This commit drops support for the legacy / custom securesystemslib key format.
This format was used in two forms:
a) In tests
b) On disk in the policy state for the root keys
To address the removal, tests have been updated to use SSH keys (via the
ssh-keygen signer). This makes up the majority of the diff for this commit, and
includes some additions to the ssh package to more easily load test artifacts.
Additionally, we don't need to store a policy state's root keys on disk for
that ref. This was an error in our initial design, and it actually leads to
complications in ensuring that the policy state's on disk keys match the keys
listed in the state's root metadata. This commit updates it so only the root
metadata's record of the root keys are used, with the keys directory omitted
for future policy states. However, we maintain backwards compatibility for
policy states that include the keys on disk, we just ignore them.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
The old methods are replaced by a simpler CanSign method needed in cmd as a
pre-run check.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
Follow Aditya's suggestion to "embed" all needed testfiles (ssh keys and
askpass script) as bytes and write them to a tmp dir where needed:
https://github.com/gittuf/gittuf/pull/414#discussion_r1618647676
Removes previously added testutils.go
**Interesting discovery**
In order to sign with an "rsa" key, ssh-keygen seems to expect an
"rsa.pub" in the same directory. This is not the case for encrypted rsa,
no for plaintext or encrypted ecdsa or ed25519.
Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
* A Key struct, similar to tuf.Key, to be included in TUF metadata (not
yet implemented), which implements the DSSE Verifier interface, to
verify signatures created with Signer.
* A Signer struct, which implements the DSSE Signer interface, to create
signatures using `ssh-keygen` and a path to a key.
* An Import function, to import a Key using `ssh-keygen` and a path to a
key.
For signing and Key import paths to either public or private, plaintext
or encrypted, rsa, ecdsa or ed25519 keys are supported (akin to git's
user.signingKey configuration).
Also adds basic smoke tests for the `ssh` package, and replaces updates
dsse tests to use this module.
Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
This commit enables testing with ED25519 keys. It also adds the openssh
representation of a public keys as test artifacts for signing Git
objects with SSH using the Git binary.
Signed-off-by: Aditya Sirish <aditya@saky.in>
