IJHack / QtPass / 40408942413
93%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 117
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 92.851% (-0.01%) from 92.861%
40408942413

push

github

web-flow 
RnpCrypto: in-process OpenPGP encrypt and decrypt through RNP (spike) (#2048)

* RnpCrypto: in-process OpenPGP encrypt and decrypt through RNP (spike)

A first step towards a backend that needs no gpg, git or pass binary
(#2005), which would let QtPass run on Windows without Gpg4win and on
Android at all. RnpCrypto wraps RNP, the OpenPGP library Thunderbird
uses: import armored keys (gpg --export / --export-secret-keys) into its
own keyring, encrypt to several recipients as one binary message (as
pass writes .gpg files), and decrypt with a passphrase callback in
place of pinentry. Recipients are found the way .gpg-id names them: a
fingerprint, a long key ID with or without 0x, or part of a user ID
such as the e-mail address, as gpg -r accepts.

Built only with qmake CONFIG+=rnp (pkg-config librnp); nothing else in
QtPass uses it yet, and default builds are unchanged.

tst_rnpcrypto checks it against the real gpg on the system: RNP
decrypts what gpg encrypted, including the OCB packets GnuPG 2.4 and
later write by default for their own keys (the risk the research
flagged), gpg decrypts what RNP encrypted for every recipient, the
passphrase callback is asked and a wrong passphrase fails, and an
unknown recipient or a missing secret key is an error. The Ubuntu
Qt 6.11 CI job now builds with CONFIG+=rnp and librnp-dev, so the test
runs there against Ubuntu's RNP and GnuPG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* SECURITY.md: what QtPass holds without GnuPG; GnuPG stays the default

The in-process OpenPGP spike moves the secret key from gpg-agent (or a
smartcard) into QtPass: it is imported from a GnuPG export, kept under
its own passphrase, and while an entry is decrypted the unlocked key and
the passphrase typed into QtPass are in QtPass's memory. No smartcards
or YubiKeys in that mode.

SECURITY.md gains a sec... (continued)

9169 of 9875 relevant lines covered (92.85%)

193.95 hits per line

Coverage Regressions

Lines Coverage ∆ File
1
86.42
-1.23% src/nativegrep.cpp
Jobs
ID Job ID Ran Files Coverage
1 40408942413.1 117
92.85
GitHub Action Run
Source Files on build 40408942413