Support loading a key from HashiCorp Vault in admin cli #608
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 4 commits
June 4, 2024 16:18
In preparation for supporting multiple online key types, this helper is changed to return the key and a uri to access the corresponding signer. Since the helper is still used for online and offline key configuration, via a common intermediary helper `_load_key_prompt`, the returned uri is not yet used. Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
Prompts for key name in vault and return uri and key. Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
Rename _load_key_prompt to _load_offline_key_prompt. This stays the same and currently only supports loading a key from file. Add new _load_online_key_prompt to load key from either file, or hashicorp vault. Change _configure_online_key_prompt to use _load_online_key_prompt, which return the key already with the uri included. Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
I'm still not sure if that was the best idea:
|
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes key loading helpers used by admin ceremony and metadata update commands to provide an option to the user to load a public key from HashiCorp Vault into TUF metadata.
TODO:
tuf-on-ci does the former (see "Prepare your local environment" in its docs/ONLINE-SIGNING-SETUP.md (cc @jku, who might be willing to share some wisdom )