Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support OpenPGP keyrings in release #100

Merged
merged 1 commit into from
Oct 20, 2023
Merged

Support OpenPGP keyrings in release #100

merged 1 commit into from
Oct 20, 2023

Conversation

woky
Copy link
Contributor

@woky woky commented Oct 18, 2023 •
edited
Loading

Support OpenPGP keyrings in release

This commit extends the chisel release with keyring definitions.
Keyrings are defined in ASCII armored format in the top-level
public-keys property by name. Keyrings are referenced by name in the
public-keys list property in archive definitions. An example of the
extended chisel release file is at the bottom.

This commit uses the newly added github.com/ProtonMail/go-crypto/openpgp
package dependency[1]. This package is a maintained fork of the
deprecated golang.org/x/crypto/openpgp package[2][3].

[1] https://github.com/ProtonMail/go-crypto
[2] https://pkg.go.dev/golang.org/x/crypto/openpgp
[3] https://golang.org/issue/44226

Example chisel.yaml:

  format: chisel-v1
  archives:
    ubuntu:
      version: 22.04
      components: [main, universe]
      suites: [jammy, jammy-updates, jammy-security]
      public-keys: [ubuntu]
    ubuntu-fips:
      version: 22.04
      pro: fips
      components: [main]
      suites: [jammy]
      public-keys: [ubuntu-fips]
  public-keys:
    ubuntu: |
      -----BEGIN PGP PUBLIC KEY BLOCK-----

      mQINBFzZxGABEADSWmX0+K//0cosKPyr5m1ewmwWKjRo/KBPTyR8icHhbBWfFd8T
      DtYggvQHPU0YnKRcWits0et8JqSgZttNa28s7SaSUTBzfgzFJZgULAi/4i8u8TUj
      +KH2zSoUX55NKC9aozba1cR66jM6O/BHXK5YoZzTpmiY1AHlIWAJ9s6cCClhnYMR
      ...
      E+SWDGxtgwixyPziL56UavL/eeYJWeS/WqvGzZzsAtgSujFVLKWyUaRi0NvYW3h/
      I50Tzj0Pkm8GtgvP2UqAWvy+iRpeUQ2ji0Nc
      =j6+P
      -----END PGP PUBLIC KEY BLOCK-----
    ubuntu-fips: |
      -----BEGIN PGP PUBLIC KEY BLOCK-----

      mQINBE+tgXgBEADfiL1KNFHT4H4Dw0OR9LemR8ebsFl+b9E44IpGhgWYDufj0gaM
      /UJ1Ti3bHfRT39VVZ6cv1P4mQy0bnAKFbYz/wo+GhzjBWtn6dThYv7n+KL8bptSC
      Xgg1a6en8dCCIA/pwtS2Ut/g4Eu6Z467dvYNlMgCqvg+prKIrXf5ibio48j3AFvd
      ...
      mguPI1KLfnVnXnsT5JYMbG2DCLHI/OIvnpRq8v955glZ5L9aq8bNnOwC2BK6MVUs
      pbJRpGLQ29hbeH8jnRPOPQ+Sbwa2C8/ZSoBa/L6JGl5RDaOLQ1w=
      =6Bkw
      -----END PGP PUBLIC KEY BLOCK-----

@woky woky added the Priority Look at me first label Oct 18, 2023
@woky woky changed the title Support OpenPGP keyrings in release Verify signatures Oct 19, 2023
@woky woky changed the title Verify signatures Verify release signatures Oct 19, 2023
benhoyt
benhoyt approved these changes Oct 19, 2023
View reviewed changes
Copy link

@benhoyt benhoyt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just one comment about (not) including all the test data in the test.go file.

Also, I've reviewed for Go style and it looks good, but I don't have a good handle on the domain or security implications. Would be worth getting a security / PGP expert to look over this!

internal/setup/setup_test.go Outdated Show resolved Hide resolved
internal/archive/testdata/chisel-test.asc Outdated Show resolved Hide resolved
cjdcordeiro
cjdcordeiro reviewed Oct 20, 2023
View reviewed changes
Copy link
Collaborator

@cjdcordeiro cjdcordeiro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tests are failing because we are missing the keys in the chisel-releases' chisel.yaml file right?

@woky
Support OpenPGP keyrings in release
56cb966 
This commit extends the chisel release with keyring definitions.
Keyrings are defined in ASCII armored format in the top-level
public-keys property by name. Keyrings are referenced by name in the
public-keys list property in archive definitions. An example of the
extended chisel release file is at the bottom.

This commit uses the newly added github.com/ProtonMail/go-crypto/openpgp
package dependency[1]. This package is a maintained fork of the
deprecated golang.org/x/crypto/openpgp package[2][3].

[1] https://github.com/ProtonMail/go-crypto
[2] https://pkg.go.dev/golang.org/x/crypto/openpgp
[3] https://golang.org/issue/44226

Example chisel.yaml:

    format: chisel-v1
    archives:
      ubuntu:
        version: 22.04
        components: [main, universe]
        suites: [jammy, jammy-updates, jammy-security]
        public-keys: [ubuntu]
      ubuntu-fips:
        version: 22.04
        pro: fips
        components: [main]
        suites: [jammy]
        public-keys: [ubuntu-fips]
    public-keys:
      ubuntu: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----

        mQINBFzZxGABEADSWmX0+K//0cosKPyr5m1ewmwWKjRo/KBPTyR8icHhbBWfFd8T
        DtYggvQHPU0YnKRcWits0et8JqSgZttNa28s7SaSUTBzfgzFJZgULAi/4i8u8TUj
        +KH2zSoUX55NKC9aozba1cR66jM6O/BHXK5YoZzTpmiY1AHlIWAJ9s6cCClhnYMR
        ...
        E+SWDGxtgwixyPziL56UavL/eeYJWeS/WqvGzZzsAtgSujFVLKWyUaRi0NvYW3h/
        I50Tzj0Pkm8GtgvP2UqAWvy+iRpeUQ2ji0Nc
        =j6+P
        -----END PGP PUBLIC KEY BLOCK-----
      ubuntu-fips: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----

        mQINBE+tgXgBEADfiL1KNFHT4H4Dw0OR9LemR8ebsFl+b9E44IpGhgWYDufj0gaM
        /UJ1Ti3bHfRT39VVZ6cv1P4mQy0bnAKFbYz/wo+GhzjBWtn6dThYv7n+KL8bptSC
        Xgg1a6en8dCCIA/pwtS2Ut/g4Eu6Z467dvYNlMgCqvg+prKIrXf5ibio48j3AFvd
        ...
        mguPI1KLfnVnXnsT5JYMbG2DCLHI/OIvnpRq8v955glZ5L9aq8bNnOwC2BK6MVUs
        pbJRpGLQ29hbeH8jnRPOPQ+Sbwa2C8/ZSoBa/L6JGl5RDaOLQ1w=
        =6Bkw
        -----END PGP PUBLIC KEY BLOCK-----
@woky woky changed the title Verify release signatures Support OpenPGP keyrings in release Oct 20, 2023
@woky woky mentioned this pull request Oct 20, 2023
Closed
woky added a commit to canonical/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
87821f4 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to canonical/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
d8e31af 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
58ee7c2 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
6535ece 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
This was referenced Oct 20, 2023
Closed
Closed
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
ee5c17a 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
99f0146 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
@woky woky mentioned this pull request Oct 20, 2023
Closed
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
48b85a3 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
@woky woky mentioned this pull request Oct 20, 2023
Closed
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
0157c3a 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

  gpg --no-default-keyring \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
      --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
      --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
@woky woky mentioned this pull request Oct 20, 2023
Closed
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
667af42 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

    gpg --no-default-keyring \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
        --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
bb9f6fc 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

    gpg --no-default-keyring \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
        --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
9ae7961 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

    gpg --no-default-keyring \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
        --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
8662cdc 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

    gpg --no-default-keyring \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
        --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
woky added a commit to woky/chisel-releases that referenced this pull request Oct 20, 2023
@woky
Add Ubuntu archive signing keys
04f934c 
This commit adds Ubuntu archive signing keys.

The keyring was obtained by running the following command on Ubuntu jammy:

    gpg --no-default-keyring \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg \
        --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg \
        --export --armor

This commit depends on Chisel support for OpenPGP keyrings. This
feature is currently under review[1].

[1] canonical/chisel#100
@woky
Copy link
Contributor Author

woky commented Oct 20, 2023

The tests are failing because we are missing the keys in the chisel-releases' chisel.yaml file right?

Indeed. I've split the commit that adds signature verification into #102. That way, this PR can be merged with CI checks passed. Then, after keyrings are merged into chisel-releases (see the PRs), #102 can be merged.

niemeyer
niemeyer approved these changes Oct 20, 2023
View reviewed changes
Copy link
Contributor

@niemeyer niemeyer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice and clean, thank you.

@niemeyer niemeyer merged commit 6bf6d46 into canonical:main Oct 20, 2023
14 checks passed
rebornplusplus added a commit to rebornplusplus/chisel that referenced this pull request Dec 1, 2023
@rebornplusplus
Revert "feat: support OpenPGP keyrings in release (canonical#100)"
6b6d1bf 
This reverts commit 6bf6d46.
letFunny pushed a commit to letFunny/chisel that referenced this pull request Dec 11, 2023
@rebornplusplus @letFunny
Revert "feat: support OpenPGP keyrings in release (canonical#100)"
3e8a881 
This reverts commit 6bf6d46.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cjdcordeiro cjdcordeiro cjdcordeiro left review comments

@benhoyt benhoyt benhoyt approved these changes

@niemeyer niemeyer niemeyer approved these changes

@rebornplusplus rebornplusplus Awaiting requested review from rebornplusplus

Assignees

@niemeyer niemeyer

Labels
Priority Look at me first
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@woky @niemeyer @benhoyt @cjdcordeiro