theupdateframework / go-tuf

Go implementation of The Update Framework (TUF)
https://theupdateframework.com
Apache License 2.0
630 stars 108 forks source link

fix: fail to load deprecated ecdsa verifier #541

Closed rdimitrov closed 1 year ago

rdimitrov commented 1 year ago

Description of the changes being introduced by the pull request:

The following PR updates the set_ecdsa package to use the correct verifier for the deprecated ECDSA key type - deprecated is hex encoded, and the compliant one is PEM-formatted.

The deprecated verifier is added for both key type formats - "ecdsa" and "ecdsa-sha2-nistp256".

Once this is merged, there will be a patch release of v0.6.1 which should include it.

Fixes #527

Release Notes:

Types of changes:

Please verify and check that the pull request fulfills the following requirements:

rdimitrov commented 1 year ago

I wonder if we should disable govulncheck for the time being. It's nice, but it cannot be configured to silence vulnerabilities. In this case, it's referring to getting the fix from an unstable version which is not ideal.

Update: I've decided to add a -json flag so it still runs but it doesn't fail the CI.

rdimitrov commented 1 year ago

cc: @asraa @haydentherapper

haydentherapper commented 1 year ago

Can we get this merged and a new release cut?

rdimitrov commented 1 year ago

Can we get this merged and a new release cut?

Yes, unfortunately, I cannot merge it unless there're 2 maintainer approvals :/

ping @mnm678 @trishankatdatadog @kommendorkapten