-
Notifications
You must be signed in to change notification settings - Fork 121
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for Fortanix DSM signer #469
Conversation
Mind rebasing? We just cut a new release and can start looking at this |
cf06381
to
f47e62e
Compare
@tony-iqlusion any progress on reviewing this? Let me know if you need more information about Fortanix DSM. |
f47e62e
to
ec212f6
Compare
@mzohreva it looks like the checks didn't run. Can you try doing a quick |
ec212f6
to
6eb17e2
Compare
@tony-iqlusion just did what you asked, I see no change. In the Checks tab I see this: |
@mzohreva I have a button on my side now, which I just hit, and the workflow is running |
Seems like |
6eb17e2
to
adc099d
Compare
Looks like a clippy failure |
adc099d
to
feb06a2
Compare
@tony-iqlusion just addressed the clippy issues. |
feb06a2
to
690c190
Compare
Thanks! The build is finally green. Will take a more in-depth look tomorrow. |
} | ||
|
||
// See RFC 8410 section 3 | ||
const ED_25519_OID: ObjectIdentifier = ObjectIdentifier::new("1.3.101.112"); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is available as ed25519::pkcs8::ALGORITHM_OID
.
Not a blocker for merging though, I can fix it up afterward (ed25519
is currently only a transitive dependency).
struct Ed25519PublicKey(Ed25519); | ||
|
||
impl DecodePublicKey for Ed25519PublicKey {} | ||
|
||
impl<'a> TryFrom<SubjectPublicKeyInfo<'a>> for Ed25519PublicKey { | ||
type Error = SpkiError; | ||
|
||
fn try_from(spki: SubjectPublicKeyInfo<'_>) -> Result<Self, Self::Error> { | ||
spki.algorithm.assert_algorithm_oid(ED_25519_OID)?; | ||
|
||
if spki.algorithm.parameters != None { | ||
// TODO: once/if https://github.com/RustCrypto/formats/issues/354 is addressed we should use that error variant. | ||
return Err(SpkiError::KeyMalformed); | ||
} | ||
|
||
Ed25519::from_bytes(spki.subject_public_key) | ||
.map_err(|_| SpkiError::KeyMalformed) | ||
.map(Ed25519PublicKey) | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Likewise most of this is available as ed25519::pkcs8::PublicKeyBytes
A few nits re: PKCS#8/SPKI, but I'm going to go ahead and merge anyway as I'd like to get this in both to have it and to unblock other work. If you'd like to follow up with using the |
I'll need to update documentation to reflect the new signing provider, but wanted to get some early feedback first.