Metadata file contains a key with an invalid keytype.

[asraa]

ECDSA keys are generated with a keytype of ecdsa using the securesystemslib https://github.com/secure-systems-lab/securesystemslib/blob/2d33d91bef92f53b5e9489d57033bb9d046a6d23/securesystemslib/keys.py#L1678.

However, if you load a repository that's created with a key from import_ecdsakey_from_public_pem, you run a TUF error that the keytype is unsupported because of:

https://github.com/theupdateframework/tuf/blob/30ba6e9f9ab25e0370e29ce574dada2d8809afa0/tuf/keydb.py#L48

Should the keytype instead be ecdsa, rather than ecdsa-sha2-nistp256, which is the scheme type?

[joshuagl]

Thanks for the bug report @asraa ! Until relatively recently securesystemslib used ecdsa-sha2-nistp256 as the key type, but that was clearly incorrect (secure-systems-lab/securesystemslib#239) as it encoded scheme and we changed it to be more consistent with the other key types in secure-systems-lab/securesystemslib#267

I think the correct fix for this is to add the 'new' ecdsa key type to the list of supported key types. Would you be willing to submit a PR with a change to _SUPPORTED_KEY_TYPES = ['rsa', 'ed25519', 'ecdsa', 'ecdsa-sha2-nistp256']?

[asraa]

Ohhh I see. Thanks for the context -- I agree that that fix makes the most sense.

[trishankatdatadog]

We should deprecate ecdsa-sha2-nistp256 keytype now, and remove it altogether later for 2.0 or something.

[avelichka]

I'd like to give that a try, please?

[asraa]

go ahead! i moved to using the go-tuf implementation and had a workaround