hush/vendor/google.golang.org/protobuf/internal/impl/merge.go
jx12n 4d9a26498e hush: one-time secret links the server cannot read
Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.

The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.

Three decisions carry the design:

  * GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
    WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
    sees it, so destroying on GET would destroy most secrets in transit and the
    recipient's "already used" would be indistinguishable from interception.
    Only POST /reveal consumes. Bot user-agent detection is an arms race;
    removing the side effect from GET is not. Pinned by
    TestGettingTheRevealPageNeverConsumesTheSecret.
  * Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
    where two simultaneous readers both win, and for a one-time secret that
    window is the product. The store contract demands atomicity and the same
    concurrency test runs against both implementations.
  * Missing, already-revealed, expired and evicted are ONE indistinguishable
    410. Separating them would confirm to a prober that a given link was real.

The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.

Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.

Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.

cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
2026-09-03 00:08:38 -06:00

204 lines
5.2 KiB
Go

// Copyright 2020 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package impl
import (
"fmt"
"reflect"
"google.golang.org/protobuf/proto"
"google.golang.org/protobuf/reflect/protoreflect"
"google.golang.org/protobuf/runtime/protoiface"
)
type mergeOptions struct{}
func (o mergeOptions) Merge(dst, src proto.Message) {
proto.Merge(dst, src)
}
// merge is protoreflect.Methods.Merge.
func (mi *MessageInfo) merge(in protoiface.MergeInput) protoiface.MergeOutput {
dp, ok := mi.getPointer(in.Destination)
if !ok {
return protoiface.MergeOutput{}
}
sp, ok := mi.getPointer(in.Source)
if !ok {
return protoiface.MergeOutput{}
}
mi.mergePointer(dp, sp, mergeOptions{})
return protoiface.MergeOutput{Flags: protoiface.MergeComplete}
}
func (mi *MessageInfo) mergePointer(dst, src pointer, opts mergeOptions) {
mi.init()
if dst.IsNil() {
panic(fmt.Sprintf("invalid value: merging into nil message"))
}
if src.IsNil() {
return
}
var presenceSrc presence
var presenceDst presence
if mi.presenceOffset.IsValid() {
presenceSrc = src.Apply(mi.presenceOffset).PresenceInfo()
presenceDst = dst.Apply(mi.presenceOffset).PresenceInfo()
}
for _, f := range mi.orderedCoderFields {
if f.funcs.merge == nil {
continue
}
sfptr := src.Apply(f.offset)
if f.presenceIndex != noPresence {
if !presenceSrc.Present(f.presenceIndex) {
continue
}
dfptr := dst.Apply(f.offset)
if f.isLazy {
if sfptr.AtomicGetPointer().IsNil() {
mi.lazyUnmarshal(src, f.num)
}
if presenceDst.Present(f.presenceIndex) && dfptr.AtomicGetPointer().IsNil() {
mi.lazyUnmarshal(dst, f.num)
}
}
f.funcs.merge(dst.Apply(f.offset), sfptr, f, opts)
presenceDst.SetPresentUnatomic(f.presenceIndex, mi.presenceSize)
continue
}
if f.isPointer && sfptr.Elem().IsNil() {
continue
}
f.funcs.merge(dst.Apply(f.offset), sfptr, f, opts)
}
if mi.extensionOffset.IsValid() {
sext := src.Apply(mi.extensionOffset).Extensions()
dext := dst.Apply(mi.extensionOffset).Extensions()
if *dext == nil {
*dext = make(map[int32]ExtensionField)
}
for num, sx := range *sext {
xt := sx.Type()
xi := getExtensionFieldInfo(xt)
if xi.funcs.merge == nil {
continue
}
dx := (*dext)[num]
var dv protoreflect.Value
if dx.Type() == sx.Type() {
dv = dx.Value()
}
if !dv.IsValid() && xi.unmarshalNeedsValue {
dv = xt.New()
}
dv = xi.funcs.merge(dv, sx.Value(), opts)
dx.Set(sx.Type(), dv)
(*dext)[num] = dx
}
}
if mi.unknownOffset.IsValid() {
su := mi.getUnknownBytes(src)
if su != nil && len(*su) > 0 {
du := mi.mutableUnknownBytes(dst)
*du = append(*du, *su...)
}
}
}
func mergeScalarValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
return src
}
func mergeBytesValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
return protoreflect.ValueOfBytes(append(emptyBuf[:], src.Bytes()...))
}
func mergeListValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
dstl := dst.List()
srcl := src.List()
for i, llen := 0, srcl.Len(); i < llen; i++ {
dstl.Append(srcl.Get(i))
}
return dst
}
func mergeBytesListValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
dstl := dst.List()
srcl := src.List()
for i, llen := 0, srcl.Len(); i < llen; i++ {
sb := srcl.Get(i).Bytes()
db := append(emptyBuf[:], sb...)
dstl.Append(protoreflect.ValueOfBytes(db))
}
return dst
}
func mergeMessageListValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
dstl := dst.List()
srcl := src.List()
for i, llen := 0, srcl.Len(); i < llen; i++ {
sm := srcl.Get(i).Message()
dm := proto.Clone(sm.Interface()).ProtoReflect()
dstl.Append(protoreflect.ValueOfMessage(dm))
}
return dst
}
func mergeMessageValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
opts.Merge(dst.Message().Interface(), src.Message().Interface())
return dst
}
func mergeMessage(dst, src pointer, f *coderFieldInfo, opts mergeOptions) {
if f.mi != nil {
if dst.Elem().IsNil() {
dst.SetPointer(pointerOfValue(reflect.New(f.mi.GoReflectType.Elem())))
}
f.mi.mergePointer(dst.Elem(), src.Elem(), opts)
} else {
dm := dst.AsValueOf(f.ft).Elem()
sm := src.AsValueOf(f.ft).Elem()
if dm.IsNil() {
dm.Set(reflect.New(f.ft.Elem()))
}
opts.Merge(asMessage(dm), asMessage(sm))
}
}
func mergeMessageSlice(dst, src pointer, f *coderFieldInfo, opts mergeOptions) {
for _, sp := range src.PointerSlice() {
dm := reflect.New(f.ft.Elem().Elem())
if f.mi != nil {
f.mi.mergePointer(pointerOfValue(dm), sp, opts)
} else {
opts.Merge(asMessage(dm), asMessage(sp.AsValueOf(f.ft.Elem().Elem())))
}
dst.AppendPointerSlice(pointerOfValue(dm))
}
}
func mergeBytes(dst, src pointer, _ *coderFieldInfo, _ mergeOptions) {
*dst.Bytes() = append(emptyBuf[:], *src.Bytes()...)
}
func mergeBytesNoZero(dst, src pointer, _ *coderFieldInfo, _ mergeOptions) {
v := *src.Bytes()
if len(v) > 0 {
*dst.Bytes() = append(emptyBuf[:], v...)
}
}
func mergeBytesSlice(dst, src pointer, _ *coderFieldInfo, _ mergeOptions) {
ds := dst.BytesSlice()
for _, v := range *src.BytesSlice() {
*ds = append(*ds, append(emptyBuf[:], v...))
}
}