingerprint> -p <passphrase>'");
-                    // println!("Both of these commands are interactive")
-                }
+                println!("This command is interactive");
 
                 bail!("Failed to sign API authentication challenge");
             }
         };
 
-        let signature = signature
-            .to_armored_string(ArmorOptions::default())
-            .context("Failed to convert signature to armored string")?;
-
         let auth_token =
             AuthToken::new(self.key.uuid.clone().unwrap().into(), signature);
 
@@ -122,9 +126,9 @@ impl Key {
         Ok(key)
     }
 
-    fn signed_public_key(&self) -> Result<pgp::SignedPublicKey, KeyError> {
+    fn signed_public_key(&self) -> Result<SignedPublicKey, KeyError> {
         let key = self.public_key_str()?;
-        let (pubkey, _) = pgp::SignedPublicKey::from_string(key.as_str())
+        let (pubkey, _) = SignedPublicKey::from_string(key.as_str())
             .map_err(|_| KeyError::FailedToParse(KeyType::Public))?;
 
         Ok(pubkey)
@@ -141,56 +145,56 @@ impl Key {
         Ok(key)
     }
 
-    fn signed_secret_key(&self) -> Result<pgp::SignedSecretKey, KeyError> {
+    fn signed_secret_key(&self) -> Result<SignedSecretKey, KeyError> {
         let key = self.secret_key_str()?;
-        let (seckey, _) = pgp::SignedSecretKey::from_string(key.as_str())
+        let (seckey, _) = SignedSecretKey::from_string(key.as_str())
             .map_err(|_| KeyError::FailedToParse(KeyType::Secret))?;
 
         Ok(seckey)
     }
 }
 
-impl TryInto<pgp::SignedSecretKey> for Key {
+impl TryInto<SignedSecretKey> for Key {
     type Error = KeyError;
 
-    fn try_into(self) -> Result<pgp::SignedSecretKey, Self::Error> {
+    fn try_into(self) -> Result<SignedSecretKey, Self::Error> {
         self.signed_secret_key()
     }
 }
 
-impl TryInto<pgp::SignedPublicKey> for Key {
+impl TryInto<SignedPublicKey> for Key {
     type Error = KeyError;
 
-    fn try_into(self) -> Result<pgp::SignedPublicKey, Self::Error> {
+    fn try_into(self) -> Result<SignedPublicKey, Self::Error> {
         self.signed_public_key()
     }
 }
 
-impl TryFrom<&Key> for pgp::SignedSecretKey {
+impl TryFrom<&Key> for SignedSecretKey {
     type Error = KeyError;
 
     fn try_from(key: &Key) -> Result<Self, Self::Error> {
         key.signed_secret_key()
     }
 }
 
-impl TryFrom<&Key> for pgp::SignedPublicKey {
+impl TryFrom<&Key> for SignedPublicKey {
     type Error = KeyError;
 
     fn try_from(key: &Key) -> Result<Self, Self::Error> {
         key.signed_public_key()
     }
 }
 
-impl TryFrom<&UnlockedKey> for pgp::SignedSecretKey {
+impl TryFrom<&UnlockedKey> for SignedSecretKey {
     type Error = KeyError;
 
     fn try_from(key: &UnlockedKey) -> Result<Self, Self::Error> {
         key.key.signed_secret_key()
     }
 }
 
-impl TryFrom<&UnlockedKey> for pgp::SignedPublicKey {
+impl TryFrom<&UnlockedKey> for SignedPublicKey {
     type Error = KeyError;
 
     fn try_from(key: &UnlockedKey) -> Result<Self, Self::Error> {
diff --git a/src/utils/kvpair.rs b/src/utils/kvpair.rs
@@ -1,5 +1,5 @@
 use anyhow::{Context, Result};
-use pgp::{Deserializable, Message};
+use pgp::composed::{Message, SignedSecretKey};
 use serde::{Deserialize, Serialize};
 use std::fmt;
 use std::str::FromStr;
@@ -30,15 +30,21 @@ pub fn read_kvpairs_from_file(
     file_name: &str,
     key: &UnlockedKey,
 ) -> Result<Vec<KVPair>> {
-    let file = std::fs::File::open(file_name)?;
-    let (msg, _) = Message::from_reader_single(file)?;
-    let (dec, _) = msg
-        .decrypt(|| key.password.clone(), &[&key.key.clone().try_into()?])
-        .context("Failed to decrypt local .envx keys")?;
-    dec.get_literal()
-        .ok_or(anyhow::anyhow!("Failed to find message"))?
-        .to_string()
-        .context("Failed to convert literal to string")?
+    let msg = Message::from_file(&file_name)?;
+
+    let ssk = SignedSecretKey::try_from(key)?;
+    let mut decrypted = msg
+        .decrypt(&key.password.clone().into(), &ssk)
+        .context("Decrypting the message")?;
+
+    if decrypted.is_compressed() {
+        decrypted = decrypted
+            .decompress()
+            .context("Failed to decompress message")?;
+    }
+
+    decrypted
+        .as_data_string()?
         .split("\n")
         .map(|s| KVPair::from_str(s))
         .collect::<Result<Vec<KVPair>>>()
diff --git a/src/utils/magic_variables.rs b/src/utils/magic_variables.rs
@@ -1,16 +1,19 @@
+use std::io::Write;
+
 use anyhow::{bail, Context};
 use home::home_dir;
-use pgp::ser::Serialize;
+use pgp::composed::SignedPublicKey;
 
 use crate::{
     sdk::SDK,
-    utils::{kvpair::read_kvpairs_from_file, variable::ToKVPair},
+    utils::{
+        kvpair::read_kvpairs_from_file, rpgp::encrypt, variable::ToKVPair,
+    },
 };
 
 use super::{
     key::{Key, UnlockedKey},
     kvpair::KVPair,
-    rpgp::encrypt_to_msg,
 };
 
 /// Magically get variables from the API or default to ~/.envx/<fingerprint>.envx file
@@ -65,17 +68,16 @@ async fn write_variables_magic(
         .map(|kv| kv.to_string())
         .collect::<Vec<String>>()
         .join("\n");
-    let msg = encrypt_to_msg(&stringified_kvpairs, &[key.try_into()?])?;
 
-    let home_dir = home_dir().context("Failed to get home directory")?;
-    let config_dir = home_dir.join(".config/envx");
-    let envx_file = config_dir.join(format!("{}.envx", &project_id));
-    let envx_file = envx_file
-        .to_str()
-        .ok_or(anyhow::anyhow!("Failed to convert path to string"))?;
+    let spk = [SignedPublicKey::try_from(key)?];
+    let msg = encrypt(&stringified_kvpairs, &spk)?;
+
+    let envx_file = home_dir()
+        .context("Failed to get home directory")?
+        .join(format!(".config/envx/{}.envx", &project_id));
 
     let mut file = std::fs::File::create(envx_file)?;
-    msg.to_writer(&mut file)?;
+    file.write_all(msg.as_bytes())?;
 
     Ok(())
 }
diff --git a/src/utils/mod.rs b/src/utils/mod.rs
@@ -11,6 +11,7 @@ pub mod magic_variables;
 pub mod prompt;
 pub mod rpgp;
 pub mod settings;
+pub mod symmetric;
 pub mod table;
 pub mod variable;
 pub mod vecu8;
diff --git a/src/utils/rpgp.rs b/src/utils/rpgp.rs
diff --git a/template.rs b/template.rs

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,4 @@`
`1`	`1`	`use super::*;`
`2`		`-use crate::utils::config::Config;`
`3`	`2`
`4`	`3`	`/// List all keys in the config`
`5`	`4`	`#[derive(Parser)]`