198 lines
6.3 KiB
Bash
198 lines
6.3 KiB
Bash
#!/bin/bash
|
|
# -----------------------------------------------------------------------------
|
|
# rotate-rekor-key.sh
|
|
# Sprint: SPRINT_20260125_003_Attestor_trust_workflows_conformance
|
|
# Task: WORKFLOW-002 - Create key rotation workflow script
|
|
# Description: Rotate Rekor public key with grace period
|
|
# -----------------------------------------------------------------------------
|
|
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
|
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
|
log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }
|
|
|
|
usage() {
|
|
echo "Usage: $0 <phase> [options]"
|
|
echo ""
|
|
echo "Rotate Rekor public key through a dual-key grace period."
|
|
echo ""
|
|
echo "Phases:"
|
|
echo " add-key Add new key to TUF (starts grace period)"
|
|
echo " verify Verify both keys are active"
|
|
echo " remove-old Remove old key (after grace period)"
|
|
echo ""
|
|
echo "Options:"
|
|
echo " --repo DIR TUF repository directory"
|
|
echo " --new-key FILE Path to new Rekor public key"
|
|
echo " --new-key-name NAME Target name for new key (default: rekor-key-v{N+1})"
|
|
echo " --old-key-name NAME Target name for old key to remove"
|
|
echo " --grace-days N Grace period in days (default: 7)"
|
|
echo " -h, --help Show this help message"
|
|
echo ""
|
|
echo "Example (3-phase rotation):"
|
|
echo " # Phase 1: Add new key"
|
|
echo " $0 add-key --repo /path/to/tuf --new-key rekor-key-v2.pub"
|
|
echo ""
|
|
echo " # Wait for grace period (clients sync)"
|
|
echo " sleep 7d"
|
|
echo ""
|
|
echo " # Phase 2: Verify"
|
|
echo " $0 verify"
|
|
echo ""
|
|
echo " # Phase 3: Remove old key"
|
|
echo " $0 remove-old --repo /path/to/tuf --old-key-name rekor-key-v1"
|
|
exit 1
|
|
}
|
|
|
|
PHASE=""
|
|
REPO_DIR=""
|
|
NEW_KEY=""
|
|
NEW_KEY_NAME=""
|
|
OLD_KEY_NAME=""
|
|
GRACE_DAYS=7
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
add-key|verify|remove-old)
|
|
PHASE="$1"
|
|
shift
|
|
;;
|
|
--repo) REPO_DIR="$2"; shift 2 ;;
|
|
--new-key) NEW_KEY="$2"; shift 2 ;;
|
|
--new-key-name) NEW_KEY_NAME="$2"; shift 2 ;;
|
|
--old-key-name) OLD_KEY_NAME="$2"; shift 2 ;;
|
|
--grace-days) GRACE_DAYS="$2"; shift 2 ;;
|
|
-h|--help) usage ;;
|
|
*) log_error "Unknown argument: $1"; usage ;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "$PHASE" ]]; then
|
|
log_error "Phase is required"
|
|
usage
|
|
fi
|
|
|
|
echo ""
|
|
echo "================================================"
|
|
echo " Rekor Key Rotation - Phase: $PHASE"
|
|
echo "================================================"
|
|
echo ""
|
|
|
|
case "$PHASE" in
|
|
add-key)
|
|
if [[ -z "$REPO_DIR" ]] || [[ -z "$NEW_KEY" ]]; then
|
|
log_error "add-key requires --repo and --new-key"
|
|
usage
|
|
fi
|
|
|
|
if [[ ! -f "$NEW_KEY" ]]; then
|
|
log_error "New key file not found: $NEW_KEY"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -d "$REPO_DIR" ]]; then
|
|
log_error "TUF repository not found: $REPO_DIR"
|
|
exit 1
|
|
fi
|
|
|
|
# Determine new key name if not specified
|
|
if [[ -z "$NEW_KEY_NAME" ]]; then
|
|
# Find highest version and increment
|
|
HIGHEST=$(ls "$REPO_DIR/targets/" 2>/dev/null | grep -E '^rekor-key-v[0-9]+' | \
|
|
sed 's/rekor-key-v//' | sed 's/\.pub$//' | sort -n | tail -1 || echo "0")
|
|
NEW_VERSION=$((HIGHEST + 1))
|
|
NEW_KEY_NAME="rekor-key-v${NEW_VERSION}"
|
|
fi
|
|
|
|
log_step "Adding new Rekor key: $NEW_KEY_NAME"
|
|
log_info "Source: $NEW_KEY"
|
|
|
|
# Copy key to targets
|
|
cp "$NEW_KEY" "$REPO_DIR/targets/${NEW_KEY_NAME}.pub"
|
|
|
|
# Add to targets.json
|
|
if [[ -x "$REPO_DIR/scripts/add-target.sh" ]]; then
|
|
"$REPO_DIR/scripts/add-target.sh" "$REPO_DIR/targets/${NEW_KEY_NAME}.pub" "${NEW_KEY_NAME}.pub" --repo "$REPO_DIR"
|
|
else
|
|
log_warn "add-target.sh not found, updating targets.json manually required"
|
|
fi
|
|
|
|
log_info ""
|
|
log_info "Key added: $NEW_KEY_NAME"
|
|
log_info ""
|
|
log_warn "IMPORTANT: Dual-key period has started."
|
|
log_warn "Wait at least $GRACE_DAYS days before running 'remove-old' phase."
|
|
log_warn "During this time, clients will sync and receive both keys."
|
|
log_info ""
|
|
log_info "Next steps:"
|
|
echo " 1. Sign and publish updated TUF metadata"
|
|
echo " 2. Monitor client sync status"
|
|
echo " 3. After $GRACE_DAYS days, run: $0 remove-old --repo $REPO_DIR --old-key-name <old-key>"
|
|
;;
|
|
|
|
verify)
|
|
log_step "Verifying key rotation status..."
|
|
|
|
# Check local trust state
|
|
stella trust status --show-keys
|
|
|
|
log_info ""
|
|
log_info "Verify that:"
|
|
echo " 1. Both old and new Rekor keys are listed"
|
|
echo " 2. Service endpoints are resolving correctly"
|
|
echo " 3. Attestations signed with old key still verify"
|
|
;;
|
|
|
|
remove-old)
|
|
if [[ -z "$REPO_DIR" ]] || [[ -z "$OLD_KEY_NAME" ]]; then
|
|
log_error "remove-old requires --repo and --old-key-name"
|
|
usage
|
|
fi
|
|
|
|
if [[ ! -d "$REPO_DIR" ]]; then
|
|
log_error "TUF repository not found: $REPO_DIR"
|
|
exit 1
|
|
fi
|
|
|
|
OLD_KEY_FILE="$REPO_DIR/targets/${OLD_KEY_NAME}.pub"
|
|
if [[ ! -f "$OLD_KEY_FILE" ]]; then
|
|
OLD_KEY_FILE="$REPO_DIR/targets/${OLD_KEY_NAME}"
|
|
fi
|
|
|
|
if [[ ! -f "$OLD_KEY_FILE" ]]; then
|
|
log_error "Old key not found: $OLD_KEY_NAME"
|
|
exit 1
|
|
fi
|
|
|
|
log_step "Removing old Rekor key: $OLD_KEY_NAME"
|
|
log_warn "This is IRREVERSIBLE. Ensure all clients have synced the new key."
|
|
|
|
read -p "Type 'CONFIRM' to proceed: " CONFIRM
|
|
if [[ "$CONFIRM" != "CONFIRM" ]]; then
|
|
log_error "Aborted"
|
|
exit 1
|
|
fi
|
|
|
|
# Remove key file
|
|
rm -f "$OLD_KEY_FILE"
|
|
|
|
# Remove from targets.json (simplified - production should use proper JSON manipulation)
|
|
log_warn "Remember to update targets.json to remove the old key entry"
|
|
log_warn "Then sign and publish the updated metadata"
|
|
|
|
log_info ""
|
|
log_info "Old key removed: $OLD_KEY_NAME"
|
|
log_info "Key rotation complete!"
|
|
;;
|
|
esac
|
|
|
|
echo ""
|