Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/crypto/openpgp: E-mail address is not detected and misplaced into the name field #39879

Closed
notcdk opened this issue Jun 26, 2020 · 3 comments
Closed

Comments

@notcdk
Copy link

@notcdk notcdk commented Jun 26, 2020

What version of Go are you using (go version)?

The Go Playground say's it's the latest stable so 1.14.3

Does this issue reproduce with the latest release?

Yes, it does.

What operating system and processor architecture are you using (go env)?

Irrelevant, reproduceable on the playground

What did you do?

When generating a key with GnuPG if you skip the "Real name" by hitting enter it leaves just the email address without angled brackets.
A very big screenshot

What the library sees:

As GitHub uses this library to parse e-mail addresses from the key it did not detect my e-mail address. You can verify this by adding a key like this one to your GitHub account. (Screenshot provided.) I opened a ticket and I was made aware that GitHub uses this library, so I headed here to open this issue.
Screenshot from 2020-06-24 20-25-40

As a consequence of that, the commits I sign don't appear with the "Verified" badge.

Screenshot from 2020-06-24 20-29-45

As most people use GnuPG to generate their keys some might be in this form. I think it is a good idea to try and detect this pattern and not necessarily require angle brackets.

What did you expect to see?

id: yesplease <no@thanks>     name:yesplease       mail:no@thanks      
id: yes@please                name:                mail:yes@please

What did you see instead?

id: yesplease <no@thanks>     name:yesplease       mail:no@thanks      
id: yes@please                name:yes@please      mail:            

(Now that I think of it, this might be a bad example as it misses the TLD e.g. please.com but it wouldn't recognize it as email either way)

@gopherbot gopherbot added this to the Unreleased milestone Jun 26, 2020
@notcdk notcdk changed the title x/crypto/openpgp E-mail address is not detected and misplaced into the name field x/crypto/openpgp: E-mail address is not detected and misplaced into the name field Jun 26, 2020
@cagedmantis
Copy link
Contributor

@cagedmantis cagedmantis commented Jun 26, 2020

@notcdk notcdk closed this Jun 26, 2020
@notcdk notcdk reopened this Jun 26, 2020
@notcdk
Copy link
Author

@notcdk notcdk commented Jun 26, 2020

Whoops miss click sorry

@FiloSottile
Copy link
Contributor

@FiloSottile FiloSottile commented Mar 29, 2021

Per the accepted #44226 proposal and due to lack of maintenance, the golang.org/x/crypto/openpgp package is now frozen and deprecated. No new changes will be accepted except for security fixes. The package will not be removed.

If this is a security issue, please email security@golang.org and we will assess it and provide a fix.

If you're looking for alternatives, consider the crypto/ed25519 package for simple signatures, golang.org/x/mod/sumdb/note for inline signatures, or filippo.io/age for encryption. You can read a summary of OpenPGP issues and alternatives here.

If you are required to interoperate with OpenPGP systems and need a maintained package, we suggest considering one of multiple community forks of golang.org/x/crypto/openpgp. We don't endorse any specific one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants