Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to disable non default signature algorithm(s) #5

Open
wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Ability to disable non default signature algorithm(s) #5

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
9d4b869
chore: update dependencies
bobhageman Oct 11, 2023
bdd928e
feat: option to disable default signing algorithm
bobhageman Oct 12, 2023
bc4a775
chore: fix typo
bobhageman Oct 19, 2023
fef1bc8
feat: add docker support
bobhageman Oct 19, 2023
bfbab04
improve: make build static
bobhageman Oct 25, 2023
9e38615
improve: use non-root user and configurable locations
bobhageman Oct 30, 2023
46c1c2a
s/secrests/secrets/
sanderhollaar Oct 30, 2023
612e0f1
improve: simplify secrets location
bobhageman Oct 30, 2023
7594cbe
Merge pull request #5 from privacybydesign/disable-algorithm
bobhageman Nov 1, 2023
d53a271
feat: build and publish container to ghcr workflow
bobhageman Nov 1, 2023
335da4f
chore: add newline to end of file
bobhageman Nov 1, 2023
757ff9c
Merge pull request #6 from privacybydesign/dockerize
bobhageman Nov 7, 2023
174f11a
relax file permission check on Ed25519KeyPath
sanderhollaar Dec 4, 2023
d5a2f5e
remove Ed25519KeyPath permission check
sanderhollaar Dec 4, 2023
fb5f005
Merge pull request #7 from privacybydesign/relax-file-permission-chec…
sanderhollaar Dec 4, 2023
808d59a
fileInfo declared and not used
sanderhollaar Dec 4, 2023
7520baa
Merge pull request #8 from privacybydesign/relax-file-permission-chec…
sanderhollaar Dec 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions config.yaml.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,12 @@ acceptableLag: 60
# The default signature algorithm. Either ed25519 or xmssmt.
defaultSigAlg: xmssmt

# Whether or not other signature algorithms besides defaultSigAlg
# are disabled. This is useful if you only want to support one algorithm.
# NOTE: if true, you can still verify validity of timestamps generated with
# any other supported algorithm for the keys listed in otherTrustedPublicKeys
disableOtherSigAlg: false
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This presumes that either there only will be two signature algorithms supported or that you'd only want to enable one of them. It seems more logical to me to have an option enabledSigAlgs, and then perhaps interpret the first as the default.

Why do you want to disable one of them btw?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently Yivi is creating a PoC moving the infrastructure into a cloud agnostic environment. Since we are only using ed25519 and we need atumd to be stateless, this small change is (for us) the least intrusive way to make that happen. No change in config needed to keep the current situation running while it is possible to disable all other algorithms (for now only XMSS[MT]) except the default one in our cloud setup.
Thought this could be a nice addition in functionality, hence the pr. On the other hand I also agree with you that the other way around with an option like enabledSigAlgs would be a nice approach.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sgtm!


# Path to store private keys. Will be generated if not present.
# WARNING: do not make backups or copies of xmssmt.key. See the README.
xmssmtKeyPath: xmssmt.key
Expand Down
31 changes: 26 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,36 @@
module github.com/bwesterb/atumd

go 1.14
go 1.19

require (
github.com/bwesterb/go-atum v1.1.5
github.com/bwesterb/go-pow v1.0.0
github.com/bwesterb/go-xmssmt v1.5.2
github.com/go-chi/cors v1.2.1
github.com/prometheus/client_golang v1.12.2
github.com/prometheus/common v0.35.0 // indirect
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
google.golang.org/protobuf v1.28.0 // indirect
github.com/prometheus/client_golang v1.17.0
golang.org/x/crypto v0.14.0
gopkg.in/yaml.v2 v2.4.0
)

require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/bwesterb/byteswriter v1.0.0 // indirect
github.com/cespare/xxhash v1.1.0 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/edsrzf/mmap-go v1.1.0 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
github.com/nightlyone/lockfile v1.0.0 // indirect
github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
github.com/prometheus/common v0.44.0 // indirect
github.com/prometheus/procfs v0.11.1 // indirect
github.com/templexxx/cpu v0.0.9 // indirect
github.com/templexxx/xorsimd v0.4.1 // indirect
github.com/timshannon/bolthold v0.0.0-20210913165410-232392fc8a6a // indirect
go.etcd.io/bbolt v1.3.6 // indirect
golang.org/x/sys v0.13.0 // indirect
google.golang.org/protobuf v1.31.0 // indirect
)
Loading