search

queicherius / asymmetric-crypto

Encryption and signing using public-key cryptography (via tweetnacl)
MIT License
15 stars 1 forks source link

An in-range update of tweetnacl is breaking the build 🚨 #11

Open greenkeeper[bot] opened 4 years ago

greenkeeper[bot] commented 4 years ago

The dependency tweetnacl was updated from 1.0.2 to 1.0.3.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

tweetnacl is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details - ❌ **continuous-integration/travis-ci/push:** The Travis CI build could not complete due to an error ([Details](https://travis-ci.org/queicherius/asymmetric-crypto/builds/648577719?utm_source=github_status&utm_medium=notification)).
Release Notes for Important security fix

IMPORTANT BUG FIX. Due to a bug in calculating carry in
modulo reduction that used bit operations on integers larger than
32 bits, nacl.sign or nacl.sign.detached could have created
incorrect signatures.

This only affects signing, not verification.

Thanks to @valerini on GitHub for finding and reporting the bug.

Commits

The new version differs by 4 commits.

See the full diff

FAQ and help There is a collection of [frequently asked questions](https://greenkeeper.io/faq.html). If those don’t help, you can always [ask the humans behind Greenkeeper](https://github.com/greenkeeperio/greenkeeper/issues/new).

Your Greenkeeper Bot :palm_tree:

greenkeeper[bot] commented 4 years ago

After pinning to 1.0.2 your tests are passing again. Downgrade this dependency 📌.