support add photo

openpgp/keys.go

@@ -32,6 +32,7 @@ type Entity struct {
 	Subkeys       []Subkey
 	SelfSignature *packet.Signature   // Direct-key self signature of the PrimaryKey (contains primary key properties in v6)
 	Signatures    []*packet.Signature // all (potentially unverified) self-signatures, revocations, and third-party signatures
+	UserAttribute []*UserAttribute
 }
 
 // An Identity represents an identity claimed by an Entity and zero or more
@@ -44,6 +45,13 @@ type Identity struct {
 	Signatures    []*packet.Signature // all (potentially unverified) self-signatures, revocations, and third-party signatures
 }
 
+type UserAttribute struct {
+	UserAttribute *packet.UserAttribute
+	SelfSignature *packet.Signature
+	Revocations   []*packet.Signature
+	Signatures    []*packet.Signature // all (potentially unverified) self-signatures, revocations, and third-party signatures
+}
+
 // A Subkey is an additional public key in an Entity. Subkeys can be used for
 // encryption.
 type Subkey struct {
@@ -491,6 +499,10 @@ EachPacket:
 		}
 
 		switch pkt := p.(type) {
+		case *packet.UserAttribute:
+			if err := addUserAttribute(e, packets, pkt); err != nil {
+				return nil, err
+			}
 		case *packet.UserId:
 			if err := addUserID(e, packets, pkt); err != nil {
 				return nil, err
@@ -726,6 +738,37 @@ func (e *Entity) serializePrivate(w io.Writer, config *packet.Config, reSign boo
 			}
 		}
 	}
+
+	for _, uat := range e.UserAttribute {
+		if reSign {
+			UserAttribute := uat.UserAttribute
+
+			err = UserAttribute.Serialize(w)
+			if err != nil {
+				return
+			}
+
+			if uat.SelfSignature == nil {
+				return goerrors.New("openpgp: can't re-sign identity without valid self-signature")
+			}
+			err = uat.SelfSignature.SignUserAttribute(UserAttribute, e.PrimaryKey, e.PrivateKey, config)
+			if err != nil {
+				return
+			}
+		} else {
+			err = uat.UserAttribute.Serialize(w)
+			if err != nil {
+				return
+			}
+		}
+		for _, sig := range uat.Signatures {
+			err = sig.Serialize(w)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	for _, subkey := range e.Subkeys {
 		err = subkey.PrivateKey.Serialize(w)
 		if err != nil {
@@ -789,6 +832,20 @@ func (e *Entity) Serialize(w io.Writer) error {
 			}
 		}
 	}
+
+	for _, uat := range e.UserAttribute {
+		err = uat.UserAttribute.Serialize(w)
+		if err != nil {
+			return err
+		}
+		for _, sig := range uat.Signatures {
+			err = sig.Serialize(w)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	for _, subkey := range e.Subkeys {
 		err = subkey.PublicKey.Serialize(w)
 		if err != nil {

openpgp/packet/public_key.go

@@ -5,6 +5,7 @@
 package packet
 
 import (
+	"crypto"
 	"crypto/dsa"
 	"crypto/rsa"
 	"crypto/sha1"
@@ -991,6 +992,33 @@ func (pk *PublicKey) VerifyUserIdHashTag(id string, sig *Signature) (err error)
 	return VerifyHashTag(preparedHash, sig)
 }
 
+// userAttributeSignatureHash returns a Hash of the message that needs to be signed
+// to assert that pk is a valid key for id.
+func userAttributeSignatureHash(uat *UserAttribute, pk *PublicKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
+
+	if !hashFunc.Available() {
+		return nil, errors.UnsupportedError("hash function")
+	}
+	h = hashFunc.New()
+
+	// RFC 4880, section 5.2.4
+	pk.SerializeSignaturePrefix(h)
+	pk.serializeWithoutHeaders(h)
+
+	data := uat.Data()
+
+	var buf [5]byte
+	buf[0] = 0xd1
+	buf[1] = byte(len(data) >> 24)
+	buf[2] = byte(len(data) >> 16)
+	buf[3] = byte(len(data) >> 8)
+	buf[4] = byte(len(data))
+	h.Write(buf[:])
+	h.Write(data)
+
+	return
+}
+
 // VerifyUserIdSignature returns nil iff sig is a valid signature, made by this
 // public key, that id is the identity of pub.
 func (pk *PublicKey) VerifyUserIdSignature(id string, pub *PublicKey, sig *Signature) (err error) {
@@ -1017,6 +1045,16 @@ func (pk *PublicKey) VerifyDirectKeySignature(sig *Signature) (err error) {
 	return pk.VerifySignature(h, sig)
 }
 
+// VerifyUserAttributeSignature returns nil iff sig is a valid signature, made by this
+// public key, that id is the identity of pub.
+func (pk *PublicKey) VerifyUserAttributeSignature(pkt *UserAttribute, pub *PublicKey, sig *Signature) (err error) {
+	h, err := userAttributeSignatureHash(pkt, pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return pk.VerifySignature(h, sig)
+}
+
 // KeyIdString returns the public key's fingerprint in capital hex
 // (e.g. "6C7EE1B8621CC013").
 func (pk *PublicKey) KeyIdString() string {

openpgp/packet/signature.go

@@ -996,6 +996,21 @@ func (sig *Signature) SignDirectKeyBinding(pub *PublicKey, priv *PrivateKey, con
 	return sig.Sign(prepareHash, priv, config)
 }
 
+// SignUserAttribute computes a signature from priv, asserting that pub is a valid
+// key for the identity id.  On success, the signature is stored in sig. Call
+// Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) SignUserAttribute(uat *UserAttribute, pub *PublicKey, priv *PrivateKey, config *Config) error {
+	if priv.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	h, err := userAttributeSignatureHash(uat, pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return sig.Sign(h, priv, config)
+}
+
 // CrossSignKey computes a signature from signingKey on pub hashed using hashKey. On success,
 // the signature is stored in sig. Call Serialize to write it out.
 // If config is nil, sensible defaults will be used.

openpgp/packet/userattribute.go

@@ -9,6 +9,8 @@ import (
 	"image"
 	"image/jpeg"
 	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
 )
 
 const UserAttrImageSubpacket = 1
@@ -24,8 +26,32 @@ type UserAttribute struct {
 // NewUserAttributePhoto creates a user attribute packet
 // containing the given images.
 func NewUserAttributePhoto(photos ...image.Image) (uat *UserAttribute, err error) {
+	var imgBytes [][]byte
+	for _, photo := range photos {
+		var buf bytes.Buffer
+		if err = jpeg.Encode(&buf, photo, nil); err != nil {
+			return
+		}
+		imgBytes = append(imgBytes, buf.Bytes())
+	}
+	return newUserAttributePhotoBytes(imgBytes)
+}
+
+func NewUserAttributePhotoBytes(photos [][]byte) (uat *UserAttribute, err error) {
+	for _, photo := range photos {
+		//check jpeg
+		_, err = jpeg.Decode(bytes.NewBuffer(photo))
+		if err != nil {
+			return nil, errors.InvalidArgumentError("jpeg data err")
+		}
+	}
+	return newUserAttributePhotoBytes(photos)
+}
+
+func newUserAttributePhotoBytes(photos [][]byte) (uat *UserAttribute, err error) {
 	uat = new(UserAttribute)
 	for _, photo := range photos {
+
 		var buf bytes.Buffer
 		// RFC 4880, Section 5.12.1.
 		data := []byte{
@@ -38,17 +64,15 @@ func NewUserAttributePhoto(photos ...image.Image) (uat *UserAttribute, err error
 		if _, err = buf.Write(data); err != nil {
 			return
 		}
-		if err = jpeg.Encode(&buf, photo, nil); err != nil {
-			return
-		}
+		buf.Write(photo)
 
-		lengthBuf := make([]byte, 5)
-		n := serializeSubpacketLength(lengthBuf, len(buf.Bytes())+1)
-		lengthBuf = lengthBuf[:n]
+		encodedLength := make([]byte, 5)
+		n := serializeSubpacketLength(encodedLength, len(buf.Bytes())+1)
+		encodedLength = encodedLength[:n]
 
 		uat.Contents = append(uat.Contents, &OpaqueSubpacket{
 			SubType:       UserAttrImageSubpacket,
-			EncodedLength: lengthBuf,
+			EncodedLength: encodedLength,
 			Contents:      buf.Bytes(),
 		})
 	}
@@ -59,7 +83,13 @@ func NewUserAttributePhoto(photos ...image.Image) (uat *UserAttribute, err error
 func NewUserAttribute(contents ...*OpaqueSubpacket) *UserAttribute {
 	return &UserAttribute{Contents: contents}
 }
-
+func (uat *UserAttribute) Data() []byte {
+	buf := bytes.NewBuffer(nil)
+	for _, osp := range uat.Contents {
+		osp.Serialize(buf)
+	}
+	return buf.Bytes()
+}
 func (uat *UserAttribute) parse(r io.Reader) (err error) {
 	// RFC 4880, section 5.13
 	b, err := io.ReadAll(r)
@@ -73,6 +103,7 @@ func (uat *UserAttribute) parse(r io.Reader) (err error) {
 // Serialize marshals the user attribute to w in the form of an OpenPGP packet, including
 // header.
 func (uat *UserAttribute) Serialize(w io.Writer) (err error) {
+
 	var buf bytes.Buffer
 	for _, sp := range uat.Contents {
 		err = sp.Serialize(&buf)