Switch to OpenPGP v5

conf/tsconfig.content_scripts.json

@@ -16,7 +16,9 @@
  "outDir": "../build/_/content_scripts",
  "baseUrl": "../extension",
  "paths": {
- "dompurify": ["types/purify.d.ts"]
+ "dompurify": ["types/purify.d.ts"],
+ "openpgp": ["../node_modules/openpgp/openpgp.d.ts"],
+ "@openpgp/web-stream-tools": ["../node_modules/@openpgp/web-stream-tools/web-stream-tools.d.ts"]
  },
  "typeRoots": ["../extension/types", "../extension/js/common/core/types"]
  },

conf/tsconfig.streams.json

@@ -0,0 +1,22 @@
+{
+ "compilerOptions": {
+ "target": "ES2020",
+ "lib": [
+ "es6",
+ "dom"
+ ],
+ "allowJs": true,
+ "alwaysStrict": true,
+ "noImplicitAny": true,
+ "strictNullChecks": true,
+ "allowSyntheticDefaultImports": true,
+ "esModuleInterop": true,
+ "module": "commonjs",
+ "sourceMap": true,
+ "outDir": "../build/streams",
+ "skipLibCheck": true
+ },
+ "include": [
+ "../node_modules/@openpgp/web-stream-tools/lib/*.js"
+ ]
+}

conf/tsconfig.test.json

@@ -10,7 +10,13 @@
  "module": "commonjs",
  "sourceMap": true,
  "outDir": "../build/test",
- "skipLibCheck": true
+ "skipLibCheck": true,
+ "paths": {
+ "@openpgp/web-stream-tools": [
+ "../node_modules/@openpgp/web-stream-tools/web-stream-tools.d.ts",
+ "../build/streams/streams.js"
+ ]
+ }
  },
  "files": [
  "../extension/types/node-forge.d.ts",

extension/chrome/dev/ci_unit_test.ts

@@ -20,6 +20,7 @@ import { Url } from '../../js/common/core/common.js';
 import * as forge from 'node-forge';
 import { Gmail } from '../../js/common/api/email-provider/gmail/gmail.js';
 import { PgpHash } from '../../js/common/core/crypto/pgp/pgp-hash.js';
+import { PgpArmor } from '../../js/common/core/crypto/pgp/pgp-armor.js';
 
 /**
  * importing all libs that are tested in ci tests
@@ -43,6 +44,7 @@ const libs: unknown[] = [
  Catch,
  Gmail,
  PgpHash,
+ PgpArmor,
 ];
 /* eslint-disable @typescript-eslint/no-explicit-any */
 // add them to global scope so ci can use them

extension/chrome/dev/export.ts

@@ -123,8 +123,8 @@ Catch.try(async () => {
  const pwd = prompt('Please enter encryption password');
  if (pwd) {
  print('encrypting..');
- const encrypted = await opgp.encrypt({ armor: false, message: opgp.message.fromBinary(data), passwords: [pwd] });
- save(encrypted.message.packets.write());
+ const encrypted = await opgp.encrypt({ format: 'binary', message: await opgp.createMessage({ binary: data }), passwords: [pwd] });
+ save(encrypted); // todo: test
  } else {
  save(data);
  }

extension/chrome/elements/compose-modules/formatters/encrypted-mail-msg-formatter.ts

@@ -233,23 +233,18 @@ export class EncryptedMsgMailFormatter extends BaseMailFormatter {
  return attachments;
  };
 
- private encryptDataArmor = async (
- data: Buf,
- pwd: string | undefined,
- pubs: PubkeyResult[],
- signingPrv?: Key
- ): Promise<PgpMsgMethod.EncryptAnyArmorResult> => {
+ private encryptDataArmor = async (data: Buf, pwd: string | undefined, pubs: PubkeyResult[], signingPrv?: Key): Promise<PgpMsgMethod.EncryptResult> => {
  const pgpPubs = pubs.filter(pub => pub.pubkey.family === 'openpgp');
  const encryptAsOfDate = await this.encryptMsgAsOfDateIfSomeAreExpiredAndUserConfirmedModal(pgpPubs);
  const pubsForEncryption = pubs.map(entry => entry.pubkey);
- return (await MsgUtil.encryptMessage({
+ return await MsgUtil.encryptMessage({
  pubkeys: pubsForEncryption,
  signingPrv,
  pwd,
  data,
  armor: true,
  date: encryptAsOfDate,
- })) as PgpMsgMethod.EncryptAnyArmorResult;
+ });
  };
 
  private getPwdMsgSendableBodyWithOnlineReplyMsgToken = async (

extension/chrome/elements/compose.ts

@@ -165,10 +165,9 @@ export class ComposeView extends View {
  const storage = await AcctStore.get(this.acctEmail, ['sendAs', 'hide_message_password', 'fesUrl']);
  this.clientConfiguration = await ClientConfiguration.newInstance(this.acctEmail);
  if (this.clientConfiguration.shouldHideArmorMeta()) {
- opgp.config.show_comment = false;
- opgp.config.show_version = false;
+ opgp.config.showComment = false;
+ opgp.config.showVersion = false;
  }
- opgp.initWorker({ path: '/lib/openpgp.worker.js' });
  this.pubLookup = new PubLookup(this.clientConfiguration);
  this.tabId = await BrowserMsg.requiredTabId();
  this.factory = new XssSafeFactory(this.acctEmail, this.tabId);

extension/chrome/settings/modules/my_key.ts

@@ -128,7 +128,7 @@ View.run(
  if (!(await Ui.modal.confirm(revokeConfirmMsg))) {
  return;
  }
- const revokedArmored = await KeyUtil.revoke(prv);
+ const revokedArmored = await KeyUtil.getOrCreateRevocationCertificate(prv);
  if (!revokedArmored) {
  await Ui.modal.error(`Could not produce revocation cert (empty)`);
  return;

extension/chrome/settings/setup.ts

@@ -126,8 +126,8 @@ export class SetupView extends View {
  this.storage.email_provider = this.storage.email_provider || 'gmail';
  this.clientConfiguration = await ClientConfiguration.newInstance(this.acctEmail);
  if (this.clientConfiguration.shouldHideArmorMeta() && typeof opgp !== 'undefined') {
- opgp.config.show_comment = false;
- opgp.config.show_version = false;
+ opgp.config.showComment = false;
+ opgp.config.showVersion = false;
  }
  this.pubLookup = new PubLookup(this.clientConfiguration);
  if (this.clientConfiguration.usesKeyManager() && this.idToken) {

extension/js/background_page/background_page.ts

@@ -6,7 +6,6 @@ import { GoogleAuth } from '../common/api/email-provider/gmail/google-auth.js';
 import { Bm, BrowserMsg } from '../common/browser/browser-msg.js';
 import { emailKeyIndex } from '../common/core/common.js';
 import { VERSION } from '../common/core/const.js';
-import { opgp } from '../common/core/crypto/pgp/openpgpjs-custom.js';
 import { ExpirationCache } from '../common/core/expiration-cache.js';
 import { processAndStoreKeysFromEkmLocally, getLocalKeyExpiration } from '../common/helpers.js';
 import { Catch } from '../common/platform/catch.js';
@@ -20,8 +19,6 @@ import { migrateGlobal, moveContactsToEmailsAndPubkeys, updateOpgpRevocations, u
 
 console.info('background_process.js starting');
 
-opgp.initWorker({ path: '/lib/openpgp.worker.js' });
-
 (async () => {
  let db: IDBDatabase;
  let storage: GlobalStoreDict;

extension/js/common/browser/browser-msg.ts

@@ -346,7 +346,7 @@ export class BrowserMsg {
  BrowserMsg.bgAddListener('pgpMsgDiagnosePubkeys', MsgUtil.diagnosePubkeys);
  BrowserMsg.bgAddListener('pgpMsgDecrypt', MsgUtil.decryptMessage);
  BrowserMsg.bgAddListener('pgpMsgVerifyDetached', MsgUtil.verifyDetached);
- BrowserMsg.bgAddListener('pgpMsgType', MsgUtil.type);
+ BrowserMsg.bgAddListener('pgpMsgType', async (r: Bm.PgpMsgType) => MsgUtil.type(r));
  BrowserMsg.bgAddListener('saveFetchedPubkeys', saveFetchedPubkeysIfNewerThanInStorage);
  BrowserMsg.bgAddListener('pgpKeyBinaryToArmored', async (r: Bm.PgpKeyBinaryToArmored) => ({
  keys: await KeyUtil.parseAndArmorKeys(r.binaryKeysData),

extension/js/common/core/crypto/key.ts

@@ -8,6 +8,7 @@ import { MsgBlockParser } from '../msg-block-parser.js';
 import { PgpArmor } from './pgp/pgp-armor.js';
 import { opgp } from './pgp/openpgpjs-custom.js';
 import { OpenPGPKey } from './pgp/openpgp-key.js';
+import type * as OpenPGP from 'openpgp';
 import { SmimeKey } from './smime/smime-key.js';
 import { MsgBlock } from '../msg-block.js';
 import { EmailParts } from '../common.js';
@@ -95,7 +96,7 @@ export interface KeyInfoWithIdentityAndOptionalPp extends KeyInfoWithIdentity {
 
 export type KeyAlgo = 'curve25519' | 'rsa2048' | 'rsa3072' | 'rsa4096';
 
-export type PrvPacket = OpenPGP.packet.SecretKey | OpenPGP.packet.SecretSubkey;
+export type PrvPacket = OpenPGP.SecretKeyPacket | OpenPGP.SecretSubkeyPacket;
 
 export class UnexpectedKeyTypeError extends Error {}
 
@@ -203,7 +204,7 @@ export class KeyUtil {
  allErr: Error[] = [];
  let uncheckedOpgpKeyCount = 0;
  try {
- const { keys, err } = await opgp.key.read(key);
+ const keys= await opgp.readKeys({ binaryKeys: key }); // todo: opgp.readKey ?
  uncheckedOpgpKeyCount = keys.length;
  for (const key of keys) {
  try {
@@ -221,9 +222,9 @@ export class KeyUtil {
  allErr.push(e as Error);
  }
  }
- if (err) {
+/* todo: re-throw? if (err) {
  allErr.push(...err);
- }
+ } */
  } catch (e) {
  allErr.push(e as Error);
  }
@@ -246,14 +247,21 @@ export class KeyUtil {
  throw new Error(err.length ? err.map((e, i) => i + 1 + '. ' + e.message).join('\n') : 'Should not happen: no keys and no errors.');
  };
 
- public static armor = (pubkey: Key): string => {
- const armored = (pubkey as unknown as { rawArmored: string }).rawArmored;
+ public static armor = (key: Key): string => {
+ const armored = (key as unknown as { rawArmored: string }).rawArmored;
  if (!armored) {
  throw new Error('The Key object has no rawArmored field.');
  }
  return armored;
  };
 
+ // remove crypto-library objects (useful when sending the object to/from background)
+ public static pack = (key: Key): void => {
+ if (key.family === 'openpgp') {
+ OpenPGPKey.pack(key);
+ }
+ };
+
  public static diagnose = async (key: Key, passphrase: string): Promise<Map<string, string>> => {
  let result = new Map<string, string>();
  result.set(`Key type`, key.family);
@@ -303,16 +311,17 @@ export class KeyUtil {
  };
 
  // todo - this should be made to tolerate smime keys
- public static normalize = async (armored: string): Promise<{ normalized: string; keys: OpenPGP.key.Key[] }> => {
+ public static normalize = async (type: 'publicKey' | 'privateKey', armored: string): Promise<{ normalized: string; keys: OpenPGP.Key[] }> => {
  try {
- let keys: OpenPGP.key.Key[] = [];
+ let keys: OpenPGP.Key[] = [];
  armored = PgpArmor.normalize(armored, 'key');
  if (RegExp(PgpArmor.headers('publicKey', 're').begin).test(armored)) {
- keys = (await opgp.key.readArmored(armored)).keys;
+ keys = await opgp.readKeys({ armoredKeys: armored });
  } else if (RegExp(PgpArmor.headers('privateKey', 're').begin).test(armored)) {
- keys = (await opgp.key.readArmored(armored)).keys;
+ keys = await opgp.readKeys({ armoredKeys: armored });
  } else if (RegExp(PgpArmor.headers('encryptedMsg', 're').begin).test(armored)) {
- keys = [new opgp.key.Key((await opgp.message.readArmored(armored)).packets)];
+ const packets = (await opgp.readMessage({ armoredMessage: armored })).packets;
+ keys = [type === 'publicKey' ? new opgp.PublicKey(packets) : new opgp.PrivateKey(packets)];
  }
  for (const k of keys) {
  for (const u of k.users) {
@@ -350,7 +359,7 @@ export class KeyUtil {
  public static decrypt = async (
  key: Key,
  passphrase: string,
- optionalKeyid?: OpenPGP.Keyid,
+ optionalKeyid?: OpenPGP.KeyID,
  optionalBehaviorFlag?: 'OK-IF-ALREADY-DECRYPTED'
  ): Promise<boolean> => {
  if (key.family === 'openpgp') {
@@ -385,11 +394,11 @@ export class KeyUtil {
  }
  };
 
- public static revoke = async (key: Key): Promise<string | undefined> => {
+ public static getOrCreateRevocationCertificate = async (key: Key): Promise<string | undefined> => {
  if (key.family === 'openpgp') {
- return await OpenPGPKey.revoke(key);
+ return await OpenPGPKey.getOrCreateRevocationCertificate(key);
  } else {
- throw new Error(`KeyUtil.revoke does not support key family ${key.family}`);
+ throw new Error(`KeyUtil.getOrCreateRevocationCertificate does not support key family ${key.family}`);
  }
  };