Skip to content

Conversation

@srinjoydutta03
Copy link
Contributor

Description

Introduced support for nested hash-bin delegations under custom delegations in the RSTUF CLI. The changes add interactive prompts to configure nested bins, update the delegation metadata to store bin information, and clarify the signing method restrictions for nested bins. Additionally, the delegation metadata display now includes the number of nested bins for each delegation.

Nested hash-bin delegation support

  • Added _prompt_nested_bins function to prompt users for the creation and number of nested hash-bin delegations under a custom delegation. The number of bins is restricted to powers of two between 2 and 4096.
  • Updated _configure_delegations to use _prompt_nested_bins, pass the bin count to _expiry_prompt, and store the bin count in the delegation's metadata (x-rstuf-num-bins).

Signing method restrictions

  • Updated the signing method selection and user-facing documentation to clarify that only global online key (existing) is supported for both custom roles and their nested bins when hash-bin delegations are used. Offline keys are not supported for nested bins as of now.

Delegation metadata and display

  • Modified the delegation metadata table to include a "Nested Bins" column, showing the number of bins for each delegation if present.

Expiry prompt improvements

  • Enhanced _expiry_prompt to accept an optional num_bins parameter, updating the prompt messaging when nested bins are being configured.

Related Issue: repository-service-tuf/repository-service-tuf#876

@kairoaraujo

Signed-off-by: Srinjoy Dutta <srinjoydutta03@gmail.com>
Signed-off-by: Srinjoy Dutta <srinjoydutta03@gmail.com>
Copy link
Member

@MVrachev MVrachev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work, but keep in mind this feature most likely will require multiple reviews, at least from me.

I noticed that during the bootstrap process the flow is the following:

  1. hash bin or custom delegation -> choose custom
  2. name of custom delegation
  3. Do you want hash‑bin delegations under this 'project-a' delegation? -> yes
  4. Number of bins
  5. Please enter days until expiry for 'project-a' role and its nested roles
  6. Please enter path

I think it's better if the user fully configures the necessery fields for the custom delegated role and in the end we mention something to the user like:

Delegated target role <NAME_OF_ROLE> configured
Do you want to add a hash bin delegations for that role?

and then after the configurmation continue.

@kairoaraujo do you agree here?

Also, add a new line between the Info here and the choice for online key:
image

"> Note: Custom delegations now support"
" nested hash-bin delegations. "
"Nested bins are created under a custom delegation"
" role but they are always signed with the global online key"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
" role but they are always signed with the global online key"
" role, but they are always signed with the global online key"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Noted, I'll fix this!

@srinjoydutta03
Copy link
Contributor Author

Nice work, but keep in mind this feature most likely will require multiple reviews, at least from me.

I noticed that during the bootstrap process the flow is the following:

  1. hash bin or custom delegation -> choose custom
  2. name of custom delegation
  3. Do you want hash‑bin delegations under this 'project-a' delegation? -> yes
  4. Number of bins
  5. Please enter days until expiry for 'project-a' role and its nested roles
  6. Please enter path

I think it's better if the user fully configures the necessery fields for the custom delegated role and in the end we mention something to the user like:

Delegated target role <NAME_OF_ROLE> configured
Do you want to add a hash bin delegations for that role?

and then after the configurmation continue.

@kairoaraujo do you agree here?

Also, add a new line between the Info here and the choice for online key:
image

Yes, this simplifies things more. We can do this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants