Mercurial > dropbear
view release.sh @ 1855:35d504d59c05
Implement server-side support for sk-ecdsa U2F-backed keys (#142)
* Implement server-side support for sk-ecdsa U2F-backed keys
* Fix out-of-bounds read on normal ecdsa-sha2-[identifier] keys
* Fix one more potential out-of-bounds read
* Check if nistp256 curve is used in sk-ecdsa-sha2- key
It's the only allowed curve per PROTOCOL.u2f specification
* Implement server-side support for sk-ed25519 FIDO2-backed keys
* Keys with type sk-* make no sense as host keys, so they should be
disabled
* fix typo
* Make sk-ecdsa call buf_ecdsa_verify
This reduces code duplication, the SK code just handles the
different message format.
* Reduce sk specific code
The application id can be stored in signkey, then we don't need
to call sk-specific functions from svr-authpubkey
* Remove debugging output, which causes compilation errors with DEBUG_TRACE disabled
* Proper cleanup of sk_app
Co-authored-by: Matt Johnston <[email protected]>
author | egor-duda <egor-duda@users.noreply.github.com> |
---|---|
date | Sat, 22 Jan 2022 16:53:04 +0300 |
parents | 209711833f15 |
children | 6110afb6f581 |
line wrap: on
line source
#!/bin/sh set -e VERSION=$(echo '#include "sysoptions.h"\necho DROPBEAR_VERSION' | cpp - | sh) echo Releasing version "$VERSION" ... if ! head -n1 CHANGES | grep -q $VERSION ; then echo "CHANGES needs updating" exit 1 fi if ! head -n1 debian/changelog | grep -q $VERSION ; then echo "debian/changelog needs updating" exit 1 fi head -n1 CHANGES if tar --version | grep -q 'GNU tar'; then TAR=tar else TAR=gtar fi RELDIR=$PWD/../dropbear-$VERSION ARCHIVE=${RELDIR}.tar.bz2 if test -e $RELDIR; then echo "$RELDIR exists" exit 1 fi if test -e $ARCHIVE; then echo "$ARCHIVE exists" exit 1 fi hg archive "$RELDIR" || exit 2 rm "$RELDIR/.hgtags" # .hg_archival.txt seems to differ between hg versions, isn't good for reproducibility rm "$RELDIR/.hg_archival.txt" RELDATE=$(head -n1 CHANGES | cut -d - -f 2) # timezone keeps it consistent, choose a plausible release time RELTIME="22:30:00 +0800" # from https://reproducible-builds.org/docs/archives/ TAROPTS="--sort=name --owner=0 --group=0 --numeric-owner" (cd "$RELDIR/.." && $TAR cjf $ARCHIVE $TAROPTS --mtime="$RELDATE $RELTIME" `basename "$RELDIR"`) || exit 2 ls -l $ARCHIVE openssl sha256 $ARCHIVE echo Done to echo "$ARCHIVE" echo Sign it with echo gpg2 --detach-sign -a -u F29C6773 "$ARCHIVE"