beaconcrypt 0.3.4__tar.gz → 0.3.6__tar.gz

beaconcrypt-0.3.6/.github/workflows/codeql.yml

@@ -0,0 +1,105 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '41 12 * * 5'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: go
+          build-mode: autobuild
+        - language: python
+          build-mode: none
+        - language: rust
+          build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - name: Run manual build steps
+      if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/.github/workflows/go.yml

@@ -2,6 +2,8 @@ name: Go Module
 
 on:
   push:
+    branches:
+      - main
     tags:
       - "[0-9]*.[0-9]*.[0-9]*"
 
@@ -83,6 +85,7 @@ jobs:
         run: go test ./...
 
   publish:
+    if: startsWith(github.ref, 'refs/tags/')
     needs: test
     runs-on: ubuntu-latest
     permissions:

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/.github/workflows/python.yml

@@ -10,6 +10,8 @@ name: Upload Python Package
 
 on:
   push:
+    branches:
+      - main
     tags:
       - "[0-9]*.[0-9]*.[0-9]*"
 
@@ -17,7 +19,7 @@ permissions:
   contents: read
 
 jobs:
-  sdist:
+  test:
     runs-on: ubuntu-latest
 
     steps:
@@ -33,8 +35,24 @@ jobs:
 
       - name: Run Python tests
         run: |
-          uv run --group dev maturin develop --bindings pyo3 --features pybinds
-          uv run --group dev pytest tests
+          uv run maturin develop --uv
+          uv run pytest tests
+
+  sdist:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - name: Set up Python
+        run: uv python install 3.14
+      - name: Install cap'n proto
+        run: |
+          sudo apt install capnproto
 
       - name: Build source distribution
         run: uvx maturin sdist --out dist
@@ -46,6 +64,8 @@ jobs:
           path: dist/
 
   wheels:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: test
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -74,6 +94,7 @@ jobs:
           path: dist/
 
   pypi-publish:
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     needs:
       - sdist

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/Cargo.lock

@@ -84,7 +84,7 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "beaconcrypt"
-version = "0.3.4"
+version = "0.3.6"
 dependencies = [
  "capnp",
  "capnpc",

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "beaconcrypt"
-version = "0.3.4"
+version = "0.3.6"
 edition = "2024"
 license-file = "LICENSE"
 readme = "README.md"

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: beaconcrypt
-Version: 0.3.4
+Version: 0.3.6
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/README.md

@@ -46,14 +46,29 @@ Test the C interface
 # Reference implementation
 I don't use rust a lot, so the code is probably fairly naive. It provides both a beacon and server implementation with C bindings through `cbindgen`. Ideally more bindings would be built on top of that so it can be used in the mythic server-side.
 
+The reference implementation expects that all beacons are compiled with the server's public key, and that beaconcrypt is initialized with it.
+
+The server is currently not very usable as it doesn't support saving the state of any individual beacon. This means that if your server goes down, you will not be able to communicate with any previously-registered beacons anymore. The server doesn't support being initialized with an Ed25519 seed (32 random bytes). Users wishing to use the server in practical cases should use this interface to ensure their server keeps its identity across reboots.
+
 ## Building
 You will need [Capn'Proto](https://capnproto.org/install.html) (just the binaries) and a recent version of rust for every build.
 
 For windows, I prefer building with stable-gnu for normal usage, and nightly-gnu for release builds. You can find the exact arguments I use to the the static library as small as possible in [release.yml](/.github\workflows\release.yml). The MSVC toolchain is expected to work just as well, I just like mingw.
 
+Build and run all tests:
+```bash
+cargo test
+cargo build --target x86_64-pc-windows-gnu
+go test ./...
+uv run maturin develop --uv
+uv run pytest tests
+```
+
 ## Profiles
 The reference implementation has two profiles: `PQXDH` and `CNSA2`. Profiles are controlled by cargo features. The CNSA2 profile only exists as a test for now. It uses a simple ML-KEM encapsulation for key exchange and the underlying libraries are not FIPS-approved. It is experimental and is likely broken. PQXDH is the intended target and the default.
 
+**CNSA2 is currently completely broken**
+
 ## Usage
 The reference implementation is a library that can currently be used either from rust or through C FFI. The C interface is currently not tested.
 

{beaconcrypt-0.3.4 → beaconcrypt-0.3.6}/beaconcrypt.go

@@ -33,7 +33,9 @@ beaconcrypt_go_buffer beaconcrypt_go_process_initial_message(void *handle, const
 beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_beacon(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_beacon_signed(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_decrypt_beacon_message(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_decrypt_beacon_message_signed(void *handle, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_server(void *handle, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_server_signed(void *handle, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_decrypt_server_message(void *handle, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_decrypt_server_message_signed(void *handle, const uint8_t *ptr, uintptr_t len);
 */
@@ -203,6 +205,15 @@ func (s *Server) DecryptBeaconMessage(keyID uint64, ciphertext []byte) ([]byte,
 	})
 }
 
+func (s *Server) DecryptBeaconMessageSigned(ciphertext []byte) ([]byte, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(ciphertext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_decrypt_beacon_message_signed(s.handle, ptr, len)
+	})
+}
+
 func (b *Beacon) EncryptToServer(plaintext []byte) ([]byte, error) {
 	if b == nil || b.handle == nil {
 		return nil, ErrClosed
@@ -212,6 +223,15 @@ func (b *Beacon) EncryptToServer(plaintext []byte) ([]byte, error) {
 	})
 }
 
+func (b *Beacon) EncryptToServerSigned(plaintext []byte) ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(plaintext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_encrypt_to_server_signed(b.handle, ptr, len)
+	})
+}
+
 func (b *Beacon) DecryptServerMessage(ciphertext []byte) ([]byte, error) {
 	if b == nil || b.handle == nil {
 		return nil, ErrClosed
@@ -240,10 +260,13 @@ func callUnary(data []byte, call func(*C.uint8_t, C.uintptr_t) C.beaconcrypt_go_
 }
 
 func copyBuffer(buffer C.beaconcrypt_go_buffer) ([]byte, error) {
-	if buffer.ptr == nil || buffer.len == 0 {
+	if buffer.ptr == nil {
 		return nil, ErrCrypto
 	}
 	defer C.beaconcrypt_go_free_buffer(buffer)
+	if buffer.len == 0 {
+		return []byte{}, nil
+	}
 	return C.GoBytes(unsafe.Pointer(buffer.ptr), C.int(buffer.len)), nil
 }