openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-03 19:53:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Potential fix for pull request finding

Browse Source 
Better handling of key material

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Nick Steele
2026-03-17 15:26:56 -04:00
committed by GitHub
co-authored by Copilot Autofix powered by AI
parent 13a9595010
commit 4528248660
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/agent_identity.rs
+8 -8
View File
@@ -399,12 +399,16 @@ fn canonical_signing_payload(agent_runtime_id: &str, timestamp: &str) -> String
format!("{agent_runtime_id}:{timestamp}")
}
fn sign_payload(private_key_pkcs8_base64: &str, payload: &[u8]) -> Result<String> {
fn decode_signing_key(private_key_pkcs8_base64: &str) -> Result<SigningKey> {
let private_key_pkcs8_der = BASE64_STANDARD
.decode(private_key_pkcs8_base64)
.context("decoding agent identity private key")?;
let signing_key = SigningKey::from_pkcs8_der(&private_key_pkcs8_der)
.context("decoding agent identity private key")?;
SigningKey::from_pkcs8_der(&private_key_pkcs8_der)
.context("decoding agent identity private key")
}
fn sign_payload(private_key_pkcs8_base64: &str, payload: &[u8]) -> Result<String> {
let signing_key = decode_signing_key(private_key_pkcs8_base64)?;
let signature: Signature = signing_key.sign(payload);
Ok(URL_SAFE_NO_PAD.encode(signature.to_bytes()))
}
@@ -429,11 +433,7 @@ fn decrypt_task_id(
.decode(&encrypted_task_id)
.or_else(|_| URL_SAFE_NO_PAD.decode(&encrypted_task_id))
.context("decoding encrypted task id envelope")?;
let private_key_pkcs8_der = BASE64_STANDARD
.decode(private_key_pkcs8_base64)
.context("decoding agent identity private key")?;
let signing_key = SigningKey::from_pkcs8_der(&private_key_pkcs8_der)
.context("decoding agent identity private key")?;
let signing_key = decode_signing_key(private_key_pkcs8_base64)?;
let secret_key = CryptoBoxSecretKey::from(signing_key.to_scalar());
let decrypted = secret_key
.unseal(&decoded)