Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

signer: deduplicate signing scheme dissection #594

Open
lukpueh opened this issue May 31, 2023 · 0 comments · May be fixed by #837
Open

signer: deduplicate signing scheme dissection #594

lukpueh opened this issue May 31, 2023 · 0 comments · May be fixed by #837
Labels
contribfest Issues for KubeCon EU contribfest good first issue

Comments

@lukpueh
Copy link
Member

lukpueh commented May 31, 2023

There is some duplicate code in securesystemslib.signer to dissect signing schemes, in order to figure out the

  • appropriate hash algorithm: e.g. "rsassa-pss-sha384" and "ecdsa-sha2-nistp384" use "sha384"), or
  • padding: e.g. "rsa-pkcs1v15-sha224 and "rsa-pkcs1v15-sha512" use "pkcs1v15"

It would be nice to provide a signer-wide helper function or map.

hint: the code can be found by grepping for split, also in pending PRs: #585, #588, #590. Note that we usually first extract the substring (which is the same for all schemes) and then map them e.g. to specific hash constants or objects (which differs between signers).

related: #593
@lukpueh lukpueh mentioned this issue May 31, 2023
Closed
@lukpueh lukpueh mentioned this issue Jul 20, 2023
Merged
3 tasks
@lukpueh lukpueh mentioned this issue Nov 15, 2023
Merged
@lukpueh lukpueh added the contribfest Issues for KubeCon EU contribfest label Mar 14, 2024
lukpueh added a commit to lukpueh/securesystemslib that referenced this issue Apr 9, 2024
@lukpueh
Remove unused function and schema checks in hash
283158c 
The function "digest_from_rsa_scheme" doesn't seem to be used anywhere
(according to sourcegraph.com), not even in securesystemslib.signer,
where the same functionality is replicated several times (see secure-systems-lab#594).
lukpueh added a commit to lukpueh/securesystemslib that referenced this issue Apr 9, 2024
@lukpueh
Remove unused function and schema checks in hash
07fd62d 
The function "digest_from_rsa_scheme" doesn't seem to be used anywhere
(according to sourcegraph.com), not even in securesystemslib.signer,
where the same functionality is replicated several times (see secure-systems-lab#594).
lukpueh added a commit to lukpueh/securesystemslib that referenced this issue Apr 10, 2024
@lukpueh
Remove unused function and schema checks in hash
3992344 
In prepartion for the removal of schema.py (secure-systems-lab#183), this patch removes
schema checks of function arguments in hash.py and one entire function.

The removed checks are obfuscated "is string" checks, and without them
invalid args are still caught in the `digest` function, where they all
end up and raise a more meaningful UnsupportedLibraryError or
UnsupportedAlgorithmError if invalid.

The removed function `digest_from_rsa_scheme` doesn't seem to be used
anywhere (according to sourcegraph.com) not even in
securesystemslib.signer, where the same functionality is replicated
several times (see secure-systems-lab#594). Removing it here allows to ignore a
slightly more complex schema check.

Signed-off-by: Lukas Puehringer <[email protected]>
@lukpueh lukpueh mentioned this issue Apr 10, 2024
Merged
lukpueh added a commit to lukpueh/securesystemslib that referenced this issue Apr 15, 2024
@lukpueh
Remove unused function and schema checks in hash
aef86c6 
In prepartion for the removal of schema.py (secure-systems-lab#183), this patch removes
schema checks of function arguments in hash.py and one entire function.

The removed checks are obfuscated "is string" checks, and without them
invalid args are still caught in the `digest` function, where they all
end up and raise a more meaningful UnsupportedLibraryError or
UnsupportedAlgorithmError if invalid.

The removed function `digest_from_rsa_scheme` doesn't seem to be used
anywhere (according to sourcegraph.com) not even in
securesystemslib.signer, where the same functionality is replicated
several times (see secure-systems-lab#594). Removing it here allows to ignore a
slightly more complex schema check.

Signed-off-by: Lukas Puehringer <[email protected]>
@L77H L77H linked a pull request Jun 28, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
contribfest Issues for KubeCon EU contribfest good first issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Abstract methods added to Key for signing scheme dissection L77H/securesystemslib
1 participant
@lukpueh