Fix order in which fingerprints are evaluated (#415)

* Fix order in which fingerprints are evaluated

this needs to be done on the key generated from the provider, not at the start

* need to base32 encode instead of base64

* fix when .keyid doesn't exist

* fix error handling

---------

Co-authored-by: Lukasz Zajaczkowski <zreigz@gmail.com>

Author: michaeljguarino

cmd/plural/crypto.go

@@ -334,12 +334,16 @@ func handleUnlock(c *cli.Context) error {
 		return err
 	}
 
-	gitIndex, _ := filepath.Abs(filepath.Join(repoRoot, ".git", "index"))
-	dump, err := os.CreateTemp("", "index.bak")
+	// fixes Invalid cross-device link when using os.Rename
+	gitIndexDir, err := filepath.Abs(filepath.Join(repoRoot, ".git"))
+	if err != nil {
+		return err
+	}
+	gitIndex := filepath.Join(gitIndexDir, "index")
+	dump, err := os.CreateTemp(gitIndexDir, "index.bak")
 	if err != nil {
 		return err
 	}
-
 	if err := os.Rename(gitIndex, dump.Name()); err != nil {
 		return err
 	}

pkg/crypto/config.go

@@ -1,7 +1,6 @@
 package crypto
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
 
@@ -33,44 +32,45 @@ func ReadConfig() (conf *Config, err error) {
 	return
 }
 
-func Build() (Provider, error) {
+func Build() (prov Provider, err error) {
 	key, err := Materialize()
 	if err != nil {
-		return nil, err
+		return
 	}
 	keyID, err := GetKeyID()
 	if err != nil {
-		return nil, err
+		return
 	}
 
-	if err := validateKey(keyID, key); err != nil {
-		return nil, err
+	prov, err = fallbackProvider(key)
+	if err != nil {
+		return
 	}
-
 	if utils.Exists(configPath()) {
-		conf, err := ReadConfig()
+		var conf *Config
+		conf, err = ReadConfig()
 		if err != nil {
 			return fallbackProvider(key)
 		}
 
 		switch conf.Type {
 		case KEY:
-			return buildKeyProvider(conf, key)
+			prov, err = buildKeyProvider(conf, key)
 		case AGE:
-			return BuildAgeProvider()
+			prov, err = BuildAgeProvider()
+		}
+		if err != nil {
+			return
 		}
 	}
 
-	return fallbackProvider(key)
+	if keyID != "" && prov.ID() != keyID {
+		err = errFingerprint
+	}
+
+	return
 }
 
 func fallbackProvider(key *AESKey) (*KeyProvider, error) {
 	return &KeyProvider{key: key.Key}, nil
 }
-
-func validateKey(keyID string, key *AESKey) error {
-	if keyID != "" && key.ID() != keyID {
-		return fmt.Errorf("the key fingerprint doesn't match")
-	}
-	return nil
-}

pkg/crypto/config_test.go

@@ -21,14 +21,14 @@ func TestBuild(t *testing.T) {
 		{
 			name:       `when faulty config exists create default fallbackProvider`,
 			keyContent: "key: abc",
-			expected:   "SHA256:ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=",
+			expected:   "SHA256:XJ4BNP4PAHH6UQKBIDPF3LRCEOYAGYNDSYLXVHFUCD7WD4QACWWQ====",
 			genConfig:  true,
 		},
 		{
 			name:       `when config doesn't exist create default fallbackProvider`,
 			genConfig:  false,
 			keyContent: "key: abc",
-			expected:   "SHA256:ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=",
+			expected:   "SHA256:XJ4BNP4PAHH6UQKBIDPF3LRCEOYAGYNDSYLXVHFUCD7WD4QACWWQ====",
 		},
 	}
 	for _, test := range tests {

pkg/crypto/errors.go

@@ -0,0 +1,7 @@
+package crypto
+
+import "fmt"
+
+var (
+	errFingerprint = fmt.Errorf("The fingerprint of your encryption key does not match this repos key, we cannot safely decrypt")
+)

pkg/crypto/key.go

@@ -31,7 +31,7 @@ func (prov *KeyProvider) SymmetricKey() ([]byte, error) {
 
 func (prov *KeyProvider) ID() string {
 	sha := sha256.Sum256([]byte(prov.key))
-	return "SHA256:" + base64.StdEncoding.EncodeToString(sha[:])
+	return "SHA256:" + base32.StdEncoding.EncodeToString(sha[:])
 }
 
 func (prov *KeyProvider) Marshall() ([]byte, error) {
@@ -172,7 +172,6 @@ func GetKeyID() (string, error) {
 		return "", err
 	}
 	return k.KeyID, nil
-
 }
 
 func CreateKeyFingerprintFile() error {