From 1c4d04c2089f719e8344f6c4f5cd8488c2320e9f Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 10:09:49 +0100 Subject: build(deps): update Bouncy Castle to 1.86 and PGPainless to 1.7.8 Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479, GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root resolution rule keeps every Bouncy Castle module on the catalog version; before, bcpg 1.77 shipped next to bcprov 1.78.1. The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by default, which the old one rejected as "non-standard AEAD". Drop the NonStandardAEAD error, its bottom sheet and strings, and replace the mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message that the tests now decrypt. The new fixture is a throwaway test key, so it is allowlisted in .gitleaksignore by fingerprint. Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so accepted every key that parsed, including keys with no encryption subkey. A signing-only key fixture now covers the rejection path. Also: migrate the removed SelectUserId.firstMatch and deprecated addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle META-INF/LICENSE.md in the APK, and move the existing InvalidPackage lint baseline entries to the bcpkix 1.86 jar. Co-Authored-By: Claude Opus 5.5 --- .../app/passwordstore/ui/crypto/DecryptActivity.kt | 21 +-------------------- app/src/main/res/values-de/strings.xml | 2 -- app/src/main/res/values-gl/strings.xml | 2 -- app/src/main/res/values-pl-rPL/strings.xml | 2 -- app/src/main/res/values-pt-rBR/strings.xml | 2 -- app/src/main/res/values/strings.xml | 2 -- 6 files changed, 1 insertion(+), 30 deletions(-) (limited to 'app/src') diff --git a/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt b/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt index 0d7f8dfb..8b2109bf 100644 --- a/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt +++ b/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt @@ -15,13 +15,11 @@ import androidx.lifecycle.lifecycleScope import app.passwordstore.Application.Companion.screenWasOff import app.passwordstore.R import app.passwordstore.crypto.PGPIdentifier -import app.passwordstore.crypto.errors.NonStandardAEAD import app.passwordstore.data.crypto.PGPPassphraseCache import app.passwordstore.data.passfile.PasswordEntry import app.passwordstore.data.password.FieldItem import app.passwordstore.databinding.DecryptLayoutBinding import app.passwordstore.ui.adapters.FieldItemAdapter -import app.passwordstore.ui.dialogs.BasicBottomSheet import app.passwordstore.util.auth.BiometricAuthenticator import app.passwordstore.util.auth.BiometricAuthenticator.Result as BiometricResult import app.passwordstore.util.extensions.getString @@ -255,24 +253,7 @@ class DecryptActivity : BasePGPActivity() { onSuccess() } else { logcat(ERROR) { result.error.stackTraceToString() } - when (result.error) { - is NonStandardAEAD -> { - BasicBottomSheet.Builder(this) - .setTitle(getString(R.string.aead_detect_title)) - .setMessage(getString(R.string.aead_detect_message, result.error.message)) - .setPositiveButtonClickListener(getString(R.string.dialog_ok)) { - setResult(RESULT_CANCELED) - finish() - } - .setOnDismissListener { - setResult(RESULT_CANCELED) - finish() - } - .build() - .show(supportFragmentManager, "AEAD_INFO_SHEET") - } - else -> decrypt(isError = true, authResult = authResult) - } + decrypt(isError = true, authResult = authResult) } } diff --git a/app/src/main/res/values-de/strings.xml b/app/src/main/res/values-de/strings.xml index 03576885..f577bd64 100644 --- a/app/src/main/res/values-de/strings.xml +++ b/app/src/main/res/values-de/strings.xml @@ -344,6 +344,4 @@ Keine Schlüssel importiert Es wurden noch keine PGP-Schlüssel in die App importiert. Wählen Sie eine Schlüsseldatei über die Schaltfläche \"Importieren\" aus. Freischalten des Passphrase-Zwischenspeichers - AEAD-Verschlüsselung festgestellt - %1$s, siehe https://passwordstore.app/fix-aead für weiterführende Informationen. diff --git a/app/src/main/res/values-gl/strings.xml b/app/src/main/res/values-gl/strings.xml index 791a6385..7d886c40 100644 --- a/app/src/main/res/values-gl/strings.xml +++ b/app/src/main/res/values-gl/strings.xml @@ -346,6 +346,4 @@ a app desde unha fonte de confianza, como a Play Store, Amazon Appstore, F-Droid Non se importaron chaves Aínda non hai chaves PGP importadas na app, preme no botón inferior para seleccionar un ficheiro de chave Desbloquear cache da frase de paso - Detectada cifraxe AEAD - %1$s, le https://passwordstore.app/fix-aead para ter máis información diff --git a/app/src/main/res/values-pl-rPL/strings.xml b/app/src/main/res/values-pl-rPL/strings.xml index 3907a0e5..f85577c5 100644 --- a/app/src/main/res/values-pl-rPL/strings.xml +++ b/app/src/main/res/values-pl-rPL/strings.xml @@ -330,6 +330,4 @@ Menedżer kluczy PGP Usunąć klucz? Nazwa zdalnej gałęzi - Wykryto szyfrowanie AEAD - %1$s, zobacz https://passwordstore.app/fix-aead aby uzyskać więcej informacji diff --git a/app/src/main/res/values-pt-rBR/strings.xml b/app/src/main/res/values-pt-rBR/strings.xml index 6f4b9ed9..0ba3d6eb 100644 --- a/app/src/main/res/values-pt-rBR/strings.xml +++ b/app/src/main/res/values-pt-rBR/strings.xml @@ -344,6 +344,4 @@ Nenhuma chave importada Não há chaves PGP importadas no aplicativo ainda, pressione o botão abaixo para escolher um arquivo de chave Desbloquear cache da senha - Criptografia AEAD detectada - %1$s, consulte https://passwordstore.app/fix-aead para obter mais informações diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml index e03e5319..b3f3e71c 100644 --- a/app/src/main/res/values/strings.xml +++ b/app/src/main/res/values/strings.xml @@ -384,7 +384,5 @@ No keys imported There are no PGP keys imported in the app yet, press the button below to pick a key file Unlock passphrase cache - AEAD encryption detected - %1$s, see https://passwordstore.app/fix-aead for more information Clear cached password on screen-off -- cgit v1.2.3