-
Notifications
You must be signed in to change notification settings - Fork 215
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove signed HTTP request support #5137
Remove signed HTTP request support #5137
Conversation
disable_signed_request_support@68757 aka 20230419.8 vs main ewma over 20 builds from 68151 to 68749 Click to see tablemain
disable_signed_request_support
|
t_cose does not support passing in custom header parameters [1][2] when signing (nor when verifying, but we can and do re-parse there with QCBOR), which we need for CCF governance. [1] https://github.com/laurencelundblade/t_cose/blob/master/examples/t_cose_basic_example_ossl.c#L262 |
The other problem with the proposal test is that it relies on being able to submit concurrent identical proposals, which is now caught by the replay proposal protection. |
…chamayou/CCF into disable_signed_request_support
Following discussion with @jumaffre, I am removing the proposal_id_test, because:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This needs a changelog entry and I think some warning in the documentation so that this feature doesn't disappear silently (even though we've warned users that this was deprecated!). It's also not clear if users can make use of the new COSE signatures via built-in authentication policies, in both C++ and JS?
@jumaffre added comments in the doc and changelog. Looking at adding a user COSE Sign1 authentication policy, but probably in a separate PR. |
This completes #3875 by removing signed HTTP request support from CCF, after its deprecation in 3.0.