Not able to sign images using openssh keys.

[sangee2004]

Acorn version - v0.8.0-rc4+b6a95e8a

Steps to reproduce the problem:

Scenario1:

1. Generate keys with ssh-keygen -t rsa
   Try to sign an image with any of the above keys

acorn image sign sangeetha/myfirstacorn:v0.0.4 --key <private key>

acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeegh1
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeegh1
? Enter password for private key sangeegh1: *********
  ✗  ERROR:  unsupported private key

2. Generate keys with ssh-keygen -t rsa -m pem

acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeepem
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeepem
? Enter password for private key sangeepem: *********
  ✗  ERROR:  error parsing rsa private key: asn1: structure error: tags don't match (16 vs {class:0 tag:11 length:79 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @2

3. Generate keys with ssh-keygen -t ed25519

 acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeeed
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeeed
? Enter password for private key sangeeed: ********
  ✗  ERROR:  unsupported private key

Note - I am able to sign images successfully using keys generated by cosign . But I am not allowed to store these keys in github.

[sangee2004]

Tested with acorn version - acorn version v0.8.0-rc4-58-gbe49d0bd+be49d0bd

I am not able to sign using openssh keys

1. Generate keys with ssh-keygen -t rsa

acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeegh1
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeegh1
? Enter password for private key sangeegh1: *********
  ✗  ERROR:  decrypt: encrypted: unexpected kdf parameters

2. Generate keys with ssh-keygen -t rsa -m pem

% acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeepem
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeepem
? Enter password for private key sangeepem: *********
  ✗  ERROR:  error parsing rsa private key: asn1: structure error: tags don't match (16 vs {class:0 tag:11 length:79 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @2

3. Generate keys with ssh-keygen -t ed25519

% acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeeed 
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeeed
? Enter password for private key sangeeed: ********
  ✗  ERROR:  decrypt: encrypted: unexpected kdf parameters

[sangee2004]

Tested with acorn version -v0.8.0-13-gab9787b8+ab9787b8

Able to sign with the following 2 keys successfully:

1. Generated keys generated with ssh-keygen -t rsa
2. Generate keys with ssh-keygen -t ed25519

Still not able sign with keys generated using ssh-keygen -t rsa -m pem

acorn image sign sangeetha/myfirstacorn:v0.0.4 --key sangeepem
  •  Signing Image sangeetha/myfirstacorn:v0.0.4 (digest: index.docker.io/sangeetha/myfirstacorn@sha256:a6e655dab6d39796d297a1b8445c549594ae19a5874e1edb287622490df41833) using key sangeepem
? Enter password for private key sangeepem: *********
  ✗  ERROR:  failed to import private key: error parsing rsa private key: asn1: structure error: tags don't match (16 vs {class:0 tag:11 length:79 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @hub-e2e 

[iwilltry42]

So far, we're able to sign with

• RSA
• ECDSA
• ED25519
• OPENSSH
• COSIGN/SIGSTORE
  keys.
  For reference: cosign only supports COSIGN/SIGSTORE and requires initial transformation to support RSA/ECDSA/ED25519 formats by default.

I think we're good like this and shouldn't block this on the alternative/optional PEM format output 👍

WDYT @cjellick ?