-
Notifications
You must be signed in to change notification settings - Fork 26
[Feature Support]: Update CLI to enable hash-bin delegations under custom delegations #901
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Srinjoy Dutta <srinjoydutta03@gmail.com>
Signed-off-by: Srinjoy Dutta <srinjoydutta03@gmail.com>
MVrachev
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice work, but keep in mind this feature most likely will require multiple reviews, at least from me.
I noticed that during the bootstrap process the flow is the following:
- hash bin or custom delegation -> choose custom
- name of custom delegation
- Do you want hash‑bin delegations under this 'project-a' delegation? -> yes
- Number of bins
- Please enter days until expiry for 'project-a' role and its nested roles
- Please enter path
I think it's better if the user fully configures the necessery fields for the custom delegated role and in the end we mention something to the user like:
Delegated target role <NAME_OF_ROLE> configured
Do you want to add a hash bin delegations for that role?
and then after the configurmation continue.
@kairoaraujo do you agree here?
Also, add a new line between the Info here and the choice for online key:

| "> Note: Custom delegations now support" | ||
| " nested hash-bin delegations. " | ||
| "Nested bins are created under a custom delegation" | ||
| " role but they are always signed with the global online key" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| " role but they are always signed with the global online key" | |
| " role, but they are always signed with the global online key" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Noted, I'll fix this!
Yes, this simplifies things more. We can do this. |
Description
Introduced support for nested hash-bin delegations under custom delegations in the RSTUF CLI. The changes add interactive prompts to configure nested bins, update the delegation metadata to store bin information, and clarify the signing method restrictions for nested bins. Additionally, the delegation metadata display now includes the number of nested bins for each delegation.
Nested hash-bin delegation support
_prompt_nested_binsfunction to prompt users for the creation and number of nested hash-bin delegations under a custom delegation. The number of bins is restricted to powers of two between 2 and 4096._configure_delegationsto use_prompt_nested_bins, pass the bin count to_expiry_prompt, and store the bin count in the delegation's metadata (x-rstuf-num-bins).Signing method restrictions
Delegation metadata and display
Expiry prompt improvements
_expiry_promptto accept an optionalnum_binsparameter, updating the prompt messaging when nested bins are being configured.Related Issue: repository-service-tuf/repository-service-tuf#876
@kairoaraujo