IJHack / QtPass / 40564693566
93%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 122
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 92.462% (-0.009%) from 92.471%
40564693566

push

github

web-flow 
RnpCrypto: keep the keyring on disk, secret keys protected (#2067)

* RnpCrypto: keep the keyring on disk, secret keys protected

The next step of #2005, by its requirements for key storage at rest:

- saveKeyring(dir): pubring.gpg and secring.gpg (OpenPGP keys, as
  GnuPG 1 kept them) in a folder of QtPass's own, made owner-only,
  each file staged and replaced whole (Util::writeFileReplacing).
  Secret keys are written as held, protected by their own passphrase
  and never decrypted for it; an unprotected one is refused, nothing
  written, unless allowUnprotected, the user's explicit consent. A
  keyring without secret keys writes an empty secring.gpg, so no
  stale secret file stays behind.
- loadKeyring(dir): each file read as a regular file, not through a
  link, at most kMaxKeyringBytes; missing or empty is no keyring.
  Secret keys stay locked until an operation needs them.
- protectKey(fingerprint, passphrase): gives an unprotected secret key
  (every secret part here) a passphrase; refuses an empty one and a key
  protected already (no passphrase change here).
- KeyInfo::secretProtected; GnuPG stubs still do not count as secret.
- SECURITY.md: "in memory only today" becomes what the disk holds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* protectKey: finish a half-protected key instead of refusing it

CodeRabbit: protectKey() refused a key with any protected part, while
saveKeyring() wants every part protected, so a key left half protected
(imported so, or a protect that failed part-way) could only be saved
with consent, unprotected parts and all. Only the parts not yet
protected get the passphrase now; a key whose parts are all protected
is still refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne J... (continued)

9432 of 10201 relevant lines covered (92.46%)

304.71 hits per line

Coverage Regressions

Lines Coverage ∆ File
1
89.8
-1.02% src/nativegrep.cpp
Jobs
ID Job ID Ran Files Coverage
1 40564693566.1 122
92.46
GitHub Action Run
Source Files on build 40564693566