[tuf] Store rkth/sign hashes in TUF repo description (#8729)

This commit introduces a new field in `TufArtifactMeta` that maps an
RoT/RoT bootloader artifact with its associated sign. This will be
necessary for the planner to support
[RoT](#8421) and [RoT
bootloader](#8664) updates.

Author: karencfv

common/src/api/external/mod.rs

@@ -3408,6 +3408,12 @@ pub struct TufArtifactMeta {
 
     /// The size of the artifact in bytes.
     pub size: u64,
+
+    /// Contents of the `SIGN` field of a Hubris archive caboose, i.e.,
+    /// an identifier for the set of valid signing keys. Currently only
+    /// applicable to RoT image and bootloader artifacts, where it will
+    /// be an LPC55 Root Key Table Hash (RKTH).
+    pub sign: Option<Vec<u8>>,
 }
 
 /// Data about a successful TUF repo import into Nexus.

nexus/db-model/src/schema_versions.rs

@@ -16,7 +16,7 @@ use std::{collections::BTreeMap, sync::LazyLock};
 ///
 /// This must be updated when you change the database schema.  Refer to
 /// schema/crdb/README.adoc in the root of this repository for details.
-pub const SCHEMA_VERSION: Version = Version::new(173, 0, 0);
+pub const SCHEMA_VERSION: Version = Version::new(174, 0, 0);
 
 /// List of all past database schema versions, in *reverse* order
 ///
@@ -28,6 +28,7 @@ static KNOWN_VERSIONS: LazyLock<Vec<KnownVersion>> = LazyLock::new(|| {
         // |  leaving the first copy as an example for the next person.
         // v
         // KnownVersion::new(next_int, "unique-dirname-with-the-sql-files"),
+        KnownVersion::new(174, "add-tuf-rot-by-sign"),
         KnownVersion::new(173, "inv-internal-dns"),
         KnownVersion::new(172, "add-zones-with-mupdate-override"),
         KnownVersion::new(171, "inv-clear-mupdate-override"),

nexus/db-model/src/tuf_repo.rs

@@ -165,6 +165,7 @@ pub struct TufArtifact {
     pub sha256: ArtifactHash,
     artifact_size: i64,
     pub generation_added: Generation,
+    pub sign: Option<Vec<u8>>,
 }
 
 impl TufArtifact {
@@ -174,6 +175,7 @@ impl TufArtifact {
         sha256: ArtifactHash,
         artifact_size: u64,
         generation_added: external::Generation,
+        sign: Option<Vec<u8>>,
     ) -> Self {
         Self {
             id: TypedUuid::new_v4().into(),
@@ -184,6 +186,7 @@ impl TufArtifact {
             sha256,
             artifact_size: artifact_size as i64,
             generation_added: generation_added.into(),
+            sign,
         }
     }
 
@@ -202,6 +205,7 @@ impl TufArtifact {
             artifact.hash.into(),
             artifact.size,
             generation_added,
+            artifact.sign,
         )
     }
 
@@ -215,6 +219,7 @@ impl TufArtifact {
             },
             hash: self.sha256.into(),
             size: self.artifact_size as u64,
+            sign: self.sign,
         }
     }
 

nexus/db-queries/src/db/datastore/deployment.rs

@@ -3197,6 +3197,7 @@ mod tests {
                                 },
                                 hash: ZONE_ARTIFACT_HASH_1,
                                 size: 0,
+                                sign: None,
                             },
                             TufArtifactMeta {
                                 id: ArtifactId {
@@ -3206,6 +3207,7 @@ mod tests {
                                 },
                                 hash: HOST_ARTIFACT_HASH_1,
                                 size: 0,
+                                sign: None,
                             },
                             TufArtifactMeta {
                                 id: ArtifactId {
@@ -3215,6 +3217,7 @@ mod tests {
                                 },
                                 hash: HOST_ARTIFACT_HASH_2,
                                 size: 0,
+                                sign: None,
                             },
                         ],
                     },

nexus/db-queries/src/db/datastore/target_release.rs

@@ -228,6 +228,7 @@ mod test {
                         },
                         hash,
                         size: 0,
+                        sign: None,
                     }],
                 },
             )

nexus/db-schema/src/schema.rs

@@ -1415,6 +1415,7 @@ table! {
         sha256 -> Text,
         artifact_size -> Int8,
         generation_added -> Int8,
+        sign -> Nullable<Binary>,
     }
 }
 

nexus/reconfigurator/planning/src/mgs_updates/mod.rs

@@ -693,7 +693,8 @@ mod test {
                 kind: kind.into(),
             },
             hash,
-            size: 0, // unused here
+            size: 0,    // unused here
+            sign: None, // unused here
         }
     }
 

nexus/reconfigurator/planning/src/planner.rs

@@ -5531,6 +5531,7 @@ pub(crate) mod test {
                 },
                 hash: ArtifactHash([0; 32]),
                 size: 0,
+                sign: None,
             }
         };
     }

openapi/nexus.json

@@ -25384,6 +25384,16 @@
               }
             ]
           },
+          "sign": {
+            "nullable": true,
+            "description": "Contents of the `SIGN` field of a Hubris archive caboose, i.e., an identifier for the set of valid signing keys. Currently only applicable to RoT image and bootloader artifacts, where it will be an LPC55 Root Key Table Hash (RKTH).",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "uint8",
+              "minimum": 0
+            }
+          },
           "size": {
             "description": "The size of the artifact in bytes.",
             "type": "integer",

schema/crdb/add-tuf-rot-by-sign/up1.sql

@@ -0,0 +1 @@
+ALTER TABLE omicron.public.tuf_artifact ADD COLUMN IF NOT EXISTS sign BYTES;