73 lines
2.5 KiB
Python
73 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Sign mirror-thin-v1 artefacts using an Ed25519 key and emit DSSE + TUF signatures.
|
|
|
|
Usage:
|
|
python scripts/mirror/sign_thin_bundle.py \
|
|
--key out/mirror/thin/tuf/keys/mirror-ed25519-test-1.pem \
|
|
--manifest out/mirror/thin/mirror-thin-v1.manifest.json \
|
|
--tar out/mirror/thin/mirror-thin-v1.tar.gz \
|
|
--tuf-dir out/mirror/thin/tuf
|
|
|
|
Writes:
|
|
- mirror-thin-v1.manifest.dsse.json
|
|
- updates signatures in root.json, targets.json, snapshot.json, timestamp.json
|
|
"""
|
|
import argparse, base64, json, pathlib, hashlib
|
|
from cryptography.hazmat.primitives import serialization
|
|
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
|
|
|
def b64url(data: bytes) -> str:
|
|
return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
|
|
|
|
def load_key(path: pathlib.Path) -> Ed25519PrivateKey:
|
|
return serialization.load_pem_private_key(path.read_bytes(), password=None)
|
|
|
|
def keyid_from_pub(pub_path: pathlib.Path) -> str:
|
|
raw = pub_path.read_bytes()
|
|
return hashlib.sha256(raw).hexdigest()
|
|
|
|
def sign_bytes(key: Ed25519PrivateKey, data: bytes) -> bytes:
|
|
return key.sign(data)
|
|
|
|
def write_json(path: pathlib.Path, obj):
|
|
path.write_text(json.dumps(obj, indent=2, sort_keys=True) + "\n")
|
|
|
|
def sign_tuf(path: pathlib.Path, keyid: str, key: Ed25519PrivateKey):
|
|
data = path.read_bytes()
|
|
sig = sign_bytes(key, data)
|
|
obj = json.loads(data)
|
|
obj["signatures"] = [{"keyid": keyid, "sig": b64url(sig)}]
|
|
write_json(path, obj)
|
|
|
|
def main():
|
|
ap = argparse.ArgumentParser()
|
|
ap.add_argument("--key", required=True, type=pathlib.Path)
|
|
ap.add_argument("--manifest", required=True, type=pathlib.Path)
|
|
ap.add_argument("--tar", required=True, type=pathlib.Path)
|
|
ap.add_argument("--tuf-dir", required=True, type=pathlib.Path)
|
|
args = ap.parse_args()
|
|
|
|
key = load_key(args.key)
|
|
pub_path = args.key.with_suffix(".pub")
|
|
keyid = keyid_from_pub(pub_path)
|
|
|
|
manifest_bytes = args.manifest.read_bytes()
|
|
sig = sign_bytes(key, manifest_bytes)
|
|
dsse = {
|
|
"payloadType": "application/vnd.stellaops.mirror.manifest+json",
|
|
"payload": b64url(manifest_bytes),
|
|
"signatures": [{"keyid": keyid, "sig": b64url(sig)}],
|
|
}
|
|
dsse_path = args.manifest.with_suffix(".dsse.json")
|
|
write_json(dsse_path, dsse)
|
|
|
|
# update TUF metadata
|
|
for name in ["root.json", "targets.json", "snapshot.json", "timestamp.json"]:
|
|
sign_tuf(args.tuf_dir / name, keyid, key)
|
|
|
|
print(f"Signed DSSE + TUF using keyid {keyid}; DSSE -> {dsse_path}")
|
|
|
|
if __name__ == "__main__":
|
|
main()
|