mailvelope / keyserver Goto Github PK

A simple OpenPGP public key server that validates email address ownership of uploaded keys.

License: GNU Affero General Public License v3.0

JavaScript 94.35% CSS 0.92% HTML 4.72%

keyserver's Introduction

Mailvelope

Mailvelope is a browser extension for Google Chrome and Firefox that allows secure email communication based on the OpenPGP standard. It can be configured to work with arbitrary Webmail provider.

OpenPGP backends

Mailvelope uses the following OpenPGP implementation

OpenPGP.js for the Chrome Extension and for the Firefox Addon

Installation

Mailvelope is available in the Chrome Web Store: https://chrome.google.com/webstore/detail/kajibbejlbohfaggdiogboambcijhkke

For Firefox you can get it from addons.mozilla.org: https://addons.mozilla.org/en/firefox/addon/mailvelope/

Or check the releases section for latest builds of Firefox and Chrome installation packages.

Client API

You can find the current API Documentation on GitHub pages. The version will correspond to the current master branch. A demo page with unit tests is available at: https://demo.mailvelope.com.

Build instructions

If you don’t have grunt installed, yet:

npm install -g grunt-cli

and then get and build the sources:

git clone https://github.com/mailvelope/mailvelope.git
cd mailvelope
npm ci && grunt prod

Chrome

grunt dist-cr

The Chrome extension will be in dist/mailvelope.chrome.zip.

Firefox

grunt dist-ff

The Firefox web extension will be in dist/mailvelope.firefox.zip.

Development

Update your local repository:

# inside mailvelope folder
git checkout dev
git pull origin dev && grunt
# continue with 'grunt dist-cr' or 'grunt dist-ff'

There are a few more tasks/tools available:

watch source code for changes and recompile if needed

grunt watch
test the firefox plugin
```
node_modules/web-ext/bin/web-ext run --source-dir=./build/firefox
```
It is possible to reload the plugin on changes, run the grunt watch task on another console terminal
reset repository

grunt clean

Website

https://www.mailvelope.com

Licence

Use of this source code is governed by the GNU AFFERO GENERAL PUBLIC LICENSE that can be found in the LICENSE file.

About

Contact: Thomas Oberndörfer [email protected] Twitter: @mailvelope Contributors: see list on GitHub

keyserver's People

Contributors

Stargazers

Watchers

Forkers

namxo rdavydov lucas-developer angelikass tatmush fork-for-review jbelke raimundojimenez jaxxstorm belavadi andrewnimmo gregorycoleman skuznetsov martin-v datolab hasandiwan svareille angusgyoung cqt-it-service gema-arta jmapd rosscdh approvers glor rodel-talampas mmmaxwwwell will7455 sitedata chez14 markrosenbaum ekmixon stradarius fp-forks danilogit acidburn0zzz mohammedessamhassan alxbnct kevindiffily holnet broeeee millabscorp suse ouadi gqadonis ejoftheweb jmosbacher rochemedia jigsaw77 dankakemu webzcc kkpan11 iriseden jimmylai2 umeshblader3

keyserver's Issues

allow update of key expiry date

Right now, in order to update a key's expiry date, you need to remove the key, and re-upload it with the new expiry-signatures.

It would be nice if the keyserver would detect these signatures, and update the key accordingly. User verification would not be required in my opinion as you need access to the private key in order to update the expiry date.

Unable to revoke key - Error! User id not found

Basically the above, I can't revoke a key with my email address, I get the follow error:

Error! User id not found

An in-range update of koa is breaking the build 🚨

Version 2.4.0 of koa was just published.

Branch	Build failing 🚨
Dependency	koa
Current Version	2.3.0
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

koa is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 27 commits.

418bb06 2.4.0 – added missing 2.3.0 changelog
c68a696 2.3.0
687b732 travis: test node@9
53a4446 expose the Application::handleRequest method (#950)
85ff544 deps: update min engines (#1040)
6029064 HTTP/2 has no status message (#1048) (#1049)
18e4faf Update fresh to ^0.5.2 to close vulnerability (#1086)
e8a024c docs: ddd Chinese docs link for v2.x (#1092)
1e81ea3 docs: update babel setup (#1077)
43a1df8 test: Remove --forceExit flag for Jest (#1071)
0168fd8 docs: Update middleware.gif (#1052)
e1e030c docs: command is wrong for running tests (#1065)
77ca429 test: replace request(app.listen()) with request(app.callback())
7f577af meta: update AUTHORS (#1067)
f3ede44 docs: fix dead link to logo image (#1069)

There are 27 commits in total.

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

keys hosted on keyserver are subject to flooding attack

It's possible to attach arbitrary third-party certifications to an already-validated OpenPGP certificates that are published on hkps://keys.mailvelope.com simply by uploading the augmented certificate to the "Manage Keys" web form. Some OpenPGP keyserver clients will reject too-large certificates when fetched from a keyserver.

This means that an anonymous user can attach garbage to an OpenPGP certificate, potentially bloating it in size beyond what clients will accept. If there is a limit to the quantity of third party certifications attachable to any given certificate, then the anonymous user can fill that limit, obstructing anyone else from attaching certifications.

This is a similar attack to one of the attacks that have been mounted against certificates hosted by the SKS keyserver network.

To fix the problem robustly, you'll either need to stop accepting third-party certifications entirely, or figure out some authorization scheme about which third-party certifications are acceptable for any given certificate. I'm happy to demonstrate the attack for any of the Mailvelope developers privately, and to talk over the options for mitigation of the issue.

sorry to be the bearer of bad news!

Button "Try it now" leads nowhere

Clicking on the button "Try it now" on the mailvelope keyserver's homepage (https://keys.mailvelope.com/) leads to a page not found (https://keys.mailvelope.com/ui.html) error.

Allow more configuration of HTTP headers (or just remove them)

https://github.com/mailvelope/keyserver/blob/master/src/app.js#L68
Currently keyserver adds a bunch of headers which are not really it's place to manage, especially if it's running behind a reverse proxy, which appears to be the intended scenario anyways.
For example, the current keyserver does not support serving HTTPS itself and yet it is setting HSTS and HPKP. IMO these should be handled by the reverse proxy. Any headers keyserver sets should be considered only for the [keyserver <-> reverse proxy] connection.

"User id not found" after verifying the Key with gmail in Firefox

I am using gmail and wanted to create a new key pair for sending emails.
I can receive the email to verify the key. After entering the password I receive a "User id not found" in the Firefox.
After that I tested the same procedure with Chromium. It works there.
So that isn't any bug of the operating system.

Link to "User id not found": https://keys.mailvelope.com/api/v1/key?op=verify&keyId=e060293bba13aefb&nonce=5c42fe37d73d48b2ae6f82f9bc457515

Firefox version: 60.2.2esr (64-Bit)
Operating System: openSUSE Leap 15.0

Lookup keys in DNS

RFC 7929. See mailvelope/mailvelope#412

Version 10 of node.js has been released

Version 10 of Node.js (code name Dubnium) has been released! 🎊

To see what happens to your code in Node.js 10, Greenkeeper has created a branch with the following changes:

Added the new Node.js version to your .travis.yml
The new Node.js version is in-range for the engines in 1 of your package.json files, so that was left alone

If you’re interested in upgrading this repo to Node.js 10, you can open a PR with these changes. Please note that this issue is just intended as a friendly reminder and the PR as a possible starting point for getting your code running on Node.js 10.

More information on this issue

Greenkeeper has checked the engines key in any package.json file, the .nvmrc file, and the .travis.yml file, if present.

engines was only updated if it defined a single version, not a range.
.nvmrc was updated to Node.js 10
.travis.yml was only changed if there was a root-level node_js that didn’t already include Node.js 10, such as node or lts/*. In this case, the new version was appended to the list. We didn’t touch job or matrix configurations because these tend to be quite specific and complex, and it’s difficult to infer what the intentions were.

For many simpler .travis.yml configurations, this PR should suffice as-is, but depending on what you’re doing it may require additional work or may not be applicable at all. We’re also aware that you may have good reasons to not update to Node.js 10, which is why this was sent as an issue and not a pull request. Feel free to delete it without comment, I’m a humble robot and won’t feel rejected 🤖

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

can't 'Upload Public Keys to Keyserver' from t'bird-enigmail

can't 'Upload Public Keys to Keyserver' from Enigmail
I get the response:
'Sending of keys failed'
Enigmail version 2.0.8 (20190203-0951)

Replace comment and version in armored header

Similar to:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: SKS 1.1.5
Comment: Hostname: keyserver.ubuntu.com

An in-range update of config is breaking the build 🚨

Version 1.29.1 of config was just published.

Branch	Build failing 🚨
Dependency	config
Current Version	1.29.0
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

config is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 4 commits.

e052e4e Fixed contributor tool bug and prepare for publish
035e650 Merge pull request #458 from electroma/437-reuse-existing-ts-handler
36dc3b0 Fixes #437
02c98b7 Changed contributors output format

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Problem using private server to import key

Hello dear team,

I've implemented Mailvelope Key Server from github on my private network and I'm using it together Mailvelope for Firefox (as a convention, whenever I quote Firefox, it should be interpreted as Mailvelope in Firefox; in addition, the key server configured and saved is my private server). So I'm having some problems. I thank you for some help:

First doubt is: I defined as a key server in Firefox, my private server. Also, I have exported to the key server some public keys to make tests. The problem is that when I'm going to import the server key using Firefox, this process does not work correctly (I think) because the server does not return a complete public key block; the server returns only the block like below:

information: 1: 1
Pub: 8A9B02981524A29C09585570B1EC5D10B5D256F8: 1: 2048: 1549892665 ::
uid: Regivaldo% 20G.% 20Costa% 20% 3Crcosta% 40rclabs.com.br% 3E :::

Next one is: using text encryption in Firefox, when I add a recipient stored on the key server, the public key is not found. I have monitored the server communication using tcpdump, but in no time, the Firefox package arrives. But even set the key as my private server, Firefox always does query to keys.mailvelope.com, never to my private server (except when I'm using the "Key Management -> Import Key" option and result is wrong like above.

Last one is: how I put the server to work using HTTPS. The only port listed when the server is started is the default, that is, the only port in listen is the 8888). I'm using the configuration shown in github, of course using my environment settings.

Thanks in advance for any help.

Kind regards.

Regivaldo Costa

Key Server Issues

Hello,

When I am trying to add my companies internal key server, it does not allow for a port to be added at the end of the address using a : . This pretty much makes the app useless for enterprise type environments wanting to test out your application addon.

When can we expect a fix?

GPG tools & mailvelope keyserver

How is one supposed to interact with the mailvelope keyserver via the gpg tools (command line). The usual command is:
gpg --keyserver hkps://keys.mailvelope.com --search-keys ...
if I use an email address which is uploaded on the mailvelope keyserver (eg. my own one) it doesn't find it. What am I doing wrong?

failure when uploading key

Hi,

after upload of key 6E0A 4E90 3241 34F0 2788 445D 044A 25F5 267D C236 the keyserver threw an error message that went something like "email could not be sent", reducing the key via gpg --armor --export-options export-minimal --export 6E0A4E90324134F02788445D044A25F5267DC236 resolved the issue.

My best guess would be that the issue is due to the attached photo user id, but it might be something else as reproduction with a random other key with photo id failed.

Sorry for vague error report. I will put better details when I set up my own mailvelope keyserver. But maybe this already helps to find the issue?

Sincerely,

Malte

Prevent serving off-site content

keyserver currently serves bootstrap.min.css and jquery-3.0.0.min.js from off-site.
For the paranoid, this is no good as the client browser will happily access these resources (sending referer headers and such).
After moving the resources to be local, the CSP ( https://github.com/mailvelope/keyserver/blob/master/src/app.js#L78 ) can be removed as well.

An in-range update of supertest is breaking the build 🚨

The devDependency supertest was updated from `3.3.0` to `3.4.0`.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

supertest is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push: The Travis CI build failed (Details).

Release Notes for v3.4.0

PR-532 - Packages updated, pipeline more explicit, documentation updated (thanks @rimiti)
PR-517 - Documentation updated (thanks @oprogramador)
PR-513 - Use more robust Array instance check (thanks @rubendg)

Commits

The new version differs by 14 commits.

5640ac9 3.4.0
60f8a9e Merge pull request #532 from visionmedia/v3.4.0
43bfae1 doc(History.md) changelog updated
fc1568d doc(README.md) cookie example added
3192d96 chore(package-lock.json) file updated
b3d271f chore(package.json) blocks reorganized, nock removed
aeae0f3 chore(.travis.yml) pipeline more explicit
53feddc chore(test/supertest.js) obscure test removed
50c59d6 Merge pull request #519 from oprogramador/patch-3
6ca3897 Merge pull request #517 from oprogramador/patch-2
0146d81 auth info in README
d853b37 fix typo in README
8158979 Merge pull request #513 from rubendg/use-isarray
550613b Use more robust Array instance check

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of winston is breaking the build 🚨

Version 2.4.0 of winston just got published.

Branch	Build failing 🚨
Dependency	winston
Current Version	2.3.1
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

winston is a direct dependency of this project this is very likely breaking your project right now. If other packages depend on you it’s very likely also breaking them.
I recommend you give this issue a very high priority. I’m sure you can resolve this 💪

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 18 commits.

ffe883e [dist] Version bump. 2.4.0
efb0ee2 [fix] Correct documentation mistake in 2.x
afffe1f Add how to colorize output in the custom formatter example (#989)
bb32267 [fix] Container.add() 'filters' and 'rewriters' option passing to logger (#1036)
4f95493 Fixed working of "humanReadableUnhandledException" parameter when additional data is added in meta (#1066)
aaa89af Added filtering by log level (#1040)
579b30c Fix grammatical error in “It's general properties are”: It's -> Its (#1029)
17f1010 Fix missing semicolon in README.md (#1082)
a14f6b0 Typo in transports.md (#1076)
bac951c regression brought by 2.3.1 (#1042)
9a57be3 Always decycle objects before cloning (#977)
57322d3 Update npmjs link in README
fcf04e1 Add label option to file transport docs
24300e2 added var declaration to startTimer() example
7e736b4 added winston.startTimer example

There are 18 commits in total.

See the full diff

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

An in-range update of mongodb is breaking the build 🚨

Version 2.2.32 of mongodb was just published.

Branch	Build failing 🚨
Dependency	mongodb
Current Version	2.2.31
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

mongodb is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 15 commits.

116c603 2.2.32
253a9a3 doc(changes): update changelog for v2.2.32
d2b0ff5 test(buffering): fix expectations of flakey tests
776b418 chore(package): update mongodb-core dependency
834a0e2 style(*): fix various minor typos throughout module
bf71053 doc(grid-fs): fixed spelling error
75dd442 docs(server): improve docs re: autoReconnect
2bb81ab style(collection): fix typo-ed internal fn name
d159eab fix(db): bubble up reconnectFailed event from Server topology
2d1fcfe doc(bulk): add param to documentation for BulkWriteResult.getWriteError
1f7954a chore(travis): remove 0.10/0.12 builds because of request semver
7bd839b fix(collection): allow passing noCursorTimeout as an option to find()
129d540 fix(cursor): hasNext should propagate errors when using callback
7cb2b7d test(cursor): update cursor tests to check for errors
beccc83 fix(aggregation): ensure that the cursor key is always present

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Show key information during "verified" step

Currently, when a user clicks on a link sent in the verification email it it just says:

Email address successfully verified!

It would be more user friendly to show data about the key (or at least the email address) being verified. Reason being, a user can "see" a result of the confirmation e.g. their key's data

Sign emails sent by keyserver

It seems natural to sign the messages being sent out :)
Luckily, the api used by keyserver claims to support this already: https://www.npmjs.com/package/nodemailer-openpgp
Adding signingKey to the call here https://github.com/mailvelope/keyserver/blob/master/src/email/email.js#L49 should do the trick.
The keyserver's public key can be hosted by the keyserver itself; the benefit of signing the message is just to give users more assurance of the origin of the message before they blindly click a link which has been sent to them.

can't find key from wingpg kleopatra

I'm using keys.mailvelope.com hkp protocol, but it can't find my key even though the website interface works fine.

Talking with GnuPG to keyserver

Perhaps I am stupid or this is a GnuPG issue:
As the keyserver should be HKP compatible, it should be possible to query a key with GnuPG.
Using GnuGP 2.2.5 I tried many variations of the command line (with hkp://, with https://, without prefix, with port, with no port, ...).
But I cannot get any key result.

Is it my fault or a GnuPG issue.

If it is my fault, please provide a command line for use with GnuPG.

Thanks

An in-range update of koa-static is breaking the build 🚨

Version 4.0.2 of koa-static was just published.

Branch	Build failing 🚨
Dependency	koa-static
Current Version	4.0.1
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

koa-static is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 3 commits.

e4e907d 4.0.2
2efdc31 fix: serve mutates opts argument so it cannot be reused (#117)
d8be914 docs: add option - setHeaders

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Support serving over HTTPS

I am new to node.js (so probably something better should be done), but I'm using the following on my server:

diff --git a/src/app.js b/src/app.js
index a37291f..4a14eef 100644
--- a/src/app.js
+++ b/src/app.js
@@ -30,6 +30,8 @@ const PGP = require('./service/pgp');
 const PublicKey = require('./service/public-key');
 const HKP = require('./route/hkp');
 const REST = require('./route/rest');
+const fs = require('fs');
+const https = require('https');
 
 let mongo, email, pgp, publicKey, hkp, rest;
 
@@ -123,7 +125,12 @@ function injectDependencies() {
 if (!global.testing) { // don't automatically start server in tests
   co(function *() {
     let app = yield init();
-    app.listen(config.server.port);
+    let https_options = {
+      key: fs.readFileSync('privkey.pem'),
+      cert: fs.readFileSync('cert.pem')
+    };
+    https.createServer(https_options, app.callback()).listen(config.server.port);
     log.info('app', 'Ready to rock! Listening on http://localhost:' + config.server.port);
   }).catch(err => log.error('app', 'Initialization failed!', err));
 }

This is because keyserver is running on a different machine than the reverse proxy (which has the HTTPS server actually talking to the browser client), and I wish to avoid the "https added and removed here" problem.

Cannot parse Curve 25519 PGP key

Moving between devices

I wondered if the private key can remain persistent - e.g. if I create a key on on device within my chrome browser and then logout and in at another device if this can follow me - my thought might be to have the key in a home drive or in the case of chrome os it link to a google drive location ?

presently when I move from one device to another I have to re-import my private key before I can send secure mail.

Howto deploy in a selfhosted scenario

Hi there,
maybe a little howto section for the steps to take when someone wants to host this nice piece of software on e.g. an Apache would be cool. Especially when the person is not that familiar with Javascript build/dependency mgmt. tools like npm.
Kind regards, David

Add email lookup via hkps://keys.mailvelope.com

It would be really great if you would add email lookup via hkp. I am using hkps://keys.mailvelope.com as keyserver in Enigmail but it doesn't find any keys.

Can you ensure that you won't expose user emails in future?

I don't upload my public key to a normal keyserver because this exposes my email address to spammers. Right now your keyserver perfectly prevents this as one can only lookup by email (and not by name, nor just syncing the whole database) -- can you ensure that you will stick to this behavior in future?

Allow lookup by key "name" value

It's really helpful to users to be able to lookup keys by name as well as email field!

An in-range update of openpgp is breaking the build 🚨

Version 2.5.11 of openpgp just got published.

Branch	Build failing 🚨
Dependency	openpgp
Current Version	2.5.10
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

openpgp is a direct dependency of this project this is very likely breaking your project right now. If other packages depend on you it’s very likely also breaking them.
I recommend you give this issue a very high priority. I’m sure you can resolve this 💪

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 5 commits.

417470d Release new version
75e5ce5 Merge pull request #586 from openpgpjs/webkit_subtle_fix
b756d35 use hash param in rsa key gen with webkit subtle
0fadd8e Merge pull request #582 from kellym/fix/key-expiration
c413d09 Replace expired subkeys with three other subkeys,

See the full diff

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

Synchronization of keys?

I haven't found anything on this topic. So is it possible to sync. keys from other keyserver with my instance of Mailvelope keyserver?
If not why?
If yes how?
Thanks.

MongoDB error while start

My system for deployment: Ubuntu 18.04 LTS

What I did so far:

Installed MongoDB for Ubuntu like described here: https://docs.mongodb.com/manual/tutorial/install-mongodb-on-ubuntu/
Created a MongoDB user for the keyserver database
Installed node like described here: https://github.com/nodesource/distributions/blob/master/README.md#installation-instructions
Cloned this repo
Set the configuration variables via npm config set <key> <value> -g as required (see: https://github.com/mailvelope/keyserver#production)
run npm start

This results in the following error message:

> [email protected] start /var/www/html/keyserver
> node index.js

info: cluster -> Forked worker #1 [pid:17830]
info: mongo -> Connecting to MongoDB ...
error: app -> Initialization failed!, MongoNetworkError: getaddrinfo EAI_AGAIN undefined

Cannot synchronize key

I was not able to synchronize one of my key from mailvelope saying the email could not be sent.

I went directly to https://keys.mailvelope.com/manage.html to upload it (after successfully uploading it to the ubuntu keyserver).

When pasting the following key I get error Error! Encrypting message for verification email failed.

I use gpg --armor --export BB6DE122BAC91D1260B68C73A82ED75A8DFC50A4 to export the key.

An in-range update of eslint is breaking the build 🚨

Version 4.6.0 of eslint just got published.

Branch	Build failing 🚨
Dependency	eslint
Current Version	4.5.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

As eslint is “only” a devDependency of this project it might not break production or downstream projects, but “only” your build or test tools – preventing new deploys or publishes.

I recommend you give this issue a high priority. I’m sure you can resolve this 💪

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Release Notes

v4.6.0

56dd769 Docs: fix link format in prefer-arrow-callback.md (#9198) (Vse Mozhet Byt)
6becf91 Update: add eslint version to error output. (fixes #9037) (#9071) (薛定谔的猫)
0e09973 New: function-paren-newline rule (fixes #6074) (#8102) (Teddy Katz)
88a64cc Chore: Make parseJsonConfig() a pure function in Linter (#9186) (Teddy Katz)
1bbac51 Fix: avoid breaking eslint-plugin-eslint-comments (fixes #9193) (#9196) (Teddy Katz)
3e8b70a Fix: off-by-one error in eslint-disable comment checking (#9195) (Teddy Katz)
73815f6 Docs: rewrite prefer-arrow-callback documentation (fixes #8950) (#9077) (Charles E. Morgan)
0d3a854 Chore: avoid mutating report descriptors in report-translator (#9189) (Teddy Katz)
2db356b Update: no-unused-vars Improve message to include the allowed patterns (#9176) (Eli White)
8fbaf0a Update: Add configurability to generator-star-spacing (#8985) (Ethan Rutherford)
8ed779c Chore: remove currentScopes property from Linter instances (refs #9161) (#9187) (Teddy Katz)
af4ad60 Fix: Handle error when running init without npm (#9169) (Gabriel Aumala)
4b94c6c Chore: make parse() a pure function in Linter (refs #9161) (#9183) (Teddy Katz)
1be5634 Chore: don't make Linter a subclass of EventEmitter (refs #9161) (#9177) (Teddy Katz)
e95af9b Chore: don't include internal test helpers in npm package (#9160) (Teddy Katz)
6fb32e1 Chore: avoid using private Linter APIs in astUtils tests (refs #9161) (#9173) (Teddy Katz)
de6dccd Docs: add documentation for Linter methods (refs #6525) (#9151) (Teddy Katz)
2d90030 Chore: remove unused assignment. (#9182) (薛定谔的猫)
d672aef Chore: refactor reporting logic (refs #9161) (#9168) (Teddy Katz)
5ab0434 Fix: indent crash on sparse arrays with "off" option (fixes #9157) (#9166) (Teddy Katz)
c147b97 Chore: Make SourceCodeFixer accept text instead of a SourceCode instance (#9178) (Teddy Katz)
f127423 Chore: avoid using private Linter APIs in Linter tests (refs #9161) (#9175) (Teddy Katz)
2334335 Chore: avoid using private Linter APIs in SourceCode tests (refs #9161) (#9174) (Teddy Katz)
2dc243a Chore: avoid using internal Linter APIs in RuleTester (refs #9161) (#9172) (Teddy Katz)
d6e436f Fix: no-extra-parens reported some parenthesized IIFEs (fixes #9140) (#9158) (Teddy Katz)
e6b115c Build: Add an edit link to the rule docs’ metadata (#9049) (Jed Fox)
fcb7bb4 Chore: avoid unnecessarily complex forEach calls in no-extra-parens (#9159) (Teddy Katz)
ffa021e Docs: quotes rule - when does \n require backticks (#9135) (avimar)
60c5148 Chore: improve coverage in lib/*.js (#9130) (Teddy Katz)

Commits

The new version differs by 31 commits.

8f01a99 4.6.0
c0acbf2 Build: changelog update for 4.6.0
56dd769 Docs: fix link format in prefer-arrow-callback.md (#9198)
6becf91 Update: add eslint version to error output. (fixes #9037) (#9071)
0e09973 New: function-paren-newline rule (fixes #6074) (#8102)
88a64cc Chore: Make parseJsonConfig() a pure function in Linter (#9186)
1bbac51 Fix: avoid breaking eslint-plugin-eslint-comments (fixes #9193) (#9196)
3e8b70a Fix: off-by-one error in eslint-disable comment checking (#9195)
73815f6 Docs: rewrite prefer-arrow-callback documentation (fixes #8950) (#9077)
0d3a854 Chore: avoid mutating report descriptors in report-translator (#9189)
2db356b Update: no-unused-vars Improve message to include the allowed patterns (#9176)
8fbaf0a Update: Add configurability to generator-star-spacing (#8985)
8ed779c Chore: remove currentScopes property from Linter instances (refs #9161) (#9187)
af4ad60 Fix: Handle error when running init without npm (#9169)
4b94c6c Chore: make parse() a pure function in Linter (refs #9161) (#9183)

There are 31 commits in total.

See the full diff

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

"Not Implemented" when searching mail domain

Hi,

This might be more of a feature request, but I noticed mailvelope keyserver does not return results when searching just the mail domain. If you search for gmail.com or any mail domain within the OpenPGP key lookup field, you get Not Implemented. I tried playing around with the mailvelope API, but got the same results. It would be great if searching by mail domain was implemented like SKS. Thanks for developing such a nice and modernized keyserver.

HKP machine-readable search output lists unverified User IDs

my OpenPGP certificate 0xC4BC2DDB38CCE96485EBE9C2F20691179038E5C6 has two User IDs, one of them using debian.org and one using fifthhorseman.net

I've uploaded it to keys.mailvelope.com but only clicked on the link in the verification message sent to the debian.org address.

When i search the keyserver via HKPS based on the fifthhorseman.net address, i get no responses. so far, so good.

But, when i look up via the debian.org address (i.e. https://keys.mailvelope.com/pks/lookup?op=index&options=mr&[email protected] ) the listing includes the unverified e-mail address as well:

info:1:1
pub:C4BC2DDB38CCE96485EBE9C2F20691179038E5C6::null:1547878146::
uid:Daniel%20Kahn%20Gillmor%20%3Cdkg%40fifthhorseman.net%3E:::
uid:Daniel%20Kahn%20Gillmor%20%3Cdkg%40debian.org%3E:::

When i actually choose to download (i.e. via https://keys.mailvelope.com/pks/lookup?op=get&options=mr&search=0xC4BC2DDB38CCE96485EBE9C2F20691179038E5C6 ) then i only get the verified User ID. So that's also good.

But given the expectation that users have of a validating keyserver, the machine-readable listing probably has no business displaying non-validated User IDs.

Use config/ to define the server host

I don't know if its possible to setup https within the project but I'm doing it through Apache2 proxy. It works fine until the emails sent have the wrong link.

The verification and removal link that arrives vía email always says:
http://localhost:8888
but the ideal link should be
https://keys.mydomain
Can you make the host or baseUrl configurable in config/ directory?

No able to verify the key

After I decrypt the link from the email provided by encrypted.asc
The api reply with "Invalid request!"

Doc not updated

Hello,

config/development.js has been removed but it's still in the doc, no informations about which config file is the good one & which syntax to use.

Please send verification e-mails using PGP/MIME

The verification e-mails are currently Inline PGP, which is problematic for a number of reasons, and difficult to parse safely. Please use RFC 3156-style PGP/MIME instead.

added a public key, got a mail, clicked verify -- keyserver doesn't have it

So i went to https://keys.mailvelope.com, clicked "try it now", uploaded a public key, got a verification link to my mail address (holger at merlinux eu), went to it and it all seemingly worked. But the keyserver's search does not find it. I can't add it a second time, it complains that it already has this key. Is this some temporary sync issue or a real bug?

Ubuntu 14.04 Install Issues

When running npm test:

> : ${NODE_ENV=development} && grunt test

Running "jshint:all" (jshint) task
>> 18 files lint free.

Running "jscs:src" (jscs) task
>> 18 files without code style errors.

Running "mochaTest:test" (mochaTest) task

/home/ubuntu/keyserver/test/unit/email-test.js:5
const expect = require('chai').expect;
^^^^^
>> Mocha exploded!
>> SyntaxError: Use of const in strict mode.
>>     at Module._compile (module.js:439:25)
>>     at Object.Module._extensions..js (module.js:474:10)
>>     at Module.load (/home/ubuntu/keyserver/node_modules/grunt/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
>>     at Function.Module._load (module.js:312:12)
>>     at Module.require (module.js:364:17)
>>     at require (module.js:380:17)
>>     at /home/ubuntu/keyserver/node_modules/mocha/lib/mocha.js:222:27
>>     at Array.forEach (native)
>>     at Mocha.loadFiles (/home/ubuntu/keyserver/node_modules/mocha/lib/mocha.js:219:14)
>>     at Mocha.run (/home/ubuntu/keyserver/node_modules/mocha/lib/mocha.js:487:10)
>>     at MochaWrapper.run (/home/ubuntu/keyserver/node_modules/grunt-mocha-test/tasks/lib/MochaWrapper.js:44:13)
>>     at /home/ubuntu/keyserver/node_modules/grunt-mocha-test/tasks/mocha-test.js:84:20
>>     at capture (/home/ubuntu/keyserver/node_modules/grunt-mocha-test/tasks/mocha-test.js:31:5)
>>     at Object.<anonymous> (/home/ubuntu/keyserver/node_modules/grunt-mocha-test/tasks/mocha-test.js:79:5)
>>     at Object.<anonymous> (/home/ubuntu/keyserver/node_modules/grunt/lib/grunt/task.js:255:15)
>>     at Object.thisTask.fn (/home/ubuntu/keyserver/node_modules/grunt/lib/grunt/task.js:73:16)
>>     at Object.<anonymous> (/home/ubuntu/keyserver/node_modules/grunt/lib/util/task.js:294:30)
>>     at Task.runTaskFn (/home/ubuntu/keyserver/node_modules/grunt/lib/util/task.js:244:24)
>>     at Task.<anonymous> (/home/ubuntu/keyserver/node_modules/grunt/lib/util/task.js:293:12)
>>     at /home/ubuntu/keyserver/node_modules/grunt/lib/util/task.js:220:11
>>     at process._tickDomainCallback (node.js:459:13)
Warning: Task "mochaTest:test" failed. Use --force to continue.

Aborted due to warnings.
npm ERR! weird error 3
npm WARN This failure might be due to the use of legacy binary "node"
npm WARN For further explanations, please read
/usr/share/doc/nodejs/README.Debian
 
npm ERR! not ok code 0

On current HEAD and trying with last release get same result.

An in-range update of mocha is breaking the build 🚨

Version 3.5.1 of mocha just got published.

Branch	Build failing 🚨
Dependency	mocha
Current Version	3.5.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

As mocha is “only” a devDependency of this project it might not break production or downstream projects, but “only” your build or test tools – preventing new deploys or publishes.

I recommend you give this issue a high priority. I’m sure you can resolve this 💪

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Release Notes

v3.5.1

3.5.1 / 2017-09-09

📰 News

📣 Mocha is now sponsoring PDXNode! If you're in the Portland area, come check out the monthly talks and hack nights!

🐛 Fixes

#2997: Fix missing xit export for "require" interface (@solodynamo)
#2957: Fix unicode character handling in XUnit reporter failures (@jkrems)

🔩 Other

#2986: Add issue and PR templates (@kungapal)
#2918: Drop bash dependency for glob-related tests (@ScottFreeCode)
#2922: Improve --compilers coverage (@ScottFreeCode)
#2981: Fix tpyos and spelling errors (@jsoref)

Commits

The new version differs by 14 commits.

4070a44 Release v3.5.1
466ba73 update CHANGELOG.md for v3.5.1 [ci skip]
1cc0fc0 import/require xit, fixes #2972
74fa66f update nyc to latest; remove workaround in travis script
aa52933 update coveralls strategy; closes #2984
73a5338 Spelling (#2981)
9f403bf Add utils.escape tests and fix unicode escaping
800acbc whitelist "developer-experience" tag for stalebot [ci skip]
5895671 Added issue, pull request templates. (#2869)
075bd51 Merge pull request #2918 from mochajs/no-shell-test
8710438 Work around Node 0.10 Windows flake when testing
13b8340 Ensure that compiler lookup works and not just that transpilation works (#2922)
26d337a Add tests for double-star behavior
c0e6b68 Eliminate glob.sh

See the full diff

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

https://keys.mailvelope.com is detected as down

Using my own instance of mailvelope's keyserver I ran into this error, checking and trying to add "https://keys.mailvelope.com" as keyserver in the firefox and chrome extension I found the same error so I think this is could be a problem with the implementation of hkp protocol?

thanks for the good work!

Auto Accept Keys without Verification?

We want to use the keyserver and have it automatically just accept the keys without e-mailing the user, is this easy to do?

HKP search should accept e-mail addresses within angle-brackets

gpg(1) says:

   --search-keys names
          Search  the  keyserver for the given names. Multiple names given
          here will be joined together to create the search string for the
          keyserver.   Option --keyserver must be used to give the name of
          this keyserver.  Keyservers that support different search  meth‐
          ods  allow  using the syntax specified in "How to specify a user
          ID" below.

[…]
HOW TO SPECIFY A USER ID
[…]
By exact match on an email address.
This is indicated by enclosing the email address in the usual
way with left and right angles.

     <[email protected]>

This suggests that users and scripts are likely to search keyservers for an e-mail address specifically by wrapping it in angle brackets.

However, the HKPS interface implemented by the mailvelope keyserver returns HTTP/1.1 501 Not Implemented when the search= query parameter is wrapped in angle-brackets.

Instead, it should accept searches wrapped in angle brackets and treat them the same as it would a comparable search that is not wrapped in angle brackets.

An in-range update of koa-router is breaking the build 🚨

Version 7.3.0 of koa-router was just published.

Branch	Build failing 🚨
Dependency	koa-router
Current Version	7.2.1
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

koa-router is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Commits

The new version differs by 24 commits.

81dc60a 7.3.0
da44991 7.3.0 changelog
da1f9e8 update history.md for 7.2.x
959072d update history.md for 7.2.x
2cbeb53 Merge pull request #396 from wachunei/add-query-params
9579168 Fix README formatting
c4348d5 README: Add Router#url() query params support description and examples
b381b12 Add Router#url() query params support
07d0d37 Improve query string tests
700be03 Add non-object params and query params test
9904aa5 Add query params support tests
bd9cbff Update .travis.yml
ac9e87d Merge pull request #384 from lagden/deps
1db1b18 Merge pull request #393 from jeffijoe/patch-1
db9c3e4 fix(readme): return next()

There are 24 commits in total.

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

mailvelope / keyserver Goto Github PK

keyserver's Introduction

Mailvelope

OpenPGP backends

Installation

Client API

Build instructions

Chrome

Firefox

Development

Website

Licence

About

keyserver's People

Contributors

Stargazers

Watchers

Forkers

keyserver's Issues

Version 2.4.0 of koa was just published.

Version 10 of Node.js (code name Dubnium) has been released! 🎊

Version 1.29.1 of config was just published.

The devDependency supertest was updated from 3.3.0 to 3.4.0.

Version 2.4.0 of winston just got published.

Version 2.2.32 of mongodb was just published.

Version 4.0.2 of koa-static was just published.

Version 2.5.11 of openpgp just got published.

Version 4.6.0 of eslint just got published.

Version 3.5.1 of mocha just got published.

3.5.1 / 2017-09-09

📰 News

🐛 Fixes

🔩 Other

Version 7.3.0 of koa-router was just published.

Recommend Projects

Recommend Topics

Recommend Org

The devDependency supertest was updated from `3.3.0` to `3.4.0`.