intra2net / paperbackup

Create a pdf with barcodes to backup text files on paper. Designed to backup ASCII-armored GnuPG and SSH key files and ciphertext.
MIT License
135 stars 17 forks source link

verification instructions fail on modern / secure imagemagick deployments #17

Open anarcat opened 1 year ago

anarcat commented 1 year ago

paperbackup suffers from the same limitation as qr-backup (https://github.com/za3k/qr-backup/issues/47) in that it relies on imagemagick (through zbar) to convert images into something zbar can grok.

this would normally be a bug in zbar more than your program, and there's kind of a workaround: as indicated in the above issue, poppler-utils ships with a pdftoppm program that can convert the pdf into a binary input zbar can parse easily. so this kind of works:

anarcat@angela:paperbackup$ pdftoppm example_output.pdf > example_output.ppm
anarcat@angela:paperbackup$ ./paperrestore.sh example_output.ppm | head -3
scanned 27 barcode symbols from 7 images in 0,48 seconds

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v2
anarcat@angela:paperbackup$ 

... but the verify bit doesn't work here:

anarcat@angela:paperbackup$ ./paperbackup-verify.sh example_output.ppm
scanned 27 barcode symbols from 7 images in 0,49 seconds

Syntax Warning: May not be a PDF file (continuing anyway)
Syntax Error (145): Command token too long
Syntax Error (273): Command token too long
Syntax Error: Couldn't find trailer dictionary
Syntax Error: Couldn't find trailer dictionary
Syntax Error: Couldn't read xref table
Creating diff:
diff: example_output: No such file or directory
scanned 27 barcode symbols from 7 images in 0,46 seconds

diff and sha256sums do NOT match!
restored sha256sum from PDF:  4adcea2856caf9a36ae5414587e64879be2d4328b0660df60b24f10212ea80ba
original sha256sum embedded: 

... because it assumes the file provided is a PDF which, fair enough, it's supposed to be. I think a simple fix to this could be to allow passing the original PDF file as well, or, better yet, compare against the actual original content somehow, which is something qr-backup does slightly better.