-
Notifications
You must be signed in to change notification settings - Fork 102
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
tls_private_key
resource: adding support for ED25519 key algorithm
#151
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Adding comments from verbal review. Excellent work and LGTM in general with minor changes.
0cb8f85
to
415c170
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looking good so far 😄 Just a few things to consider while we are in the neighborhood.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nothing major from my end, just a couple of nits.
This commit add support for ED25519 algorithm when generating tls_private_key resource. Refs #26 Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com>
This commit adds private_key_openssh attribute, which always contains private key in format, which is compatible with OpenSSH. This allows to produce ED25519 private key in OpenSSL compatible format in private_key_pem attribute and OpenSSH-compatible format in this new attribute. Other key types are the same in private_key_pem and private_key_openssh, as OpenSSH can read them. In the future, this could be changed to produce all private keys OpenSSH native format. Refs #26 Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com>
This is a temporary solution. The content is cherry-picked from Cherry-picking from https://go-review.googlesource.com/c/crypto/+/218620. Once that is upstreamed, we can remove this and use methods from the official `x/crypto/ssh` module.
…temporary) `openssh` package
The purpose of this is to reduce the reliance on generic `string` and lean a bit more on the compiler.
…matted keys Notice the "gotchas" around ECDSA elliptic P-224 curves
…data source This is necessary as the function `readPublicKey()` is shared between resources and data sources.
…s_public_key` data source. They are both getting updated as they share the `utils.go#readPublicKey()` function.
Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com>
Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com>
Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com>
415c170
to
c9e8373
Compare
tsl_private_key
resourcetsl_private_key
resource: adding support for ED25519 key algorithm
…this is a temporary solution We want to get rid of it as soon as #154 becomes actionable
tsl_private_key
resource: adding support for ED25519 key algorithmtls_private_key
resource: adding support for ED25519 key algorithm
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like all my changes are addressed.
…ashicorp#151) * r/private_key: Add support for ed25519 algorithm This commit add support for ED25519 algorithm when generating tls_private_key resource. Refs hashicorp#26 Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com> * r/private_key: Add private_key_openssh attribute This commit adds private_key_openssh attribute, which always contains private key in format, which is compatible with OpenSSH. This allows to produce ED25519 private key in OpenSSL compatible format in private_key_pem attribute and OpenSSH-compatible format in this new attribute. Other key types are the same in private_key_pem and private_key_openssh, as OpenSSH can read them. In the future, this could be changed to produce all private keys OpenSSH native format. Refs hashicorp#26 Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com> * Utility package to marshal `crypto.PrivateKey` to OpenSSH PEM format This is a temporary solution. The content is cherry-picked from Cherry-picking from https://go-review.googlesource.com/c/crypto/+/218620. Once that is upstreamed, we can remove this and use methods from the official `x/crypto/ssh` module. * Removing `marshalED25519PrivateKey` from `util.go` in favour of the (temporary) `openssh` package * Adding type `Algorithm` to use in maps and signatures The purpose of this is to reduce the reliance on generic `string` and lean a bit more on the compiler. * Switching to use the `openssh` package for generating OpenSSH PEM formatted keys Notice the "gotchas" around ECDSA elliptic P-224 curves * Adding `public_key_fingerprint_sha256` attribute to `tls_private_key` resource * Update `tls_private_key` resource testing to reflect all the recent changes * Adding attribute `public_key_fingerprint_sha256` to `tls_public_key` data source This is necessary as the function `readPublicKey()` is shared between resources and data sources. * Updating website documentation for `tls_private_key` resource and `tls_public_key` data source. They are both getting updated as they share the `utils.go#readPublicKey()` function. * Update internal/openssh/lib_test.go (typo) Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update website/docs/r/private_key.html.md Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update internal/openssh/lib_test.go Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Fixing indentation * Removing dependency on `testify` as requested by Katy Moe * Rewarding description for 2 fields * Moving "types" into "types.go" and out of "util.go" * Adding input argument validations to `tls_private_key` * Updating markdown documentation to address PR feedback * Avoided creating exported constants in `internal/openssh` library as this is a temporary solution We want to get rid of it as soon as hashicorp#154 becomes actionable * Fix typo: marshall -> marshal * Adding a 'copyright header' on the 'internal/openssh/lib.go' file Co-authored-by: Mateusz Gozdek <mgozdekof@gmail.com> Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com>
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions. |
Context: #150
This PR starts from the work of #59 (thank you!) and moves towards the use of upcoming features of
x/crypto/ssh
(link).A configuration like this will now be possible:
Subtasks in this PR:
private_key_openssh
for all key algorithm that we can generate OpenSSH PEM format for (i.e. this excludes ECDSA P-224, because of SSH limitations)public_key_fingerprint_sha256
for all key algorithms that we can generate OpenSSH PEM format for (same as above)tls_private_key
documentationPLEASE NOTE: This PR does NOT cover everything we want to address in #150 but focuses around
tls_private_key
. This means that we will not be cutting a release until all the items in #150 are addressed.