{"action":"created","issue":{"url":"https://api.github.com/repos/pre-commit/pre-commit-hooks/issues/339","repository_url":"https://api.github.com/repos/pre-commit/pre-commit-hooks","labels_url":"https://api.github.com/repos/pre-commit/pre-commit-hooks/issues/339/labels{/name}","comments_url":"https://api.github.com/repos/pre-commit/pre-commit-hooks/issues/339/comments","events_url":"https://api.github.com/repos/pre-commit/pre-commit-hooks/issues/339/events","html_url":"https://github.com/pre-commit/pre-commit-hooks/issues/339","id":383294897,"node_id":"MDU6SXNzdWUzODMyOTQ4OTc=","number":339,"title":"Ban unarmored GPG keys","user":{"login":"rpdelaney","id":1139517,"node_id":"MDQ6VXNlcjExMzk1MTc=","avatar_url":"https://avatars1.githubusercontent.com/u/1139517?v=4","gravatar_id":"","url":"https://api.github.com/users/rpdelaney","html_url":"https://github.com/rpdelaney","followers_url":"https://api.github.com/users/rpdelaney/followers","following_url":"https://api.github.com/users/rpdelaney/following{/other_user}","gists_url":"https://api.github.com/users/rpdelaney/gists{/gist_id}","starred_url":"https://api.github.com/users/rpdelaney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rpdelaney/subscriptions","organizations_url":"https://api.github.com/users/rpdelaney/orgs","repos_url":"https://api.github.com/users/rpdelaney/repos","events_url":"https://api.github.com/users/rpdelaney/events{/privacy}","received_events_url":"https://api.github.com/users/rpdelaney/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-11-21T21:16:53Z","updated_at":"2018-11-21T23:10:37Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"In #329 we added a ban for ASCII-armored GPG private keys. But as far as I can tell we don't have a method for detecting un-armored private keys, since they resemble unstructured binary data.\r\n\r\n```\r\n$ gpg --export-secret-keys > secrets\r\n$ file -I secrets\r\nsecrets: application/octet-stream; charset=binary\r\n```\r\nHowever, that doesn't mean they can't be identified (evidently):\r\n```\r\n$ file secrets \r\nsecrets: PGP    Secret Key - 4096b created on Sun Nov 17 19:37:04 2013 - RSA (Encrypt or Sign) e=65537 hashed AES with 128-bit key Salted&Iterated S2K SHA-11\r\n```\r\nIt looks like the mime-type for PGP keys is defined here: https://tools.ietf.org/html/rfc3156\r\n\r\n---\r\n\r\nThis leads to a fork in the road for implementation:\r\n\r\n#### We could make a subprocess call to `file`. \r\n\r\nI don't like this for portability reasons. We don't know that `file` exists and behaves consistently everywhere pre-commit will be deployed.\r\n\r\n#### We could use the `magic` library. \r\nThis works:\r\n```\r\n$ python3\r\nPython 3.7.1 (default, Nov  6 2018, 18:45:35) \r\n[Clang 10.0.0 (clang-1000.11.45.5)] on darwin\r\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\r\n>>> import magic\r\n>>> mime = magic.Magic()\r\n>>> mime.from_file('secrets')\r\n'PGP\\\\011Secret Key - 4096b created on Sun Nov 17 19:37:04 2013 - RSA (Encrypt or Sign) e=65537 hashed AES with 128-bit key Salted&Iterated S2K SHA-1'\r\n```\r\nBut it adds a dependency on a non-standard library: `python-magic`.\r\n\r\n#### We could try to emulate the mimetype matching ourselves.\r\n\r\nReinvents a wheel and the consequences of getting it wrong when users trust us to get it right could be bad.\r\n\r\n---\r\n\r\nWhat do you think?"},"comment":{"url":"https://api.github.com/repos/pre-commit/pre-commit-hooks/issues/comments/440843642","html_url":"https://github.com/pre-commit/pre-commit-hooks/issues/339#issuecomment-440843642","issue_url":"https://api.github.com/repos/pre-commit/pre-commit-hooks/issues/339","id":440843642,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MDg0MzY0Mg==","user":{"login":"asottile","id":1810591,"node_id":"MDQ6VXNlcjE4MTA1OTE=","avatar_url":"https://avatars3.githubusercontent.com/u/1810591?v=4","gravatar_id":"","url":"https://api.github.com/users/asottile","html_url":"https://github.com/asottile","followers_url":"https://api.github.com/users/asottile/followers","following_url":"https://api.github.com/users/asottile/following{/other_user}","gists_url":"https://api.github.com/users/asottile/gists{/gist_id}","starred_url":"https://api.github.com/users/asottile/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asottile/subscriptions","organizations_url":"https://api.github.com/users/asottile/orgs","repos_url":"https://api.github.com/users/asottile/repos","events_url":"https://api.github.com/users/asottile/events{/privacy}","received_events_url":"https://api.github.com/users/asottile/received_events","type":"User","site_admin":false},"created_at":"2018-11-21T23:10:37Z","updated_at":"2018-11-21T23:10:37Z","author_association":"MEMBER","body":"ban entirely seems fine to me"}}
{"actor":{"display_login":"asottile"}}