Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Register package signing certificates on NuGet.org #5346

Closed
anangaur opened this issue Jan 24, 2018 · 9 comments
Closed

Register package signing certificates on NuGet.org #5346

anangaur opened this issue Jan 24, 2018 · 9 comments
Assignees
@dtivel @anangaur
Labels
Area: Gallery UI Discussions
Milestone
S135 - 2018/04/30

Comments

@anangaur
Copy link
Member

anangaur commented Jan 24, 2018 •
edited

As part of submitting signed packages, package authors on NuGet.org would need to register these certificates on NuGet.org.

The spec for this feature can be found here: NuGet/Home/wiki/Register-package-signing-certificates
@anangaur anangaur self-assigned this Jan 24, 2018
@karann-msft karann-msft mentioned this issue Jan 25, 2018
Open
@anangaur anangaur mentioned this issue Jan 25, 2018
Open
@clairernovotny
Copy link

The section that talks about deleting a registered certificate where there's already packages uploaded using it is unclear.

What if I, as a package author, want to prevent new packages from being uploaded with a particular certificate? It's not clear how I can disable any further uploads with a particular certificate.

@anangaur
Copy link
Member Author

@onovotny Thanks for the feedback. Added a section to explain the revoked/expired cert cases and clarified the 'delete certificates' section a bit more. Do let me know if more clarity is required.

What happens when a certificate expires or is revoked?

  • New packages signed with the expired/revoked certificates will not be published i.e. the push/upload/update actions would fail.

Deleting/Removing registered certificates

One may want to remove an existing registered certificate if he/she gets another certificate that he/she intends to use for package signing. In such a case, the new certificate would need to be registered using the flow discussed above. Additionally the author may want to remove the certificate he/she does not want to use any longer:

  • A registered certificate can be safely removed by clicking on the delete button if there were no packages uploaded to NuGet.org signed with that certificate. The row for the registered certificate will no longer be shown.
  • If there were one or more packages pushed to NuGet.org, delete action will disable the row that shows the registered certificate but should not remove the row altogether.
    image
  • In both these delete cases, the packages signed with these deleted certificates cannot be published to NuGet.org i.e. the push/upload/update actions will fail.

@clairernovotny
Copy link

clairernovotny commented Jan 25, 2018 via email

@maartenba
Copy link
Contributor

Package owner's can manage certificate requirements for their packages. That's great, but imagine this:

  • UserA or OrgA owns 100 packages
  • UserMe is co-owner, as I have to upload these packages as part of my job
  • UserMe updates all cert requirements to none or to a certificate owned by UserMe
  • UserA / OrgA drops UserMe as an owner

What happens when I get removed as co-owner? Does my cert still apply to the packages/upload? Can UserX ever upload another package if I get removed as an owner but the package requires my cert?

Additionally if UserMe can temporarily set the certificate requirement to none, UserMe could upload an unsigned package and then switch it all back to normal. Signature validation will of course fail downstream for that package, but what if the downstream has that disabled.

All in all like the spec!

@anangaur
Copy link
Member Author

What has happens if the user made some mistake in deleteing the cert? Can they re-enable it?

@onovotny , re-uploading the same cert should re-enable the registration. Updated the spec. Thanks!

@anangaur
Copy link
Member Author

@maartenba the cert requirement is pinned on account(s) uploading it. So today you may have no certificate and hence you can upload unsigned packages. Tomorrow you can register CertA and you now would need to submit packages signed by CertA. Day after, you may choose to remove CertA and upload a new CertB or no cert at all. Depending upon which certs are registered in the context of the package in the owner(s)' account(s), package must be signed with corresponding cert(s).

What happens when I get removed as co-owner? Does my cert still apply to the packages/upload? Can UserX ever upload another package if I get removed as an owner but the package requires my cert?

If you are removed as co-owner, the cert requirements for packages apply for the current owners i.e. UserX can upload the package unsigned (if no certs are registered) or with CertX (the cert registered by UserX).

Additionally if UserMe can temporarily set the certificate requirement to none, UserMe could upload an unsigned package and then switch it all back to normal. Signature validation will of course fail downstream for that package, but what if the downstream has that disabled.

UserMe can set to none only if one of the co-owners does not have any registered cert. If all the owners have certs registered, default option is "Any of the certs" registered by "Any of the Owners". It can be changed to either UserMe's certs or User2's cert or any other Owner's cert.

@anangaur
Copy link
Member Author

All in all like the spec!

@maartenba Thanks :)

@anangaur
Copy link
Member Author

@maartenba I also feel that if the cert changes between the package updates, this should be adequately handled through warnings during upload/push and during consumption.
/cc: @rido-min

@maartenba
Copy link
Contributor

Ok makes sense!

@skofman1 skofman1 added this to the S132 - 2018.02.26 milestone Feb 24, 2018
@chenriksson chenriksson added this to the S135 - 2018/04/30 milestone May 7, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dtivel dtivel

@anangaur anangaur

Labels
Area: Gallery UI Discussions
Projects
None yet
Milestone
S135 - 2018/04/30
Development

No branches or pull requests
6 participants
@maartenba @clairernovotny @dtivel @anangaur @chenriksson @skofman1