Concatenate keys into a single armored block #11
Conversation
openshift-ci-robot
added
the
size/XS
The `ReadArmoredKeyRing()` function from Golang's OpenPGP library only supports reading from a single armored block. Instead of concatenating the two armored keys together, the keys need to be dearmored, concatenated, and then armored. This will allow the OpenPGP library to read both keys into the keyring.
The resulting armored block looks as follows: ``` $ gpg --list-packets :public key packet: version 4, algo 1, created 1256212795, expires 0 pkey[0]: [4096 bits] pkey[1]: [17 bits] keyid: 199E2F91FD431D51 :user ID packet: "Red Hat, Inc. (release key 2) <security@redhat.com>" :signature packet: algo 1, keyid 199E2F91FD431D51 version 4, created 1256212795, md5len 0, sigclass 0x13 digest algo 2, begin of digest 6c e9 hashed subpkt 2 len 4 (sig created 2009-10-22) hashed subpkt 27 len 1 (key flags: 03) hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2) hashed subpkt 21 len 3 (pref-hash-algos: 2 8 3) hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1) hashed subpkt 30 len 1 (features: 01) hashed subpkt 23 len 1 (keyserver preferences: 80) subpkt 16 len 8 (issuer key ID 199E2F91FD431D51) data: [4095 bits] :public key packet: version 4, algo 1, created 1235485488, expires 0 pkey[0]: [4096 bits] pkey[1]: [17 bits] keyid: 938A80CAF21541EB :user ID packet: "Red Hat, Inc. (beta key 2) <security@redhat.com>" :signature packet: algo 1, keyid 938A80CAF21541EB version 4, created 1246901223, md5len 0, sigclass 0x13 digest algo 2, begin of digest ff 6d hashed subpkt 2 len 4 (sig created 2009-07-06) hashed subpkt 27 len 1 (key flags: 03) hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2) hashed subpkt 21 len 3 (pref-hash-algos: 2 8 3) hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1) hashed subpkt 30 len 1 (features: 01) hashed subpkt 23 len 1 (keyserver preferences: 80) subpkt 16 len 8 (issuer key ID 938A80CAF21541EB) data: [4096 bits] ```
openshift-ci-robot
added
size/M
|
/lgtm |
|
@wking: changing LGTM is restricted to assignees, and only openshift/cluster-update-keys repo collaborators may be assigned issues. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm /cherry-pick release-4.1 |
|
@abhinavdahiya: changing LGTM is restricted to assignees, and only openshift/cluster-update-keys repo collaborators may be assigned issues. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/assign @abhinavdahiya |
|
@crawford: GitHub didn't allow me to assign the following users: abhinavdahiya. Note that only openshift members and repo collaborators can be assigned and that issues/PRs can only have 10 assignees at the same time. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
We should just change to the beta2 key only. That’s lower risk than this (or at least, reduces the risk to a minimal amount and we can subsequently deliver this in a later z). But I’m not opposed to this change as is, as long as we add a unit test in cvo to catch this |
| CAqWkbJSgKFccsjPoTbLyxhuMSNkEZFHvlZrSK9vnPzmfiRH0Orx3wYpMQ== | ||
| =21pb | ||
| -----END PGP PUBLIC KEY BLOCK----- | ||
| dzdA27UUYjWvx42w9menJwh/0jeQcTecIUd0d0rFcw/c1pvgMMl/Q73yzKgKY5kC |
There was a problem hiding this comment.
Makes it much harder to review visually, unfortunately.
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abhinavdahiya, crawford, smarterclayton, wking The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
6 participants
The
ReadArmoredKeyRing()function from Golang's OpenPGP library onlysupports reading from a single armored block. Instead of concatenating
the two armored keys together, the keys need to be dearmored,
concatenated, and then armored. This will allow the OpenPGP library to
read both keys into the keyring.
The resulting armored block looks as follows: