prefixed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "brownpaper"
-version = "0.2.0"
+version = "0.4.0"
 authors = ["shimun <shimun@shimun.net>"]
 edition = "2018"
 
@@ -16,7 +16,7 @@ rand = "0.4.2"
 
 byteorder = "1.3.2"
 chrono = "0.4.9"
-sequoia-openpgp = "0.9.0"
+sequoia-openpgp = "0.12.0"
 lazy_static = "1.4.0"
 c2-chacha = "0.2.2"
 sha2 = "0.8.0"

Dockerfile

@@ -1,9 +1,21 @@
+FROM rust:1.41.0 as builder
+
+COPY . /bp
+
+RUN apt update
+
+RUN apt install clang nettle-dev -y 
+
+RUN cargo install --path /bp --root /usr
+
 FROM debian:buster-slim
 
 VOLUME /snips
 
 EXPOSE 3000
 
-COPY bin/brownpaper /bin/
+COPY --from=builder /usr/bin/brownpaper /bin/
+
+WORKDIR /
 
 ENTRYPOINT [ "/bin/brownpaper" ]

bp.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+BP_ENDPOINT=${BROWNPAPER_ENDPOINT:-https://shimun.net/bp}
+CURL_ARGS="--write-out %{url_effective}\\n --silent -o /dev/null"
+GPG_ARGS="$([ ! -z "$BROWNPAPER_KEY" ] && echo "--local-user $BROWNPAPER_KEY")"
+if [ ! -z "$1" ]; then
+	printf "$1" | gpg --sign -a $GPG_ARGS | curl -s --data @-  -X POST $BP_ENDPOINT/new -Ls $CURL_ARGS
+else
+	gpg --sign -a $GPG_ARGS | curl -s --data @-  -X POST $BP_ENDPOINT/new -Ls $CURL_ARGS
+fi

default.nix

@@ -0,0 +1,25 @@
+{ pkgs ? import <nixpkgs> { }
+, callPackage ? pkgs.callPackage
+, stdenv ? pkgs.stdenv
+, fetchgit ? pkgs.fetchgit
+, name ? "brownpaper"
+, src ? (builtins.filterSource (path: type: baseNameOf path != "target") ./.)
+}:
+let
+  crate2nix_tools = import "${fetchgit { url = "https://github.com/kolloch/crate2nix.git"; rev = "adecff03c53b87255b3299f5a5787327342a69b2"; sha256 = "0l10yqa3gq73fc4xc977vb9zk5jlp70xiz5qd9c1vq873yqk1c7g"; }}/tools.nix" { inherit pkgs; };
+  overrides = pkgs.defaultCrateOverrides // rec {
+    nettle-sys = attrs: with pkgs; {
+      propagatedBuildInputs = [ clang nettle pkg-config ];
+      LIBCLANG_PATH = "${clang.cc.lib}/lib";
+    };
+    sequoia-openpgp = attrs: with pkgs; {
+      nativeBuildInputs = [ clang gmp pkg-config ];
+      LIBCLANG_PATH = "${clang.cc.lib}/lib";
+    };
+    brownpaper = sequoia-openpgp; # requires gmp as well
+  };
+  client = pkgs.writeShellScriptBin "brownpaper" ''
+    PATH=${pkgs.bash}/bin/:${pkgs.gnupg}/bin/:${pkgs.curl}/bin/:$PATH ${./bp.sh} "$@"
+  '';
+in
+{ server = callPackage (crate2nix_tools.generatedCargoNix { inherit name src; }) { inherit pkgs; };  inherit client; }

src/main.rs

@@ -21,18 +21,16 @@ use iron::url::Url;
 use iron::mime::Mime;
 use sha2::Digest;
 
+use std::env::{self, args};
 use std::io;
 use std::io::prelude::*;
 use std::iter::Iterator;
+use std::net::SocketAddr;
 use std::path::Path;
 use std::sync::Arc;
 use std::sync::Mutex;
 
-#[cfg(not(debug_assertions))]
-const STORAGE_DIR: &str = "/snips";
-
-#[cfg(debug_assertions)]
-const STORAGE_DIR: &str = "/tmp";
+const STORAGE_DIR: &str = "./snips";
 
 lazy_static! {
     static ref KNOWN_KEYS: Arc<Mutex<KnownKeys>> = Arc::new(Mutex::new(
@@ -44,7 +42,7 @@ const VERSION: &str = env!("CARGO_PKG_VERSION");
 
 fn handle(req: &mut Request) -> IronResult<Response> {
     println!("{}", req.url);
-    let storage = SnippetStorage::new(&Path::new(STORAGE_DIR));
+    let storage = SnippetStorage::new(&Path::new(&STORAGE_DIR));
     let segments: Vec<&str> = req.url.path();
     match (&req.method, segments.first()) {
         (Method::Get, Some(&"version")) => Ok(Response::with((iron::status::Ok, VERSION))),
@@ -127,5 +125,16 @@ fn handle(req: &mut Request) -> IronResult<Response> {
 fn main() {
     let chain = Chain::new(handle);
     println!("Starting brownpaper: {}", STORAGE_DIR);
-    Iron::new(chain).http("0.0.0.0:3000").unwrap();
+    Iron::new(chain).http(
+        args()
+            .skip(1)
+            .next()
+            .map(|ip| {
+                ip.parse::<SocketAddr>()
+                    .expect("can't parse socket address")
+            })
+            .unwrap_or("0.0.0.0:3000".parse::<SocketAddr>().unwrap())
+            .to_string()
+            .as_str(),
+    );
 }

src/pgp.rs

@@ -37,8 +37,32 @@ impl KnownKeys {
     pub fn verify(&mut self, r: impl Read) -> io::Result<Vec<u8>> {
         let mut content = Vec::with_capacity(2048);
         let helper = &*self;
-        let mut v = Verifier::<&KnownKeys>::from_reader(r, helper, None)
-            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, "Failed to verify signature"))?;
+        let mut v = Verifier::<&KnownKeys>::from_reader(r, helper, None).map_err(|e| {
+            io::Error::new(io::ErrorKind::InvalidData, "Failed to verify signature")
+        })?;
+        let mut buf = [0u8; 512];
+        let bp = "brownpaper".as_bytes();
+        loop {
+            match v.read(&mut buf)? {
+                0 => break,
+                read => {
+                    // first buffer read
+                    if content.len() == 0 {
+                        if !(buf.len() > bp.len() && bp == &buf[0..bp.len()]) {
+                            return Err(io::Error::new(
+                                io::ErrorKind::InvalidData,
+                                "Failed to verify signature(prefix)",
+                            ));
+                        } else {
+                            // remove prefix
+                            content.extend_from_slice(&buf[bp.len()..read])
+                        }
+                    } else {
+                        content.extend_from_slice(&buf[0..read]);
+                    }
+                }
+            }
+        }
         if v.read_to_end(&mut content).is_err() {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidData,