add migrate_key cli script #658
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is in preparation for the removal of legacy key modules and formats, in favor of the new Signer API. It allows users to convert their old rsa, ed25519 and ecdsa key files, generated with the `interface` or `keys` module, and using an outdated standard or sslib proprietary format (see secure-systems-lab#309), to a consistent new standard format, which can be used with the file-based signer (`CryptoSigner`) of the new Signer API. NOTE: The script uses legacy code and should thus be removed with them, from the repo tree, while remaining available to users of securesystemslib for some time. We could keep pointing to it in docs after its removal (users would need to check-out the repo at a specified tag), or move it to a different place. *Change details* * Add cli script to convert key files. * Add private/private encrypted/public test key files for each supported algorithm in the legacy format. **The key pairs were generated with `interface`, minimally modified to allow writing an encrypted and non-encrypted version of the same private key. * Add comprehensive tests, includes backwards/forward compatibility of signatures. Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
Collaborator
|
I don't object to the functionality but I have some questions:
I'm a little surprised I can't get mypy to complain about the lack of typing (even if I add the file to the config) but I don't know if that's something you should spend time on... |
Member
Author
Git tree only is fine. It certainly does not have to be part of the public API/CLI, or even packaged. I really just wanted to add it to the "securesystemslib" namespace, piggyback on its ci, and show that it passes at least once. My idea was to tag it, remove it, but keep it in the docs for a while, including the tag at which it can be used. In reality, the script is unlikely to have a lot of users, and it's simple enough, so I might as well just throw it in a personal gist. What do you think? |
Collaborator
|
I don't have strong opinions, any of those sounds fine. Could drop it in docs/ or examples/ as well 🤷 . |
Script does not have to be part of the public API/CLI or be packaged. Just want to have it in the repo and use existing CI. Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
Member
Author
|
@jku, would you kindly approve? I moved the script to docs/ and added a small pointer to README. |
Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
lukpueh
force-pushed
the
add-key-migrate-cli
branch
from
2a4fbbb to
d378d2e
Compare
jku
approved these changes
Nov 22, 2023
lukpueh
pushed a commit
to lukpueh/securesystemslib
that referenced
this pull request
Apr 10, 2024
In preparation for the removal of legacy key interfaces and formats (secure-systems-lab#731), we provided a key file migration script in docs/ (secure-systems-lab#658). The script itself uses the legacy interfaces and thus should be removed from the current git tree together with them. This patch removes the script, including tests and test data, but keeps a tagged reference in the README, so that it can still be used with the pre-legacy-removal version of securesystemslib. Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is in preparation for the removal of legacy key modules and formats, in favor of the new Signer API. It allows users to convert their old rsa, ed25519 and ecdsa key files, generated with the
interfaceorkeysmodule, and using an outdated standard or sslib proprietary format (see #309), to a consistent new standard format, which can be used with the file-based signer (CryptoSigner) of the new Signer API.NOTE: The script uses legacy code and should thus be removed with them, from the repo tree, while remaining available to users of securesystemslib for some time. We could keep pointing to it in docs after its removal (users would need to check-out the repo at a specified tag), or move it to a different place.
Change details
interface, minimally modified to allow writing an encrypted and non-encrypted version of the same private key.