Merge 8.0.x into 8.1.x before the 8.1.0 release - #401
Merged
Merged
Conversation
elliptic has no fix for GHSA-848j-6mx2-7j84 (wrong ECDSA signatures in some cases), and the SDK signs every request with it. - KeyUtils now signs with @noble/secp256k1 1.7.2 (CommonJS, no Node range change). Signatures are always low-S. - New KeyPair class keeps the elliptic methods the SDK and users call: getPrivate(), getPublic(), sign().toDER(), verify(). - Keys are parsed with bn.js 4.x, like elliptic did, so saved keys keep the same public key and SIN (hex of any length, Buffers, BN, and elliptic KeyPair objects). - getPrivate('hex') now always returns 64 chars. - Adds unit tests with vectors generated by elliptic 6.6.1.
Replace elliptic with @noble/secp256k1 1.7.x (8.1.0)
The setup script wrote the private key file with mode 0755 and the config file with the default mode (usually 0644). Both could be read by any local user. The config file holds the API tokens, and with the "plain text" option it also holds the private key. Both files are now written with mode 0600. If the file already exists from an earlier run, its permissions are tightened too, since the mode option of writeFile only applies when a file is created.
…issions Save the setup key and config files with owner-only permissions (IM-190)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the 16 commits merged into 8.0.x since 8.1.x was created, so 8.1.0 ships with them. Only dependency updates and dependabot.yml, no source changes. It also brings the brace-expansion fix, so the audit job passes on 8.1.x again.
Please merge with "Create a merge commit", not squash, so the next sync does not show these commits again.
Tested locally: npm ci, build, prettier, lint, unit (75/75), npm audit --audit-level=high