Stop formatting signers as raw private keys - #62
Closed
bajtos wants to merge 1 commit into
Closed
Conversation
Multikey signers are byte slices holding the private key, so passing one to a formatting verb writes the key material into the output. Two error messages in EncodeSignerToPEM did exactly that. Add identity.Signer, a wrapper whose String() returns the key DID, and use it wherever the identity package holds a signer. Fixing the type rather than the two call sites keeps future fmt and log calls safe. The same wrapper belongs on the multikey signer implementations in ucantone, which would cover every dependency at once; this change makes libforge safe in the meantime. Signed-off-by: Miroslav Bajto拧 <oss@bajtos.net> Assisted-by: Claude:claude-opus-5[1m]
Contributor
There was a problem hiding this comment.
Pull request overview
This PR prevents accidental leakage of private key material when multikey signers are formatted into error messages/logs by introducing a safe identity.Signer wrapper with a non-sensitive string representation (DID-based), and then using that wrapper throughout the identity package.
Changes:
- Add
identity.Signerwrapper aroundmultikey.Signerwith a safeString()implementation. - Wrap signers in
identity.NewandEncodeSignerToPEM, and return the wrapper fromDecodeSignerFromPEM. - Add tests ensuring formatting uses the key DID and that
EncodeSignerToPEMmarshal errors do not include raw key bytes.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| identity/signer.go | Introduces a signer wrapper intended to prevent private key bytes from being emitted via formatting. |
| identity/signer_test.go | Adds tests validating string/format behavior for the wrapper type. |
| identity/pem.go | Wraps signer arguments for safer error messages; changes DecodeSignerFromPEM to return the wrapper type. |
| identity/pem_test.go | Adds tests asserting error messages name signers by DID and avoid key-byte leakage. |
| identity/identity.go | Ensures identities created from generated/parsed keys use the wrapped signer type. |
馃挕 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+21
to
+27
| // Formatting verbs a signer may plausibly reach in an error message or a log | ||
| // line. None of them may print the private key. | ||
| var signerFormatVerbs = map[string]string{ | ||
| "%s": "%s", | ||
| "%v": "%s", | ||
| "%q": "%q", | ||
| } |
Comment on lines
+23
to
+27
| // String returns the DID of the signer's key. It never returns private key | ||
| // material. | ||
| func (s Signer) String() string { | ||
| return s.KeyDID().String() | ||
| } |
Comment on lines
39
to
42
| // DecodeSignerFromPEM loads a private key from a PKCS#8 PEM as a signer. | ||
| // Currently, only Ed25519 keys are supported. | ||
| func DecodeSignerFromPEM(pemData []byte) (multikey.Signer, error) { | ||
| func DecodeSignerFromPEM(pemData []byte) (Signer, error) { | ||
| var privateKey *crypto_ed25519.PrivateKey |
bajtos
marked this pull request as draft
August 12, 2026 12:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PLEASE CLOSE THIS PULL REQUEST IF YOU HAVE THE PERMISSIONS NEEDED.
Claude opened it on my behalf, and I don't have sufficient permissions to close it.
The fix will come via fil-forge/ucantone#48