Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

repo: Ensure keyids are correct in signing event #536

Merged
merged 4 commits into from
Feb 4, 2025
Merged

repo: Ensure keyids are correct in signing event #536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4a67100
repo: Ensure keyids are correct in signing event
jku Feb 3, 2025
32524b4
Fix the test key keyid
jku Feb 3, 2025
f8f9b5a
tests: Update expected results
jku Feb 3, 2025
2dceec4
Prepare release 0.16
jku Feb 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,16 @@

## Unreleased

## v0.16.0

This release contains minor improvements to both repository and signer.

* Verify keyid calculation in signing event (#536)
* Improve error message when Yubikey authentication fails (#528)
* Improve python project metadata (#533)

Updating a repository from 0.15 does not require changes in GitHub workflow files.

## v0.15.2

This point release fixes a bug introduced in 0.14.
Expand Down
9 changes: 9 additions & 0 deletions repo/tuf_on_ci/_repository.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@
from glob import glob

from securesystemslib.exceptions import UnverifiedSignatureError
from securesystemslib.formats import encode_canonical
from securesystemslib.hash import digest
from securesystemslib.signer import (
KEY_FOR_TYPE_AND_SCHEME,
SIGNER_FOR_URI_SCHEME,
Expand Down Expand Up @@ -371,6 +373,13 @@ def _validate_role(
if signing_days < 1 or expiry_days <= signing_days:
return False, "Online signing or expiry period failed sanity check"

for key in md.signed.keys.values():
data: bytes = encode_canonical(key.to_dict()).encode()
hasher = digest("sha256")
hasher.update(data)
if key.keyid != hasher.hexdigest():
return False, f"Key {key.keyid} keyid does not match content hash"

# TODO for root:
# * check delegations are correct

Expand Down
2 changes: 1 addition & 1 deletion repo/tuf_on_ci/_version.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.15.2"
__version__ = "0.16.0"
2 changes: 1 addition & 1 deletion signer/tuf_on_ci_sign/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@
from tuf_on_ci_sign.import_repo import import_repo
from tuf_on_ci_sign.sign import sign

__version__ = "0.15.2"
__version__ = "0.16.0"

__all__ = ["delegate", "import_repo", "sign"]
2 changes: 1 addition & 1 deletion signer/tuf_on_ci_sign/delegate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,7 +263,7 @@ def _collect_online_key(user_config: User) -> Key:
uri = f"file2:{os.getenv('TUF_ON_CI_TEST_KEY')}"
pub_key = "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
return SSlibKey(
"fa47289",
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"ed25519",
"ed25519",
{"public": pub_key},
Expand Down
20 changes: 10 additions & 10 deletions tests/expected/basic/metadata/1.root.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,21 @@
"consistent_snapshot": true,
"expires": "2022-02-03T01:02:03Z",
"keys": {
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
},
"ddadf0c54d24c3429a36b7ad8434414fa35b80922497d2c99067261d38746460": {
"keytype": "ecdsa",
"keyval": {
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
},
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
},
"fa47289": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
}
},
"roles": {
Expand All @@ -36,7 +36,7 @@
},
"snapshot": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 365,
Expand All @@ -50,7 +50,7 @@
},
"timestamp": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 2,
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/basic/metadata/1.snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/basic/metadata/timestamp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
20 changes: 10 additions & 10 deletions tests/expected/delegated/metadata/1.root.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,21 @@
"consistent_snapshot": true,
"expires": "2022-02-03T01:02:03Z",
"keys": {
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
},
"ddadf0c54d24c3429a36b7ad8434414fa35b80922497d2c99067261d38746460": {
"keytype": "ecdsa",
"keyval": {
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
},
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
},
"fa47289": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
}
},
"roles": {
Expand All @@ -36,7 +36,7 @@
},
"snapshot": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 365,
Expand All @@ -50,7 +50,7 @@
},
"timestamp": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 2,
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/delegated/metadata/2.snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/delegated/metadata/timestamp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
20 changes: 10 additions & 10 deletions tests/expected/multi-user-signing/metadata/1.root.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,21 @@
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user2"
},
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
},
"ddadf0c54d24c3429a36b7ad8434414fa35b80922497d2c99067261d38746460": {
"keytype": "ecdsa",
"keyval": {
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
},
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
},
"fa47289": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
}
},
"roles": {
Expand All @@ -44,7 +44,7 @@
},
"snapshot": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 365,
Expand All @@ -59,7 +59,7 @@
},
"timestamp": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 2,
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/multi-user-signing/metadata/1.snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
20 changes: 10 additions & 10 deletions tests/expected/multi-user-signing/metadata/2.root.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,21 @@
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user2"
},
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
},
"ddadf0c54d24c3429a36b7ad8434414fa35b80922497d2c99067261d38746460": {
"keytype": "ecdsa",
"keyval": {
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
},
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
},
"fa47289": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
}
},
"roles": {
Expand All @@ -44,7 +44,7 @@
},
"snapshot": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 365,
Expand All @@ -59,7 +59,7 @@
},
"timestamp": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 5,
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/multi-user-signing/metadata/timestamp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
20 changes: 10 additions & 10 deletions tests/expected/online-version-bump/metadata/1.root.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,21 @@
"consistent_snapshot": true,
"expires": "2022-02-03T01:02:03Z",
"keys": {
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
},
"ddadf0c54d24c3429a36b7ad8434414fa35b80922497d2c99067261d38746460": {
"keytype": "ecdsa",
"keyval": {
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
},
"scheme": "ecdsa-sha2-nistp384",
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
},
"fa47289": {
"keytype": "ed25519",
"keyval": {
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
},
"scheme": "ed25519",
"x-tuf-on-ci-online-uri": "file2:online-test-key"
}
},
"roles": {
Expand All @@ -36,7 +36,7 @@
},
"snapshot": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 10,
Expand All @@ -50,7 +50,7 @@
},
"timestamp": {
"keyids": [
"fa47289"
"cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34"
],
"threshold": 1,
"x-tuf-on-ci-expiry-period": 2,
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/online-version-bump/metadata/2.snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
2 changes: 1 addition & 1 deletion tests/expected/online-version-bump/metadata/timestamp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"signatures": [
{
"keyid": "fa47289",
"keyid": "cda7a53138556e7c0d1737e4ba32868f3cf287e78ab9366c820115ce11383d34",
"sig": "XXX"
}
],
Expand Down
Loading