@libp2p/floodsub 11.0.25-3bf5d395c → 11.0.25-5459e136d

package/dist/src/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEtE,eAAO,MAAM,UAAU,yBAAyC,CAAA;AAEhE;;GAEG;AACH,wBAAsB,WAAW,CAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBpN;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4B9H;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAE,OAAO,EAAE,aAAa,GAAG,SAAS,CAoBnE"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEtE,eAAO,MAAM,UAAU,yBAAyC,CAAA;AAEhE;;GAEG;AACH,wBAAsB,WAAW,CAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBpN;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4B9H;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAE,OAAO,EAAE,aAAa,GAAG,SAAS,CAwBnE"}

package/dist/src/sign.js

@@ -63,12 +63,16 @@ export function messagePublicKey(message) {
     if (message.from == null) {
         throw new Error('Could not get the public key from the originator id');
     }
-    if (message.key != null) {
-        return message.key;
-    }
+    // an Ed25519/secp256k1 peer id embeds its own public key, so a key recovered
+    // from `from` is provably the author's; trust it over the supplied message.key
     if (message.from.publicKey != null) {
         return message.from.publicKey;
     }
+    // otherwise the supplied key must derive to the from peer id, else a message
+    // could be signed by one key while claiming a different author
+    if (message.key != null && message.from.equals(message.key.toMultihash().bytes)) {
+        return message.key;
+    }
     // We couldn't validate pubkey is from the originator, error
     throw new Error('Could not get the public key from the originator id');
 }

package/dist/src/sign.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAKzC,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;AAEhE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,UAAsB,EAAE,OAAkF,EAAE,MAA6C;IAC1L,2DAA2D;IAC3D,MAAM,aAAa,GAAkB;QACnC,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC;KACvC,CAAA;IAED,+DAA+D;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAA;IAEF,aAAa,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,aAAa,CAAC,GAAG,GAAG,UAAU,CAAC,SAAS,CAAA;IAExC,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAE,OAAsB,EAAE,MAA6C;IAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC;YACL,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,SAAS;SACf,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAExC,0BAA0B;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAE,OAAsB;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,CAAA;IACpB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAA;IAC/B,CAAC;IAED,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;AACxE,CAAC"}
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAKzC,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;AAEhE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,UAAsB,EAAE,OAAkF,EAAE,MAA6C;IAC1L,2DAA2D;IAC3D,MAAM,aAAa,GAAkB;QACnC,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC;KACvC,CAAA;IAED,+DAA+D;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAA;IAEF,aAAa,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,aAAa,CAAC,GAAG,GAAG,UAAU,CAAC,SAAS,CAAA;IAExC,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAE,OAAsB,EAAE,MAA6C;IAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC;YACL,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,SAAS;SACf,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAExC,0BAA0B;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAE,OAAsB;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAA;IAC/B,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,OAAO,CAAC,GAAG,CAAA;IACpB,CAAC;IAED,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;AACxE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@libp2p/floodsub",
-  "version": "11.0.25-3bf5d395c",
+  "version": "11.0.25-5459e136d",
   "description": "libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming (it just floods the network).",
   "license": "Apache-2.0 OR MIT",
   "homepage": "https://github.com/libp2p/js-libp2p/tree/main/packages/floodsub#readme",
@@ -54,12 +54,12 @@
     "test:electron-main": "aegir test -t electron-main"
   },
   "dependencies": {
-    "@libp2p/crypto": "5.1.21-3bf5d395c",
-    "@libp2p/interface": "3.2.5-3bf5d395c",
-    "@libp2p/interface-internal": "3.1.8-3bf5d395c",
-    "@libp2p/peer-collections": "7.0.23-3bf5d395c",
-    "@libp2p/peer-id": "6.0.12-3bf5d395c",
-    "@libp2p/utils": "7.2.4-3bf5d395c",
+    "@libp2p/crypto": "5.1.21-5459e136d",
+    "@libp2p/interface": "3.2.5-5459e136d",
+    "@libp2p/interface-internal": "3.1.8-5459e136d",
+    "@libp2p/peer-collections": "7.0.23-5459e136d",
+    "@libp2p/peer-id": "6.0.12-5459e136d",
+    "@libp2p/utils": "7.2.4-5459e136d",
     "it-length-prefixed": "^11.0.1",
     "main-event": "^1.0.1",
     "multiformats": "^14.0.0",
@@ -69,7 +69,7 @@
     "uint8arrays": "^6.1.1"
   },
   "devDependencies": {
-    "@libp2p/logger": "6.2.10-3bf5d395c",
+    "@libp2p/logger": "6.2.10-5459e136d",
     "@multiformats/multiaddr": "^13.0.3",
     "@types/sinon": "^21.0.1",
     "aegir": "^48.1.1",

package/src/sign.ts

@@ -80,14 +80,18 @@ export function messagePublicKey (message: SignedMessage): PublicKey {
     throw new Error('Could not get the public key from the originator id')
   }
 
-  if (message.key != null) {
-    return message.key
-  }
-
+  // an Ed25519/secp256k1 peer id embeds its own public key, so a key recovered
+  // from `from` is provably the author's; trust it over the supplied message.key
   if (message.from.publicKey != null) {
     return message.from.publicKey
   }
 
+  // otherwise the supplied key must derive to the from peer id, else a message
+  // could be signed by one key while claiming a different author
+  if (message.key != null && message.from.equals(message.key.toMultihash().bytes)) {
+    return message.key
+  }
+
   // We couldn't validate pubkey is from the originator, error
   throw new Error('Could not get the public key from the originator id')
 }