gokey - Debian Package Tracker

general

source: gokey (main)
version: 0.2.0-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Anthony Fok [DMD]
arch: all any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.1.0-1
oldstable: 0.1.2-1
stable: 0.1.2-1
testing: 0.2.0-1
unstable: 0.2.0-1

versioned links

0.1.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.1.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.2.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gokey
golang-github-cloudflare-gokey-dev

action needed

A new upstream version is available: 0.2.1 high

A new upstream version 0.2.1 is available, you should consider packaging it.

Created: 2026-04-01 Last update: 2026-07-31 17:31

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 37be97e299281518902709bbfa5e20cda1e70ae8
Author: Marcos Talau <talau@debian.org>
Date:   Sun Jul 19 16:47:45 2026 -0300

    debian/salsa-ci.yml: Add to provide CI tests for Salsa

https://salsa.debian.org/api/v4/projects/go-team%2Fpackages%2Fgokey API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-19 Last update: 2026-07-28 05:32

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2025-13353: (needs triaging) In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-12-03 Last update: 2026-05-22 08:34

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2025-13353: (needs triaging) In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-12-03 Last update: 2026-05-22 08:34

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2024-04-07 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-01-25] gokey 0.2.0-1 MIGRATED to testing (Debian testing watch)
[2026-01-23] Accepted gokey 0.2.0-1 (source) into unstable (Matheus Polkorny) (signed by: Samuel Henrique)
[2026-01-03] gokey REMOVED from testing (Debian testing watch)
[2023-06-13] Accepted gokey 0.0~git20190103.40eba7e+really0.0~git20181023.b4e2780-3+deb10u1 (source) into oldoldstable (Markus Koschany)
[2023-02-11] gokey 0.1.2-1 MIGRATED to testing (Debian testing watch)
[2023-02-08] Accepted gokey 0.1.2-1 (source) into unstable (Shengjing Zhu)
[2022-11-01] gokey 0.1.1-2 MIGRATED to testing (Debian testing watch)
[2022-10-30] Accepted gokey 0.1.1-2 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2022-09-08] gokey 0.1.1-1 MIGRATED to testing (Debian testing watch)
[2022-09-05] Accepted gokey 0.1.1-1 (source) into unstable (Anthony Fok)
[2022-03-09] gokey 0.1.0-2 MIGRATED to testing (Debian testing watch)
[2022-03-04] Accepted gokey 0.1.0-2 (source) into unstable (Benjamin Drung)
[2019-07-18] gokey 0.1.0-1 MIGRATED to testing (Debian testing watch)
[2019-07-09] Accepted gokey 0.1.0-1 (source) into unstable (Benjamin Drung)
[2019-07-08] Accepted gokey 0.0~git20190505.5e08140-1 (source) into unstable (Benjamin Drung)
[2019-06-20] gokey 0.0~git20190103.40eba7e+really0.0~git20181023.b4e2780-3 MIGRATED to testing (Debian testing watch)
[2019-06-17] Accepted gokey 0.0~git20190103.40eba7e+really0.0~git20181023.b4e2780-3 (source) into unstable (Benjamin Drung)
[2019-06-13] Accepted gokey 0.0~git20190103.40eba7e+really0.0~git20181023.b4e2780-2 (source) into unstable (Benjamin Drung)
[2019-06-07] gokey 0.0~git20190103.40eba7e+really0.0~git20181023.b4e2780-1 MIGRATED to testing (Debian testing watch)
[2019-06-04] Accepted gokey 0.0~git20190103.40eba7e+really0.0~git20181023.b4e2780-1 (source) into unstable (Dr. Tobias Quathamer)
[2019-01-08] Accepted gokey 0.0~git20190103.40eba7e-1 (source) into unstable (Anthony Fok)
[2019-01-03] gokey 0.0~git20181023.b4e2780-1 MIGRATED to testing (Debian testing watch)
[2019-01-01] Accepted gokey 0.0~git20181023.b4e2780-1 (source) into unstable (Anthony Fok)
[2018-11-08] gokey 0.0~git20170602.05f83bb-1 MIGRATED to testing (Debian testing watch)
[2018-11-06] Accepted gokey 0.0~git20170602.05f83bb-1 (source amd64 all) into unstable, unstable (Benjamin Drung)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.2.0-1