Skip to content

Commit af338b8

Browse files
uenoueno
committed
sign: Support x509 signature type
The current "ed25519" signing type assumes raw Ed25519 key format for both public and private keys. That requires custom processing of keys after generated with openssl tools, and also lacks cryptographic agility[1]; when Ed25519 becomes vulnerable, it would not be straightforward to migrate to other algorithms, such as post-quantum signature algorithms. This patch adds a new signature type "x509" to use the key formats natively supported by OpenSSL (PKCS#8 and SubjectPublicKeyInfo) and capable of embedding algorithm identifier in an X.509 format. The "x509" signature type prefers keys to be encoded in the PEM format on disk, while it still accepts base64 encoded keys when given through the command-line. 1. https://en.wikipedia.org/wiki/Cryptographic_agility Signed-off-by: Daiki Ueno <dueno@redhat.com>
1 parent 5583563 commit af338b8

17 files changed

+1128
-61
lines changed

‎Makefile-libostree.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,8 @@ libostree_1_la_SOURCES += \
261261
src/libostree/ostree-sign-dummy.h \
262262
src/libostree/ostree-sign-ed25519.c \
263263
src/libostree/ostree-sign-ed25519.h \
264+
src/libostree/ostree-sign-x509.c \
265+
src/libostree/ostree-sign-x509.h \
264266
src/libostree/ostree-sign-private.h \
265267
src/libostree/ostree-blob-reader.c \
266268
src/libostree/ostree-blob-reader.h \

‎Makefile-otcore.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ libotcore_la_SOURCES = \
1919
src/libotcore/otcore.h \
2020
src/libotcore/otcore-ed25519-verify.c \
2121
src/libotcore/otcore-prepare-root.c \
22+
src/libotcore/otcore-x509-verify.c \
2223
$(NULL)
2324

2425
libotcore_la_CFLAGS = $(AM_CFLAGS) -I$(srcdir)/libglnx -I$(srcdir)/src/libotutil -DLOCALEDIR=\"$(datadir)/locale\" $(OT_INTERNAL_GIO_UNIX_CFLAGS) $(OT_INTERNAL_GPGME_CFLAGS) $(OT_DEP_CRYPTO_LIBS) $(LIBSYSTEMD_CFLAGS)

‎Makefile-tests.am‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,12 +156,24 @@ _installed_or_uninstalled_test_scripts = \
156156
tests/test-summary-collections.sh \
157157
tests/test-pull-collections.sh \
158158
tests/test-config.sh \
159-
tests/test-signed-commit.sh \
159+
tests/test-signed-commit-dummy.sh \
160160
tests/test-signed-pull.sh \
161161
tests/test-pre-signed-pull.sh \
162162
tests/test-signed-pull-summary.sh \
163163
$(NULL)
164164

165+
if HAVE_ED25519
166+
_installed_or_uninstalled_test_scripts += \
167+
tests/test-signed-commit-ed25519.sh \
168+
$(NULL)
169+
endif
170+
171+
if HAVE_X509
172+
_installed_or_uninstalled_test_scripts += \
173+
tests/test-signed-commit-x509.sh \
174+
$(NULL)
175+
endif
176+
165177
if USE_GPGME
166178
_installed_or_uninstalled_test_scripts += \
167179
tests/test-remote-gpg-import.sh \

‎configure.ac‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -452,10 +452,19 @@ if test x$with_openssl != xno; then OSTREE_FEATURES="$OSTREE_FEATURES openssl";
452452
AM_CONDITIONAL(USE_OPENSSL, test $with_openssl != no)
453453
dnl end openssl
454454

455-
if test x$with_openssl != xno || test x$with_ed25519_libsodium != xno; then
455+
AM_CONDITIONAL([HAVE_ED25519], [test x$with_openssl != xno || test x$with_ed25519_libsodium != xno])
456+
457+
AM_COND_IF([HAVE_ED25519], [
456458
AC_DEFINE([HAVE_ED25519], 1, [Define if ed25519 is supported ])
457459
OSTREE_FEATURES="$OSTREE_FEATURES sign-ed25519"
458-
fi
460+
])
461+
462+
AM_CONDITIONAL([HAVE_X509], [test x$with_openssl != xno])
463+
464+
AM_COND_IF([HAVE_X509], [
465+
AC_DEFINE([HAVE_X509], 1, [Define if x509 is supported ])
466+
OSTREE_FEATURES="$OSTREE_FEATURES sign-x509"
467+
])
459468

460469
dnl begin gnutls; in contrast to openssl this one only
461470
dnl supports --with-crypto=gnutls
@@ -697,7 +706,7 @@ echo "
697706
systemd: $with_libsystemd
698707
libmount: $with_libmount
699708
libsodium (ed25519 signatures): $with_ed25519_libsodium
700-
openssl (ed25519 signatures): $with_openssl
709+
openssl (ed25519 and x509 signatures): $with_openssl
701710
libarchive (parse tar files directly): $with_libarchive
702711
static deltas: yes (always enabled now)
703712
O_TMPFILE: $enable_otmpfile

‎man/ostree-commit.xml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
312312
<term><option>-s, --sign-type</option></term>
313313
<listitem><para>
314314
Use particular signature engine. Currently
315-
available <arg choice="plain">ed25519</arg> and <arg choice="plain">dummy</arg>
315+
available <arg choice="plain">ed25519</arg>, <arg choice="plain">x509</arg>, and <arg choice="plain">dummy</arg>
316316
signature types.
317317

318318
The default is <arg choice="plain">ed25519</arg>.
@@ -323,7 +323,8 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
323323
<varlistentry>
324324
<term><option>--sign-from-file</option>="PATH"</term>
325325
<listitem><para>
326-
This will read a key (corresponding to the provided <literal>--sign-type</literal> from the provided path. The key should be base64 encoded.
326+
This will read a key (corresponding to the provided <literal>--sign-type</literal> from the provided path. The encoding of the key depends on
327+
signature engine. For ed25519 the key should be base64 encoded, for x509 it should be in PEM format, and for dummy it should be an ASCII-string.
327328
</para></listitem>
328329
</varlistentry>
329330

@@ -337,7 +338,7 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
337338
The <literal>KEY-ID</literal> is:
338339
<variablelist>
339340
<varlistentry>
340-
<term><option>for ed25519:</option></term>
341+
<term><option>for ed25519 and x509:</option></term>
341342
<listitem><para>
342343
<literal>base64</literal>-encoded secret key for commit signing.
343344
</para></listitem>

‎man/ostree-sign.xml‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -64,26 +64,28 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
6464
</para>
6565

6666
<para>
67-
There are several "well-known" system places for `ed25519` trusted and revoked public keys -- expected single <literal>base64</literal>-encoded key per line.
67+
For `ed25519` and `x509`, there are several "well-known" system places for trusted and revoked public keys as listed below.
6868
</para>
6969

7070
<para>Files:
7171
<itemizedlist>
72-
<listitem><para><filename>/etc/ostree/trusted.ed25519</filename></para></listitem>
73-
<listitem><para><filename>/etc/ostree/revoked.ed25519</filename></para></listitem>
74-
<listitem><para><filename>/usr/share/ostree/trusted.ed25519</filename></para></listitem>
75-
<listitem><para><filename>/usr/share/ostree/revoked.ed25519</filename></para></listitem>
72+
<listitem><para><filename>/etc/ostree/trusted.<replaceable>SIGN-TYPE</replaceable></filename></para></listitem>
73+
<listitem><para><filename>/etc/ostree/revoked.<replaceable>SIGN-TYPE</replaceable></filename></para></listitem>
74+
<listitem><para><filename>/usr/share/ostree/trusted.<replaceable>SIGN-TYPE</replaceable></filename></para></listitem>
75+
<listitem><para><filename>/usr/share/ostree/revoked.<replaceable>SIGN-TYPE</replaceable></filename></para></listitem>
7676
</itemizedlist>
7777
</para>
7878

7979
<para>Directories containing files with keys:
8080
<itemizedlist>
81-
<listitem><para><filename>/etc/ostree/trusted.ed25519.d</filename></para></listitem>
82-
<listitem><para><filename>/etc/ostree/revoked.ed25519.d</filename></para></listitem>
83-
<listitem><para><filename>/usr/share/ostree/trusted.ed25519.d</filename></para></listitem>
84-
<listitem><para><filename>/usr/share/ostree/revoked.ed25519.d</filename></para></listitem>
81+
<listitem><para><filename>/etc/ostree/trusted.<replaceable>SIGN-TYPE</replaceable>.d</filename></para></listitem>
82+
<listitem><para><filename>/etc/ostree/revoked.<replaceable>SIGN-TYPE</replaceable>.d</filename></para></listitem>
83+
<listitem><para><filename>/usr/share/ostree/trusted.<replaceable>SIGN-TYPE</replaceable>.d</filename></para></listitem>
84+
<listitem><para><filename>/usr/share/ostree/revoked.<replaceable>SIGN-TYPE</replaceable>.d</filename></para></listitem>
8585
</itemizedlist>
8686
</para>
87+
88+
<para>The format of those files depends on the signature mechanism; for `ed25519`, keys are stored in the <literal>base64</literal> encoding per line, while for `x509` they are stored in the PEM "PUBLIC KEY" encoding.</para>
8789
</refsect1>
8890

8991
<refsect1>
@@ -95,7 +97,7 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
9597
<listitem><para>
9698
<variablelist>
9799
<varlistentry>
98-
<term><option>for ed25519:</option></term>
100+
<term><option>for ed25519 and x509:</option></term>
99101
<listitem><para>
100102
<literal>base64</literal>-encoded secret (for signing) or public key (for verifying).
101103
</para></listitem>
@@ -120,7 +122,7 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
120122
<term><option>-s, --sign-type</option></term>
121123
<listitem><para>
122124
Use particular signature mechanism. Currently
123-
available <arg choice="plain">ed25519</arg> and <arg choice="plain">dummy</arg>
125+
available <arg choice="plain">ed25519</arg>, <arg choice="plain">x509</arg>, and <arg choice="plain">dummy</arg>
124126
signature types.
125127

126128
The default is <arg choice="plain">ed25519</arg>.
@@ -133,8 +135,8 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
133135
</para></listitem>
134136

135137
<listitem><para>
136-
Valid for <literal>ed25519</literal> signature type.
137-
For <literal>ed25519</literal> this file must contain <literal>base64</literal>-encoded
138+
Valid for <literal>ed25519</literal> and <literal>x509</literal> signature types.
139+
This file must contain <literal>base64</literal>-encoded
138140
secret key(s) (for signing) or public key(s) (for verifying) per line.
139141
</para></listitem>
140142
</varlistentry>

‎rust-bindings/sys/tests/constant.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ main ()
157157
PRINT_CONSTANT (OSTREE_SHA256_DIGEST_LEN);
158158
PRINT_CONSTANT (OSTREE_SHA256_STRING_LEN);
159159
PRINT_CONSTANT (OSTREE_SIGN_NAME_ED25519);
160+
PRINT_CONSTANT (OSTREE_SIGN_NAME_X509);
160161
PRINT_CONSTANT ((gint)OSTREE_STATIC_DELTA_GENERATE_OPT_LOWLATENCY);
161162
PRINT_CONSTANT ((gint)OSTREE_STATIC_DELTA_GENERATE_OPT_MAJOR);
162163
PRINT_CONSTANT ((gint)OSTREE_STATIC_DELTA_INDEX_FLAGS_NONE);

0 commit comments

Comments
 (0)