repo: Add workaround for sigstore KMS keyid #423
Conversation
|
I don't have the GCP permissions to test this but Bob confirmed the current version is 1. |
The sigstore root-signing online key keyid was entered incorrectly: Add a workaround here so there is more time to fix the actual keyid. Fixes theupdateframework#422
jku
force-pushed
the
workaround-sigstore-kms-keyid
branch
from
d7c03ca
to
1d90720
Compare
|
There were actually two issues with the key, both appeared because I just copied the similar looking but not same format from legacy root-signing:
This is the incorrect legacy format: |
| @@ -228,6 +228,15 @@ def close(self, rolename: str, md: Metadata) -> None: | |||
| for key in self._get_keys(rolename): | |||
| if rolename in ["timestamp", "snapshot"]: | |||
| uri = key.unrecognized_fields[TAG_ONLINE_URI] | |||
|
|
|||
| # FIXME: workaround for issue #422, only needed while sigstore | |||
| # root-signing online key keyid is incorrect | |||
There was a problem hiding this comment.
Instead of this hard coded rewrite, how about a version that detects invalid format (wrong scheme and missing version) and use that before instantiating the key via Signer.priv_key_from_uri?
The sigstore root-signing online key keyid was entered incorrectly: Add a workaround here so there is more time to fix the actual keyid.
Fixes #422
DRAFT while I am not sure of the actual key version