Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Implement TAP-12 support #310

Merged
merged 5 commits into from
Jun 13, 2022
Merged

Conversation

znewman01
Copy link
Contributor

Please fill in the fields below to submit a pull request. The more information that is provided, the better.

Fixes #232
Release Notes: Add support for repositories that implement TAP-12 (allowing arbitrary key IDs). go-tuf itself will continue to emit pre-TAP-12-compliant key IDs.

Types of changes:

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Description of the changes being introduced by the pull request:

Allows arbitrary key IDs in repos that we read, per TAP-12. (We will still only produce key IDs that are the SHA2 of the public key.)

Please verify and check that the pull request fulfills the following requirements:

  • Tests have been added for the bug fix or new feature
  • (N/A) Docs have been added for the bug fix or new feature

@znewman01 znewman01 requested review from asraa and mnm678 June 8, 2022 22:34
@znewman01 znewman01 self-assigned this Jun 8, 2022
@asraa
Copy link
Contributor

asraa commented Jun 9, 2022

quick comment: could you remove the contributing.md commit?

@znewman01
Copy link
Contributor Author

quick comment: could you remove the contributing.md commit?

D'oh, thought I rebased. Thanks, done!

verify/db.go Outdated Show resolved Hide resolved
verify/db_test.go Show resolved Hide resolved
@znewman01 znewman01 mentioned this pull request Jun 9, 2022
1 task
asraa
asraa previously approved these changes Jun 10, 2022
asraa
asraa previously approved these changes Jun 10, 2022
Copy link
Contributor

@asraa asraa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

Signed-off-by: Zachary Newman <z@znewman.net>
@znewman01
Copy link
Contributor Author

@mnm678 ping

mnm678
mnm678 previously approved these changes Jun 13, 2022
Main changes:

- allow IDs that aren't the SHA2 of the public key
- but disallow multiple distinct keys with the same ID
- test for TAP-12 compliance
  - Adding keys should disallow different keys with the same ID, but allow everything else
  - Verification should ensure that we have unique keys for each signature

Fixes theupdateframework#232.

Signed-off-by: Zachary Newman <z@znewman.net>
Signed-off-by: Zachary Newman <z@znewman.net>
Signed-off-by: Zachary Newman <z@znewman.net>
Signed-off-by: Zachary Newman <z@znewman.net>
@znewman01
Copy link
Contributor Author

Hoist by my own petard (#308)!

No changes other than DCO and rebasing, but I need fresh approvals.

@znewman01 znewman01 requested review from asraa and mnm678 June 13, 2022 19:44
@mnm678 mnm678 merged commit 355e39c into theupdateframework:master Jun 13, 2022
@asraa
Copy link
Contributor

asraa commented Jul 1, 2022

@znewman01 @rdimitrov I'm having trouble updating go-tuf in my library, because of a transitive dependency from rekor to v0.3.0 here. This removed verify.ErrWrongID -- can we cut a new minor release soon?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Implement TAP-12 for future-proofing
3 participants