Skip to content

Commit 55c4bc0

Browse files
author
Kairo Araujo
committed
Include to dev enviroment RSTUF bootstrap inittuf
Include the RSTUF `bootstrap.json` payload in the `dev/rstuf/` folder. The bootstrap payload has the RSTUF complete ceremony process. It uses the keys available in the `dev/rstuf/keys` This commit also includes the `inittuf` in Makefile. The information in the development docs. - context (PEP 458) - command (bootstrap) - use (try out API) Signed-off-by: Kairo Araujo <kairo.araujo@testifysec.com> Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
1 parent 82d44d4 commit 55c4bc0

File tree

3 files changed

+128
-0
lines changed

3 files changed

+128
-0
lines changed

‎Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,9 @@ initdb: .state/docker-build-base
110110
docker compose run --rm web python -m warehouse classifiers sync
111111
$(MAKE) reindex
112112

113+
inittuf: .state/docker-build-base
114+
docker compose run --rm web rstuf admin ceremony -b -u -f dev/rstuf/bootstrap.json --api-server http://rstuf-api
115+
113116
runmigrations: .state/docker-build-base
114117
docker compose run --rm web python -m warehouse db upgrade head
115118

‎dev/rstuf/bootstrap.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"settings": {
3+
"expiration": {
4+
"root": 365,
5+
"targets": 365,
6+
"snapshot": 1,
7+
"timestamp": 1,
8+
"bins": 1
9+
},
10+
"services": {
11+
"number_of_delegated_bins": 16,
12+
"targets_base_url": "https://localhost:9001/packaging/",
13+
"targets_online_key": true
14+
}
15+
},
16+
"metadata": {
17+
"root": {
18+
"signatures": [
19+
{
20+
"keyid": "c6d8bf2e4f48b41ac2ce8eca21415ca8ef68c133b47fc33df03d4070a7e1e9cc",
21+
"sig": "19dd6b1d5da8149b5a490efc8137beedb85ae036255244b2eba909efe05561636e56c0f9a3fe219601602c142b74cc9d2ab5ba18016cb1f3fb81f16f4cb89100"
22+
}
23+
],
24+
"signed": {
25+
"_type": "root",
26+
"version": 1,
27+
"spec_version": "1.0.31",
28+
"expires": "2025-02-21T13:58:51Z",
29+
"consistent_snapshot": true,
30+
"keys": {
31+
"50d7e110ad65f3b2dba5c3cfc8c5ca259be9774cc26be3410044ffd4be3aa5f3": {
32+
"keytype": "ecdsa",
33+
"scheme": "ecdsa-sha2-nistp256",
34+
"keyval": {
35+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcLYSZyFGeKdWNt5dWFbnv6N9NyHC\noUNLcG6GZIxLwN8Q8MUdHdOOxGkDnyBRSJpIZ/r/oDECSTwfCYhdogweLA==\n-----END PUBLIC KEY-----\n"
36+
},
37+
"x-rstuf-key-name": "my ecdsa root key"
38+
},
39+
"c6d8bf2e4f48b41ac2ce8eca21415ca8ef68c133b47fc33df03d4070a7e1e9cc": {
40+
"keytype": "ed25519",
41+
"scheme": "ed25519",
42+
"keyval": {
43+
"public": "4f66dabebcf30628963786001984c0b75c175cdcf3bc4855933a2628f0cd0a0f"
44+
},
45+
"x-rstuf-key-name": "my ed25519 root key"
46+
},
47+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241": {
48+
"keytype": "rsa",
49+
"scheme": "rsassa-pss-sha256",
50+
"keyval": {
51+
"public": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhX6rioiL/cX5Ys32InF\nU52H8tL14QeX0tacZdb+AwcH6nIh97h3RSHvGD7Xy6uaMRmGldAnSVYwJHqoJ5j2\nynVzU/RFpr+6n8Ps0QFg5GmlEqZboFjLbS0bsRQcXXnqJNsVLEPT3ULvu1rFRbWz\nAMFjNtNNk5W/u0GEzXn3D03jIdhD8IKAdrTRf0VMD9TRCXLdMmEU2vkf1NVUnOTb\n/dRX5QA8TtBylVnouZknbavQ0J/pPlHLfxUgsKzodwDlJmbPG9BWwXqQCmP0DgOG\nNIZ1X281MOBaGbkNVEuntNjCSaQxQjfALVVU5NAfal2cwMINtqaoc7Wa+TWvpFEI\nWwIDAQAB\n-----END PUBLIC KEY-----\n"
52+
},
53+
"x-rstuf-online-key-uri": "fn:2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
54+
}
55+
},
56+
"roles": {
57+
"root": {
58+
"keyids": [
59+
"50d7e110ad65f3b2dba5c3cfc8c5ca259be9774cc26be3410044ffd4be3aa5f3",
60+
"c6d8bf2e4f48b41ac2ce8eca21415ca8ef68c133b47fc33df03d4070a7e1e9cc"
61+
],
62+
"threshold": 1
63+
},
64+
"targets": {
65+
"keyids": [
66+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
67+
],
68+
"threshold": 1
69+
},
70+
"timestamp": {
71+
"keyids": [
72+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
73+
],
74+
"threshold": 1
75+
},
76+
"snapshot": {
77+
"keyids": [
78+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
79+
],
80+
"threshold": 1
81+
}
82+
}
83+
}
84+
}
85+
}
86+
}

‎docs/dev/development/getting-started.rst‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,45 @@ or that the ``static`` container has finished compiling the static assets:
249249
250250
or maybe something else.
251251

252+
Bootstrapping the TUF Metadata Repository
253+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
254+
255+
To enable PyPI Index Signing (`PEP 458 <https://peps.python.org/pep-0458/>`_),
256+
you have to first bootstrap the TUF metadata repository.
257+
258+
Wait until `make serve` has finished, then run:
259+
260+
.. code-block:: console
261+
262+
make inittuf
263+
264+
You should see the following line at the bottom of the output:
265+
266+
.. code-block:: console
267+
268+
Bootstrap completed using `dev/rstuf/bootstrap.json`. 🔐 🎉
269+
270+
271+
This command sends a static *bootstrap payload* to the RSTUF API. The payload
272+
includes the TUF trust root for development and other configuration.
273+
274+
By calling this API, RSTUF creates the TUF metadata repository, installs the
275+
TUF trust root for development, and creates the initial set of TUF metadata.
276+
277+
.. note::
278+
279+
The RSTUF API is exposed only for development purposes and will not be
280+
available in production. Currently, no upload hooks or automatic metadata
281+
update tasks are configured to interact with RSTUF.
282+
283+
Take a look at the `RSTUF API documentation
284+
<https://repository-service-tuf.readthedocs.io/en/stable/guide/general/usage.html#adding-artifacts>`_
285+
to see how you can simulate artifact upload or removal, and how they affect
286+
the TUF metadata repository:
287+
288+
* RSTUF API: http://localhost:8001
289+
* TUF Metadata Repository: http://localhost:9001/tuf-metadata/
290+
252291

253292
Viewing Warehouse in a browser
254293
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

0 commit comments

Comments
 (0)