keybase-proofs 2.3.34 → 2.3.35

package/src/base.iced

@@ -76,7 +76,7 @@ compare_hash_buf_to_str = (b, s) ->
 
 class Verifier
 
-  constructor : ({@armored, @id, @short_id, @skip_ids, @make_ids, @strict, @now, @critical_clock_skew_secs, @skip_clock_skew_check, @inner, @outer, @expansions, @assert_pgp_hash, @require_packet_hash}, @sig_eng, @base) ->
+  constructor : ({@armored, @id, @short_id, @skip_ids, @make_ids, @strict, @now, @critical_clock_skew_secs, @skip_clock_skew_check, @inner, @outer, @expansions, @assert_pgp_hash, @require_packet_hash, @pgp_max_length}, @sig_eng, @base) ->
 
   #---------------
 
@@ -215,7 +215,9 @@ class Verifier
 
   _parse_and_process : ({armored}, cb) ->
     err = null
-    await @sig_eng.unbox armored, defer(err, payload, body), { @assert_pgp_hash, @require_packet_hash }
+    # pgp_max_length only applies to PGP messages since Keybase NaCl
+    # does not have a compression feature.
+    await @sig_eng.unbox armored, defer(err, payload, body), { @assert_pgp_hash, @require_packet_hash, @pgp_max_length }
     if not err? and not @skip_ids
       await @_check_ids body, defer err
     if not err? and @make_ids
@@ -244,7 +246,7 @@ class Verifier
       err = new Error "non-canonical JSON found in strict mode (#{errsan ours} v #{errsan json_str_utf8_trimmed})"
       return cb err
     await akatch (() -> expand_json({ json : json_tmp, expansions})), esc defer @json
-    await @base._v_check {@json, @assert_pgp_hash}, esc defer()
+    await @base._v_check {@json, @assert_pgp_hash, @pgp_max_length}, esc defer()
     cb null, @json, json_str_utf8
 
 #==========================================================================
@@ -659,6 +661,7 @@ class Base
   # @option obj {bool} strict Turn on all strict-mode checks
   # @option obj {bool} require_packet_hash Turn on if we require a packet hash
   # @option obj {Function} assert_pgp_hash Callback to reject specific PGP hash functions if encountered
+  # @option obj {number} pgp_max_length Max length of PGP message (after decompression)
   verify : (obj, cb) ->
     verifier = new Verifier obj, @sig_eng, @
     await verifier.verify defer err, json_obj, json_str

package/src/subkey.iced

@@ -59,10 +59,10 @@ exports.SubkeyBase = class SubkeyBase extends Base
       err = new Error "Reverse sig json mismatch: #{a} != #{b}"
     return err
 
-  _v_check : ({json, assert_pgp_hash}, cb) ->
+  _v_check : ({json, assert_pgp_hash, pgp_max_length}, cb) ->
     esc = make_esc cb, "SubkeyBase::_v_check"
     await super { json }, esc defer()
-    await @reverse_sig_check { json, new_km: @get_new_km(), assert_pgp_hash }, esc defer()
+    await @reverse_sig_check { json, new_km: @get_new_km(), assert_pgp_hash, pgp_max_length }, esc defer()
     cb null
 
   _get_reverse_sig : (json) ->
@@ -73,7 +73,7 @@ exports.SubkeyBase = class SubkeyBase extends Base
     # body.sibkey.reverse_sig should be the only field different between the two
     outer.body[@get_key_field()].reverse_sig = null
 
-  reverse_sig_check : ({json, new_km, subkm, assert_pgp_hash}, cb) ->
+  reverse_sig_check : ({json, new_km, subkm, assert_pgp_hash, pgp_max_length}, cb) ->
 
     # For historical reasons, some people call 'new_km' 'subkm'
     new_km or= subkm
@@ -82,7 +82,9 @@ exports.SubkeyBase = class SubkeyBase extends Base
     err = null
     if (sig = @_get_reverse_sig(json))? and new_km?
       eng = new_km.make_sig_eng()
-      await eng.unbox sig, esc(defer(raw)), { assert_pgp_hash }
+      # pgp_max_length only applies to PGP messages since Keybase NaCl
+      # does not have a compression feature.
+      await eng.unbox sig, esc(defer(raw)), { assert_pgp_hash, pgp_max_length }
       await a_json_parse raw, esc defer payload
       rsk = new_km.get_ekid().toString('hex')
       if (err = @_match_json json, payload)? then # noop

package/.github/workflows/ci.yml

@@ -1,37 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-permissions:
-  contents: read # access to check out code and install dependencies
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [22, 24, 26]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build project
-        run: make build
-
-      - name: Run tests
-        run: make test-server