matrix-org / vodozemac

An implementation of Olm and Megolm in pure Rust.
Apache License 2.0
155 stars 29 forks source link

Allow the usage of git-trailers for changelog messages #165

Closed poljar closed 2 weeks ago

poljar commented 1 month ago

This PR modifies the way git-cliff parses commits and produces changelog entries, please take a look at the updated CONTRIBUTING.md file for more info.

In short, it allows us to write a commit like this:

fix: Use a constant-time Base64 encoder for secret key material

This patch fixes a security issue around a side-channel vulnerability[1]
when decoding secret key material using Base64.

In some circumstances an attacker can obtain information about secret
secret key material via a controlled-channel and side-channel attack.

This patch avoids the side-channel by switching to the base64ct crate
for the encoding, and more importantly, the decoding of secret key
material.

Security-Impact: Low
CVE: CVE-2024-40640
GitHub-Advisory: GHSA-j8cm-g7r6-hfpq

Changelog: Use a constant-time Base64 encoder for secret key material
to mitigate side-channel attacks leaking secret key material.

To produce a changelog entry like this:

### Security

- Use a constant-time Base64 encoder for secret key material to mitigate
  side-channel attacks leaking secret key material.
  (Low, [CVE-2024-40640](https://www.cve.org/CVERecord?id=CVE-2024-40640), [GHSA-j8cm-g7r6-hfpq](https://github.com/matrix-org/vodozemac/security/advisories/GHSA-j8cm-g7r6-hfpq))
Hywan commented 1 month ago

Looks great.

poljar commented 2 weeks ago

@dkasak do you want to take a look at this or should I merge?

codecov-commenter commented 2 weeks ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 90.55%. Comparing base (72f4235) to head (baf9cc9). Report is 1 commits behind head on main.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #165 +/- ## ======================================= Coverage 90.55% 90.55% ======================================= Files 34 34 Lines 1906 1906 ======================================= Hits 1726 1726 Misses 180 180 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

poljar commented 2 weeks ago

image