Add support for SRP Login

XcodesOrg / XcodesApp

The easiest way to install and switch between multiple versions of Xcode - with a mouse click.

MIT License

7.07k stars 310 forks source link

Add support for SRP Login #638

Closed abiligiri closed 4 weeks ago

abiligiri commented 4 weeks ago

Switch to use https://github.com/adam-fowler/swift-srp with some modifications that are local
- Pad g value to equal size of N while calculating clientProof
Use SHA256(plain-text-password) while computing key using PBKDF2
Added a unit test with some sample values

Fixes https://github.com/XcodesOrg/XcodesApp/issues/630

fiznool commented 4 weeks ago

Personally, I like the approach of using a well-tested library for SRP, and the upstream library seems to provide this. So I would be in favour of this implementation vs #639

If I can make a suggestion, forking adam-fowler/swift-srp and publishing as a separate package with the necessary changes would be my preference for the following reasons:

any changes to the upstream code can be more easily incorporated into a fork
the shared package can be consumed by the Xcodes app and cli

abiligiri commented 4 weeks ago

Note that both options use a library for SRP. This uses https://github.com/adam-fowler/swift-srp/blob/main/Sources/SRP/client.swift and #639 fixes the srp code that was already in repo most likely from https://github.com/Bouke/SRP. I see that Adam Fowler implementation is still active. Maybe that is another reason to use it.

@MattKiazyk I was able to download and install Xcode 16.1.0. Not sure what you mean by download doesn't work.

abiligiri commented 4 weeks ago

May I also request merging this for the release https://github.com/XcodesOrg/XcodesApp/pull/632

abiligiri commented 4 weeks ago

I cleaned this up a bit. Using patched swift-srp from https://github.com/abiligiri/swift-srp and removed local copy. I have also opened MR for upstream https://github.com/adam-fowler/swift-srp/pull/13

MattKiazyk commented 4 weeks ago

@abiligiri hope you don't mind I clean up some extra prints that were in there as well as moved the swift-srp dependency to an xcodes fork. I copied your changes from your branch into main on our fork.