lukpueh
commented
6 years ago Here is a shell snippet that tests securesystemslib's encode_canonical function against the gibson042/canonicaljson-spec.
mkvirtualenv secsyslib-canonical # Optional
pip install securesystemslib
git clone git@github.com:gibson042/canonicaljson-spec.git
cd canonicaljson-spec
cat >secsyslib_canonical_json.py <<EOL
#!/usr/bin/env python
import sys, json, securesystemslib.formats
# Load JSON file passed as first argument by test.sh
with open(sys.argv[1]) as fobj:
json_data = json.load(fobj)
json_canonical = securesystemslib.formats.encode_canonical(json_data)
# Write canonicalized json to stdout from where it is read by test.sh
sys.stdout.write(json_canonical)
EOL
chmod 755 secsyslib_canonical_json.py
PATH=$PATH:${PWD} ./test.sh secsyslib_canonical_json.py
JustinCappos
joshuagl
heartsucker
mnm678
Description of issue or feature request: Securesystemslib provides a custom json canonicalization function based on this Canonical JSON specification.
The specification seems outdated, or at least is not compatible with newer and more detailed specifications, such as the gibson042/canonicaljson-spec, for which a Go implementation exists.
The Notary Go implementation of TUF uses its own canonical JSON implementation which (IIUC) does not conform with any of above two specifications, but looks similar to the latter.
Current behavior: securesystemslib uses an outdated JSON canonicalization specification.
Expected behavior: I wonder if we should update securesystemlib's JSON canonicalization, or, given that there is no single accepted specification, switch to something that has wider cross-language support?
Note: I am well aware that this is a bigger request, as it would break backwards compatibility for metadata signatures used in TUF and in-toto, and would therefor require a TAP or ITE.