Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clientupdate/distsign: add new library for package signing/verification #8943

Merged
merged 1 commit into from
Aug 22, 2023

Conversation

awly
Copy link
Contributor

@awly awly commented Aug 17, 2023

This library is intended for use during release (cmd/dist) to sign packages which are then served from pkgs.tailscale.com.
The library is also then used by clients downloading packages for tailscale update where OS package managers / app stores aren't used.

In a separate PR I will make a CLI around distsign.Signer for common operations like "generate new keys", "sign signing keys", "re-sign stuff with a new signing key". This PR is too big to include that :)

Updates #8760
Updates #6995

clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
@awly awly force-pushed the awly/distsign-lib branch 2 times, most recently from 29f38d9 to bc88225 Compare August 17, 2023 23:25
@awly awly requested a review from noncombatant August 17, 2023 23:28
@awly
Copy link
Contributor Author

awly commented Aug 18, 2023

Updated PR to use Ed25519ph (pre-hashed version) for actual packages so that we don't have to buffer them in memory. The signing key bundle is still signed with regular Ed25519, it should be small enough to buffer in memory.

Also added RootKey and SigningKey wrappers for Signer to hide this from the caller.

clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign_test.go Outdated Show resolved Hide resolved
@awly awly requested a review from noncombatant August 18, 2023 23:04
@awly awly force-pushed the awly/distsign-lib branch 2 times, most recently from a22c908 to 707fc1e Compare August 21, 2023 15:44
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
clientupdate/distsign/distsign.go Show resolved Hide resolved
clientupdate/distsign/distsign.go Outdated Show resolved Hide resolved
This library is intended for use during release to sign packages which
are then served from pkgs.tailscale.com.
The library is also then used by clients downloading packages for
`tailscale update` where OS package managers / app stores aren't used.

Updates #8760
Updates #6995

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
@awly awly merged commit 7364c6b into main Aug 22, 2023
36 checks passed
@awly awly deleted the awly/distsign-lib branch August 22, 2023 20:35
alexelisenko pushed a commit to Control-D-Inc/tailscale that referenced this pull request Feb 15, 2024
…on (tailscale#8943)

This library is intended for use during release to sign packages which
are then served from pkgs.tailscale.com.
The library is also then used by clients downloading packages for
`tailscale update` where OS package managers / app stores aren't used.

Updates tailscale#8760
Updates tailscale#6995

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
Signed-off-by: Alex Paguis <alex@windscribe.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants