keybase-proofs 2.3.33 → 2.3.35

package/lib/schema3.js

@@ -1,16 +1,22 @@
-// Generated by IcedCoffeeScript 108.0.12
+// Generated by IcedCoffeeScript 108.0.11
 (function() {
-  var Array, Binary, Bool, ChainType, Dict, Int, KID, LinkType, Node, Object, Or, Path, PtkType, Seqno, String, StringEnum, Struct, Time, Value, mkerr, parse,
+  var Array, Binary, Bool, ChainType, Dict, Int, KID, LinkType, Node, Object, Or, Path, PtkType, Seqno, String, StringEnum, Struct, Time, Value, get_own, has_own, is_reserved_key_name, mkerr, parse, _ref,
     __hasProp = {}.hasOwnProperty,
     __extends = function(child, parent) { for (var key in parent) { if (__hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; },
     __indexOf = [].indexOf || function(item) { for (var i = 0, l = this.length; i < l; i++) { if (i in this && this[i] === item) return i; } return -1; };
 
   parse = require('./parse3');
 
+  _ref = require('./util'), has_own = _ref.has_own, get_own = _ref.get_own;
+
   mkerr = function(path, err) {
     return new Error("At " + (path.toString()) + ": " + err);
   };
 
+  is_reserved_key_name = function(k) {
+    return k === '__proto__';
+  };
+
   Path = (function() {
     function Path(v) {
       this._v = v || [];
@@ -84,7 +90,7 @@
         return null;
       }
       if (obj == null) {
-        mkerr(path, "value cannot be null");
+        return mkerr(path, "value cannot be null");
       }
       return checker._check({
         path: path,
@@ -100,15 +106,20 @@
     __extends(Dict, _super);
 
     function Dict(_arg) {
-      var keys;
+      var k, keys;
       keys = _arg.keys;
+      for (k in keys) {
+        if (is_reserved_key_name(k)) {
+          throw new Error("schema key name is not allowed: " + k);
+        }
+      }
       this._keys = keys;
       this._allow_extra_keys = false;
       Dict.__super__.constructor.apply(this, arguments);
     }
 
     Dict.prototype._check = function(_arg) {
-      var checker, err, k, new_path, obj, path, v, _ref;
+      var checker, err, k, new_path, obj, path, v, _ref1;
       path = _arg.path, obj = _arg.obj;
       if (!parse.is_dict(obj)) {
         return mkerr(path, "need a dictionary");
@@ -116,7 +127,10 @@
       for (k in obj) {
         v = obj[k];
         new_path = path.extend(k);
-        if ((checker = this._keys[k]) == null) {
+        if (is_reserved_key_name(k)) {
+          return mkerr(new_path, "key name is not allowed");
+        }
+        if ((checker = get_own(this._keys, k)) == null) {
           if (this._allow_extra_keys) {
             continue;
           }
@@ -130,11 +144,11 @@
           return err;
         }
       }
-      _ref = this._keys;
-      for (k in _ref) {
-        v = _ref[k];
+      _ref1 = this._keys;
+      for (k in _ref1) {
+        v = _ref1[k];
         new_path = path.extend(k);
-        if ((obj[k] == null) && !v.is_optional()) {
+        if (!has_own(obj, k) && !v.is_optional()) {
           return mkerr(new_path, "key is missing but is mandatory");
         }
       }
@@ -142,12 +156,12 @@
     };
 
     Dict.prototype.debug_localize = function(obj) {
-      var k, ret, v, _ref;
+      var k, ret, v, _ref1;
       ret = {};
-      _ref = this._keys;
-      for (k in _ref) {
-        v = _ref[k];
-        if (obj[k] != null) {
+      _ref1 = this._keys;
+      for (k in _ref1) {
+        v = _ref1[k];
+        if (has_own(obj, k)) {
           ret[v._name || k] = v.debug_localize(obj[k]);
         }
       }
@@ -155,6 +169,9 @@
     };
 
     Dict.prototype.set_key = function(k, v) {
+      if (is_reserved_key_name(k)) {
+        throw new Error("schema key name is not allowed: " + k);
+      }
       return this._keys[k] = v;
     };
 
@@ -282,7 +299,7 @@
       var bot, obj, path;
       path = _arg.path, obj = _arg.obj;
       if (this._convert && typeof obj === 'string') {
-        obj = Buffer.from(obj, 'hex');
+        obj = parse.decode_hex(obj);
       }
       if (!(Buffer.isBuffer(obj) && obj.length === this._len)) {
         return [mkerr(path, "value needs to be buffer of length " + this._len), null];
@@ -297,12 +314,12 @@
     };
 
     Binary.prototype._check = function(_arg) {
-      var err, obj, path, _, _ref;
+      var err, obj, path, _, _ref1;
       path = _arg.path, obj = _arg.obj;
-      _ref = this._convert_and_check({
+      _ref1 = this._convert_and_check({
         path: path,
         obj: obj
-      }), err = _ref[0], _ = _ref[1];
+      }), err = _ref1[0], _ = _ref1[1];
       return err;
     };
 
@@ -321,17 +338,17 @@
     }
 
     KID.prototype._check = function(_arg) {
-      var err, obj, path, typ, _ref, _ref1;
+      var err, obj, path, typ, _ref1, _ref2;
       path = _arg.path, obj = _arg.obj;
-      _ref = this._convert_and_check({
+      _ref1 = this._convert_and_check({
         path: path,
         obj: obj
-      }), err = _ref[0], obj = _ref[1];
+      }), err = _ref1[0], obj = _ref1[1];
       if (err != null) {
         return err;
       }
       typ = this._encryption ? [0x21] : [0x20, 0x01, 0x11, 0x13, 0x16];
-      if ((obj[0] !== 0x01) || (_ref1 = obj[1], __indexOf.call(typ, _ref1) < 0) || (obj.slice(-1)[0] !== 0x0a)) {
+      if ((obj[0] !== 0x01) || (_ref2 = obj[1], __indexOf.call(typ, _ref2) < 0) || (obj.slice(-1)[0] !== 0x0a)) {
         return mkerr(path, "value must be a KID" + (this._encryption ? ' (for encryption)' : ''));
       }
       return null;
@@ -431,12 +448,12 @@
     }
 
     String.prototype._check = function(_arg) {
-      var max_length, obj, path, _ref;
+      var max_length, obj, path, _ref1;
       path = _arg.path, obj = _arg.obj;
       if (typeof obj !== 'string' || obj.length === 0) {
         return mkerr(path, "value must be a string");
       }
-      if ((max_length = (_ref = this._args) != null ? _ref.max_length : void 0) != null) {
+      if ((max_length = (_ref1 = this._args) != null ? _ref1.max_length : void 0) != null) {
         if (obj.length > max_length) {
           return mkerr(path, "value length needs to be < " + max_length);
         }
@@ -457,6 +474,9 @@
       this._values = {};
       for (_i = 0, _len = values.length; _i < _len; _i++) {
         v = values[_i];
+        if (is_reserved_key_name(v)) {
+          throw new Error("enum value is not allowed: " + v);
+        }
         this._values[v] = true;
       }
     }
@@ -467,7 +487,7 @@
       if (typeof obj !== 'string') {
         return mkerr(path, "value must be a string");
       }
-      if (!this._values[obj]) {
+      if (!has_own(this._values, obj)) {
         return mkerr(path, "unknown enum value (" + obj + ")");
       }
       return null;
@@ -567,13 +587,13 @@
     }
 
     Or.prototype._check = function(_arg) {
-      var obj, ok, path, t, _i, _len, _ref;
+      var obj, ok, path, t, _i, _len, _ref1;
       path = _arg.path, obj = _arg.obj;
       ok = false;
-      _ref = this._terms;
-      for (_i = 0, _len = _ref.length; _i < _len; _i++) {
-        t = _ref[_i];
-        if (!(t.check(obj))) {
+      _ref1 = this._terms;
+      for (_i = 0, _len = _ref1.length; _i < _len; _i++) {
+        t = _ref1[_i];
+        if (!(!t.check(obj))) {
           continue;
         }
         ok = true;

package/lib/scrapers/twitter.js

@@ -113,7 +113,7 @@
         return (function(__iced_k) {
           __iced_deferrals = new iced.Deferrals(__iced_k, {
             parent: ___iced_passed_deferral,
-            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
             funcname: "TwitterScraper.hunt2"
           });
           _this._get_body_api({
@@ -174,7 +174,7 @@
     };
 
     TwitterScraper.prototype.users_lookup = function(_arg, cb) {
-      var batch_size, cursor_wait, dict, done, err, i, identifier, ids, include_entities, input_list, j, json, key, query, r, rc, res, responses, screen_names, u, ___iced_passed_deferral, __iced_deferrals, __iced_k;
+      var batch_size, cursor_wait, done, err, i, identifier, ids, include_entities, input_list, j, json, key, map, query, r, rc, res, responses, screen_names, u, ___iced_passed_deferral, __iced_deferrals, __iced_k;
       __iced_k = __iced_k_noop;
       ___iced_passed_deferral = iced.findDeferral(arguments);
       ids = _arg.ids, screen_names = _arg.screen_names, cursor_wait = _arg.cursor_wait, include_entities = _arg.include_entities;
@@ -222,7 +222,7 @@
               (function(__iced_k) {
                 __iced_deferrals = new iced.Deferrals(__iced_k, {
                   parent: ___iced_passed_deferral,
-                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
                   funcname: "TwitterScraper.users_lookup"
                 });
                 _this._get_body_api({
@@ -265,7 +265,7 @@
                                 (function(__iced_k) {
                                   __iced_deferrals = new iced.Deferrals(__iced_k, {
                                     parent: ___iced_passed_deferral,
-                                    filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+                                    filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
                                     funcname: "TwitterScraper.users_lookup"
                                   });
                                   setTimeout(__iced_deferrals.defer({
@@ -294,16 +294,16 @@
         return function() {
           var _i, _j, _len, _len1;
           if (responses != null ? responses.length : void 0) {
-            dict = {};
+            map = new Map;
             key = ids != null ? "id_str" : "screen_name";
             for (_i = 0, _len = responses.length; _i < _len; _i++) {
               r = responses[_i];
-              dict[r[key]] = r;
+              map.set(String(r[key]), r);
             }
             res = [];
             for (i = _j = 0, _len1 = input_list.length; _j < _len1; i = ++_j) {
               identifier = input_list[i];
-              res[i] = dict[identifier] || null;
+              res[i] = map.get(String(identifier)) || null;
             }
           }
           return cb(err, res);
@@ -351,7 +351,7 @@
               (function(__iced_k) {
                 __iced_deferrals = new iced.Deferrals(__iced_k, {
                   parent: ___iced_passed_deferral,
-                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
                   funcname: "TwitterScraper.get_follower_ids"
                 });
                 _this._get_body_api({
@@ -397,7 +397,7 @@
                                 (function(__iced_k) {
                                   __iced_deferrals = new iced.Deferrals(__iced_k, {
                                     parent: ___iced_passed_deferral,
-                                    filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+                                    filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
                                     funcname: "TwitterScraper.get_follower_ids"
                                   });
                                   setTimeout(__iced_deferrals.defer({
@@ -518,7 +518,7 @@
         return (function(__iced_k) {
           __iced_deferrals = new iced.Deferrals(__iced_k, {
             parent: ___iced_passed_deferral,
-            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
             funcname: "TwitterScraper.check_status"
           });
           _this._get_url_body({
@@ -605,7 +605,7 @@
         return (function(__iced_k) {
           __iced_deferrals = new iced.Deferrals(__iced_k, {
             parent: ___iced_passed_deferral,
-            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
             funcname: "TwitterScraper._get_bearer_token"
           });
           bt.get(__iced_deferrals.defer({
@@ -637,7 +637,7 @@
         return (function(__iced_k) {
           __iced_deferrals = new iced.Deferrals(__iced_k, {
             parent: ___iced_passed_deferral,
-            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
             funcname: "TwitterScraper._get_body_api"
           });
           _this._get_bearer_token(__iced_deferrals.defer({
@@ -670,7 +670,7 @@
               (function(__iced_k) {
                 __iced_deferrals = new iced.Deferrals(__iced_k, {
                   parent: ___iced_passed_deferral,
-                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/proofs/src/scrapers/twitter.iced",
+                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/scrapers/twitter.iced",
                   funcname: "TwitterScraper._get_body_api"
                 });
                 _this._get_url_body(args, __iced_deferrals.defer({

package/lib/subkey.js

@@ -90,7 +90,7 @@
                 (function(__iced_k) {
                   __iced_deferrals = new iced.Deferrals(__iced_k, {
                     parent: ___iced_passed_deferral,
-                    filename: "/Users/max/src/keybase/proofs/src/subkey.iced",
+                    filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/subkey.iced",
                     funcname: "SubkeyBase._v_generate"
                   });
                   _this.generate_json({
@@ -108,7 +108,7 @@
                   (function(__iced_k) {
                     __iced_deferrals = new iced.Deferrals(__iced_k, {
                       parent: ___iced_passed_deferral,
-                      filename: "/Users/max/src/keybase/proofs/src/subkey.iced",
+                      filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/subkey.iced",
                       funcname: "SubkeyBase._v_generate"
                     });
                     eng.box(msg, esc(__iced_deferrals.defer({
@@ -165,16 +165,16 @@
     };
 
     SubkeyBase.prototype._v_check = function(_arg, cb) {
-      var assert_pgp_hash, esc, json, ___iced_passed_deferral, __iced_deferrals, __iced_k;
+      var assert_pgp_hash, esc, json, pgp_max_length, ___iced_passed_deferral, __iced_deferrals, __iced_k;
       __iced_k = __iced_k_noop;
       ___iced_passed_deferral = iced.findDeferral(arguments);
-      json = _arg.json, assert_pgp_hash = _arg.assert_pgp_hash;
+      json = _arg.json, assert_pgp_hash = _arg.assert_pgp_hash, pgp_max_length = _arg.pgp_max_length;
       esc = make_esc(cb, "SubkeyBase::_v_check");
       (function(_this) {
         return (function(__iced_k) {
           __iced_deferrals = new iced.Deferrals(__iced_k, {
             parent: ___iced_passed_deferral,
-            filename: "/Users/max/src/keybase/proofs/src/subkey.iced",
+            filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/subkey.iced",
             funcname: "SubkeyBase._v_check"
           });
           SubkeyBase.__super__._v_check.call(_this, {
@@ -189,13 +189,14 @@
           (function(__iced_k) {
             __iced_deferrals = new iced.Deferrals(__iced_k, {
               parent: ___iced_passed_deferral,
-              filename: "/Users/max/src/keybase/proofs/src/subkey.iced",
+              filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/subkey.iced",
               funcname: "SubkeyBase._v_check"
             });
             _this.reverse_sig_check({
               json: json,
               new_km: _this.get_new_km(),
-              assert_pgp_hash: assert_pgp_hash
+              assert_pgp_hash: assert_pgp_hash,
+              pgp_max_length: pgp_max_length
             }, esc(__iced_deferrals.defer({
               lineno: 64
             })));
@@ -222,10 +223,10 @@
     };
 
     SubkeyBase.prototype.reverse_sig_check = function(_arg, cb) {
-      var a, assert_pgp_hash, b, eng, err, esc, json, new_km, payload, raw, rsk, sig, subkm, ___iced_passed_deferral, __iced_deferrals, __iced_k;
+      var a, assert_pgp_hash, b, eng, err, esc, json, new_km, payload, pgp_max_length, raw, rsk, sig, subkm, ___iced_passed_deferral, __iced_deferrals, __iced_k;
       __iced_k = __iced_k_noop;
       ___iced_passed_deferral = iced.findDeferral(arguments);
-      json = _arg.json, new_km = _arg.new_km, subkm = _arg.subkm, assert_pgp_hash = _arg.assert_pgp_hash;
+      json = _arg.json, new_km = _arg.new_km, subkm = _arg.subkm, assert_pgp_hash = _arg.assert_pgp_hash, pgp_max_length = _arg.pgp_max_length;
       new_km || (new_km = subkm);
       esc = make_esc(cb, "SubkeyBase::reverse_sig_check");
       err = null;
@@ -236,7 +237,7 @@
             (function(__iced_k) {
               __iced_deferrals = new iced.Deferrals(__iced_k, {
                 parent: ___iced_passed_deferral,
-                filename: "/Users/max/src/keybase/proofs/src/subkey.iced",
+                filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/subkey.iced",
                 funcname: "SubkeyBase.reverse_sig_check"
               });
               eng.unbox(sig, esc(__iced_deferrals.defer({
@@ -245,16 +246,17 @@
                     return raw = arguments[0];
                   };
                 })(),
-                lineno: 84
+                lineno: 86
               })), {
-                assert_pgp_hash: assert_pgp_hash
+                assert_pgp_hash: assert_pgp_hash,
+                pgp_max_length: pgp_max_length
               });
               __iced_deferrals._fulfill();
             })(function() {
               (function(__iced_k) {
                 __iced_deferrals = new iced.Deferrals(__iced_k, {
                   parent: ___iced_passed_deferral,
-                  filename: "/Users/max/src/keybase/proofs/src/subkey.iced",
+                  filename: "/Users/michal/SourceCode/keybase/go/src/github.com/keybase/keybase-proofs/src/subkey.iced",
                   funcname: "SubkeyBase.reverse_sig_check"
                 });
                 a_json_parse(raw, esc(__iced_deferrals.defer({
@@ -263,7 +265,7 @@
                       return payload = arguments[0];
                     };
                   })(),
-                  lineno: 85
+                  lineno: 87
                 })));
                 __iced_deferrals._fulfill();
               })(function() {

package/lib/util.js

@@ -1,6 +1,6 @@
 // Generated by IcedCoffeeScript 108.0.11
 (function() {
-  var Lock, bufeq_secure, constants, crypto, json_secure_compare, json_stringify_sorted, pack, v2_sig_type_from_sig_type, _ref;
+  var Lock, bufeq_secure, constants, crypto, get_own, has_own, json_secure_compare, json_stringify_sorted, pack, v2_sig_type_from_sig_type, _has_own, _ref;
 
   constants = require('./constants').constants;
 
@@ -10,6 +10,20 @@
 
   pack = require('purepack').pack;
 
+  _has_own = {}.constructor.prototype.hasOwnProperty;
+
+  exports.has_own = has_own = function(o, k) {
+    return _has_own.call(o, k);
+  };
+
+  exports.get_own = get_own = function(o, k) {
+    if (_has_own.call(o, k)) {
+      return o[k];
+    } else {
+      return void 0;
+    }
+  };
+
   exports.json_secure_compare = json_secure_compare = function(a, b) {
     var err, o1, o2, x, _ref1;
     _ref1 = (function() {

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "keybase-proofs",
-  "version": "2.3.33",
+  "version": "2.3.35",
   "description": "Publicly-verifiable proofs of identity",
   "main": "lib/main.js",
+  "files": [
+    "lib/",
+    "src/",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "test": "make test"
   },
@@ -27,7 +32,7 @@
     "iced-error": ">=0.0.9",
     "iced-lock": "^1.0.1",
     "iced-runtime": ">=0.0.1",
-    "kbpgp": ">=2.1.13",
+    "kbpgp": ">=2.1.20",
     "pgp-utils": ">=0.0.22",
     "purepack": "^1.0.4",
     "triplesec": ">=3.0.16"

package/src/alloc.iced

@@ -15,9 +15,9 @@ base = require './base'
 {PGPUpdate} = require './pgp_update'
 {UpdatePassphraseHash} = require './update_passphrase_hash'
 {UpdateSettings} = require './update_settings'
+{get_own} = require './util'
 team = require './team'
 team_hidden = require './team_hidden'
-wot = require './wot'
 
 #=======================================================
 
@@ -65,15 +65,13 @@ lookup_tab = {
   "team.kbfs"                      : team.KBFS
   "team.settings"                  : team.Settings
   "team.bot_settings"              : team.BotSettings
-  "wot.vouch"                      : wot.Vouch
-  "wot.react"                      : wot.React
 }
 
 #--------------------------------------------
 
 get_klass = (type, extra_lookup_tab) ->
   err = klass = null
-  unless (klass = extra_lookup_tab?[type])? or (klass = lookup_tab[type])?
+  unless (extra_lookup_tab? and (klass = get_own(extra_lookup_tab, type))?) or (klass = get_own(lookup_tab, type))?
     err = new Error "Unknown proof class: #{type}"
   [err, klass]
 

package/src/base.iced

@@ -76,7 +76,7 @@ compare_hash_buf_to_str = (b, s) ->
 
 class Verifier
 
-  constructor : ({@armored, @id, @short_id, @skip_ids, @make_ids, @strict, @now, @critical_clock_skew_secs, @skip_clock_skew_check, @inner, @outer, @expansions, @assert_pgp_hash, @require_packet_hash}, @sig_eng, @base) ->
+  constructor : ({@armored, @id, @short_id, @skip_ids, @make_ids, @strict, @now, @critical_clock_skew_secs, @skip_clock_skew_check, @inner, @outer, @expansions, @assert_pgp_hash, @require_packet_hash, @pgp_max_length}, @sig_eng, @base) ->
 
   #---------------
 
@@ -215,7 +215,9 @@ class Verifier
 
   _parse_and_process : ({armored}, cb) ->
     err = null
-    await @sig_eng.unbox armored, defer(err, payload, body), { @assert_pgp_hash, @require_packet_hash }
+    # pgp_max_length only applies to PGP messages since Keybase NaCl
+    # does not have a compression feature.
+    await @sig_eng.unbox armored, defer(err, payload, body), { @assert_pgp_hash, @require_packet_hash, @pgp_max_length }
     if not err? and not @skip_ids
       await @_check_ids body, defer err
     if not err? and @make_ids
@@ -244,7 +246,7 @@ class Verifier
       err = new Error "non-canonical JSON found in strict mode (#{errsan ours} v #{errsan json_str_utf8_trimmed})"
       return cb err
     await akatch (() -> expand_json({ json : json_tmp, expansions})), esc defer @json
-    await @base._v_check {@json, @assert_pgp_hash}, esc defer()
+    await @base._v_check {@json, @assert_pgp_hash, @pgp_max_length}, esc defer()
     cb null, @json, json_str_utf8
 
 #==========================================================================
@@ -659,6 +661,7 @@ class Base
   # @option obj {bool} strict Turn on all strict-mode checks
   # @option obj {bool} require_packet_hash Turn on if we require a packet hash
   # @option obj {Function} assert_pgp_hash Callback to reject specific PGP hash functions if encountered
+  # @option obj {number} pgp_max_length Max length of PGP message (after decompression)
   verify : (obj, cb) ->
     verifier = new Verifier obj, @sig_eng, @
     await verifier.verify defer err, json_obj, json_str

package/src/constants.iced

@@ -44,6 +44,8 @@ exports.constants = constants =
       kbfs : "team.kbfs"
       settings : "team.settings"
       bot_settings : "team.bot_settings"
+    # wot proofs are deprecated, but constants must remain available to kbweb
+    # because of existing signatures.
     wot :
       vouch : "wot.vouch"
       react : "wot.react"
@@ -83,6 +85,8 @@ exports.constants = constants =
       bot_settings: 48
     wallet :
       stellar : 15
+    # wot proofs are deprecated, but constants must remain available to kbweb
+    # because of existing signatures.
     wot :
       vouch : 16
       vouch_with_revoke : 17

package/src/main.iced

@@ -32,7 +32,6 @@ mods = [
   require('./scrapers/hackernews')
   require('./scrapers/generic_social')
   require('./errors')
-  require('./wot')
 ]
 
 for m in mods
@@ -44,4 +43,3 @@ exports.team = require('./team')
 exports.team_hidden = require('./team_hidden')
 exports.sig3 = require('./sig3')
 exports.schema = require('./schema3')
-exports.wot = require('./wot')

package/src/parse3.iced

@@ -15,10 +15,16 @@ exports.is_kid = (h) -> is_hex(h,35)
 exports.is_int = is_int = (s) ->
     n = Math.floor Number s
     return typeof(s) is 'number' and (n isnt Infinity) and (n is s) and n >= 0
+exports.decode_hex = decode_hex = (s) ->
+  return null unless typeof(s) is 'string'
+  buf = Buffer.from s, 'hex'
+  return null unless buf.toString('hex') is s.toLowerCase()
+  buf
 exports.is_hex = is_hex = (h, l) ->
   return false unless h?
-  if typeof(h) is 'string' then h = Buffer.from(h, 'hex')
-  else if not Buffer.isBuffer then return false
+  if typeof(h) is 'string'
+    return false unless (h = decode_hex(h))?
+  else if not Buffer.isBuffer(h) then return false
   return (h.length is l)
 exports.is_seqno = (s) ->
   return false unless s?
@@ -75,6 +81,6 @@ exports.is_chain_type = (x) ->
 exports.unhex = (b) ->
   if not b? then null
   else if Buffer.isBuffer(b) then b
-  else if typeof(b) is 'string' then Buffer.from(b, 'hex')
+  else if typeof(b) is 'string' and (h = decode_hex(b))? then h
   else throw new Error "bad binary or hex string"