Make new api compatible with the Signing interface by MVrachev · Pull Request #1272 · theupdateframework/python-tuf

MVrachev · 2021-02-03T16:49:47Z

Related to: #1263

Description of the changes being introduced by the pull request:

This pr makes TUF compatible with changes introduced in secure-systems-lab/securesystemslib#319.

Please wait for the securesystemlib pr to be merged first!

Signed-off-by: Martin Vrachev mvrachev@vmware.com

lukpueh

Cool stuff, @MVrachev! I only noticed one thing (see inline comment), but we can revisit once secure-systems-lab/securesystemslib#319 has landed.

On a general note, I appreciate slightly more informative commit messages.

MVrachev · 2021-02-10T21:46:04Z

Cool stuff, @MVrachev! I only noticed one thing (see inline comment), but we can revisit once secure-systems-lab/securesystemslib#319 has landed.
On a general note, I appreciate slightly more informative commit messages.

Sorry for the lack of a good commit message, you are right.

I will update this pr when the securesystemslib signer interface is merged and I will add a better commit message before mark it
as a non-draft pr.

MVrachev · 2021-02-24T12:28:33Z

I updated the pr addressing Lukas comment #1272 (comment), adding a new commit fixing one comment in the code, and making the commit message more descriptive.

MVrachev · 2021-02-26T22:45:28Z

Updated the pr after we have bumped securesystemslib version to 0.20.0 which supports the new Signer interface.

joshuagl · 2021-03-03T08:00:20Z

Thanks for this PR Martin, I'm hoping to give it a thorough review ASAP.

One quick observation: we should bump the minimum version of securesystemslib in the install_requires entry of setup.py to the version with the Signer abstraction.

joshuagl

The small diffstat of this PR feels like a nice validation of the Signer interface.

This LGTM, thank you @MVrachev. Could you please add a patch to the PR to update the securesystemslib version in setup.py's install_requires? Also, your first patch will no longer be required once we merge #1293.

MVrachev · 2021-03-05T15:08:34Z

I addressed your comments @joshuagl and fixed the conflicts.

lukpueh

Except for two minor nits this is good to go.

MVrachev · 2021-03-09T08:51:55Z

I updated according to the last @lukpueh remarks.

In the securesystemslib pr secure-systems-lab/securesystemslib#319 I added a new Signer interface with the purpose of supporting multiple signing implementations. Additionally, I added the SSlibSigner implementation of that interface which implements the signing operation for rsa, ed25519 and ecdsa schemes. With this commit, I integrate the SSlibSigner into the new API in tuf. Signed-off-by: Martin Vrachev <mvrachev@vmware.com>

lukpueh

Hey @MVrachev, I took the liberty to rebase your PR on top of #1279, fixing conflicts and making minimal changes. See comments inline...

To get a full diff between your old diff and my new rebased diff you can do:

git range-diff develop 3050fb6 49aa0fc

I think we can merge. But maybe should consult with a 3rd-party, now that we are both authors? (ping @joshuagl, @jku, @sechkova)

lukpueh · 2021-03-10T10:07:33Z


+from securesystemslib.keys import verify_signature
 from securesystemslib.util import persist_temp_file
+from securesystemslib.signer import Signer, Signature


Re-ordered imports alphabetically.

lukpueh · 2021-03-10T10:10:21Z

- # metadata['signatures'], call Signature.from_dict for each item, and
- # pass a list of Signature objects to the Metadata constructor instead.
+ signatures = []
+ for signature in metadata.pop('signatures'):


Now popping the signatures list for consistently destructing the passed dictionary as described in the newly added "Side Effect" docstring section.

lukpueh · 2021-03-10T10:11:18Z


 Arguments:
- key: A securesystemslib-style private key object used for signing.
+ signer: An object implementing the securesystemslib.signer.Signer


Did s/singer/signer to fix a typo I had missed in my review.

MVrachev · 2021-03-10T11:21:31Z

I agree with your changes @lukpueh.
Let us wait and see what the others will say.

joshuagl

LGTM. Thanks for the changes @MVrachev and the rebase/fixes @lukpueh

lukpueh · 2021-03-10T14:47:26Z

Ping @woodruffw! Metadata.sign now accepts a custom Signer. :)

trishankatdatadog · 2021-03-10T14:53:54Z

Very cool, thanks for all the great work, guys!

Will, you should be able to reuse a lot of the Vault-specific code I wrote as part of this PR...

MVrachev marked this pull request as draft February 3, 2021 16:50

lukpueh reviewed Feb 10, 2021
View reviewed changes

Comment threadtuf/api/metadata.py Outdated

MVrachev force-pushed the signer-interface branch 2 times, most recently from 3062307 to 19e08d0Compare February 24, 2021 12:27

MVrachev marked this pull request as ready for review February 24, 2021 13:01

joshuagl mentioned this pull request Feb 25, 2021
Roadmap update for TUF support pypi/warehouse#5247
Closed

MVrachev force-pushed the signer-interface branch 2 times, most recently from a5e64e1 to ce655acCompare February 26, 2021 22:42

joshuagl requested changes Mar 3, 2021
View reviewed changes

Comment threadtuf/api/metadata.py Outdated

MVrachev force-pushed the signer-interface branch 4 times, most recently from 1856040 to 977f0d4Compare March 5, 2021 15:04

lukpueh requested changes Mar 8, 2021
View reviewed changes

Comment threadtuf/api/metadata.py Outdated
Comment threadtuf/api/metadata.py Outdated

MVrachev force-pushed the signer-interface branch from 977f0d4 to 3050fb6Compare March 9, 2021 08:50

lukpueh force-pushed the signer-interface branch from 3050fb6 to 49aa0fcCompare March 10, 2021 10:01

lukpueh reviewed Mar 10, 2021
View reviewed changes

joshuagl approved these changes Mar 10, 2021
View reviewed changes

lukpueh approved these changes Mar 10, 2021
View reviewed changes

lukpueh merged commit 65005cf into theupdateframework:developMar 10, 2021

MVrachev deleted the signer-interface branch March 31, 2021 17:59

joshuagl mentioned this pull request Apr 22, 2021
Enable signing and verifying using keys stored in Hashicorp Vault secure-systems-lab/securesystemslib#307
Closed

di mentioned this pull request Feb 1, 2022
Roadmap for PEP 458 pypi/warehouse#10672
Open
52 tasks

Uh oh!

Conversation

MVrachev commented Feb 3, 2021• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lukpueh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MVrachev commented Feb 10, 2021

Uh oh!

MVrachev commented Feb 24, 2021• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MVrachev commented Feb 26, 2021

Uh oh!

joshuagl commented Mar 3, 2021

Uh oh!

joshuagl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MVrachev commented Mar 5, 2021

Uh oh!

lukpueh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

MVrachev commented Mar 9, 2021

Uh oh!

lukpueh left a comment

Choose a reason for hiding this comment

Uh oh!

lukpuehMar 10, 2021

Choose a reason for hiding this comment

Uh oh!

lukpuehMar 10, 2021

Choose a reason for hiding this comment

Uh oh!

lukpuehMar 10, 2021

Choose a reason for hiding this comment

Uh oh!

MVrachev commented Mar 10, 2021

Uh oh!

joshuagl left a comment

Choose a reason for hiding this comment

Uh oh!

lukpueh commented Mar 10, 2021

Uh oh!

trishankatdatadog commented Mar 10, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MVrachev commented Feb 3, 2021•
edited
Loading

MVrachev commented Feb 24, 2021•
edited
Loading