Closed jku closed 3 months ago
Fixing the initial key creation in tuf-on-ci seems doable: make a wrapper for modifying the custom fields, have the wrapper also re-calculate the keyid
There are a couple of issues though:
The alternative "solution" is to push for a spec change:
This is quite unfortunate, and as @jku points out, having a good set of conformance tests would have helped us here, as apparently almost no client is verifying the key ids so this bug didn't get surfaced.
having a good set of conformance tests would have helped us here, as apparently almost no client is verifying the key ids so this bug didn't get surfaced.
I'm probably partly to blame for that since I've been quite vocal about my distaste for the keyid calculation requirement... That said, if we had had a conformance test suite it would have pushed us to make the spec change or at least clearly document this (instead of just ignoring that bit of the spec).
I filed the spec issue as well https://github.com/theupdateframework/specification/issues/305
Recap:
--force-compliant-keyids
flag was added to tuf-on-ci-delegate
: This can be used to create a signing event
that fixes already published root and targets metadata