search

gittuf / gittuf

A security layer for Git repositories
https://gittuf.dev
Apache License 2.0
439 stars 28 forks source link

Add ssh Key <-> SSlibKey conversion functions #429

Closed lukpueh closed 2 weeks ago

lukpueh commented 2 weeks ago

Add functions to convert an ssh Key to an SSlibKey and vice versa.

This can be used to include an ssh Key in TUF metadata (which expects an SSlibKey) and to again extract it for ssh signature verification.

A basic unit test and a TUF metadata usage example (as test) is included.

lukpueh commented 2 weeks ago

I'd like to give some additional context for this PR. My original intention for ssh Key was to satisfy both the dsse.Verifier interface, and a hypothetical "Key-in-TUF-metadata" interface (currently this is the SSlibKey struct).

This idea is modeled after the python-tuf/secureystemslib Key API design, which provides a Key interface, defining the metadata container (keyid, keytype, scheme, keyval), de/serialization methods, and a verify method. To instantiate a concrete Key, we call a factory function, when deserializing TUF metadata. The factory looks up a global map of keytype/scheme pairs to Key implementations. This allows adding support for new keys without changing existing code. The key types just need to be registered in the global map.

I realize now that this idea does not fit well in the current gittuf design, where:

  1. Key and Verifier are separated
  2. Key-to-Verifier conversion is performed explicitly in New*VerifierFrom*Key functions

It seems easier to update my code to fit the gittuf model, than the other way around. Also, separating Key and Verifier does not contradict dynamic dispatch via global map. It would just happen at a different time.

I'll propose another PR on top of this one.

lukpueh commented 2 weeks ago

Superseded by #433