Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow specifying OpenPGP implementation to use for signing #3094

Merged
merged 1 commit into from
Oct 28, 2024

Conversation

wiktor-k
Copy link
Contributor

@wiktor-k wiktor-k commented Oct 2, 2024

Hi 👋

I'm pushing a first preview of SOP signing for SHA256SUMs. I've tested that locally and also added tests for rsop and old gpg (just in case) and will begin to refactor this a bit. Since I'm new to both mkosi and Python I think it's good to get feedback earlier in the process if something looks particularly wrong here.

Note that I've tried to make it as minimal as possible with no nice-to-have adjustments mentioned in #3042.

Fixes: #3042
CC: @dvzrv

@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 2 times, most recently from 88fd737 to 2f5e5db Compare October 2, 2024 10:43
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from 2f5e5db to c57403e Compare October 2, 2024 10:44
@DaanDeMeyer
Copy link
Contributor

DaanDeMeyer commented Oct 2, 2024

I'm curious about hardware tokens. Will those be supported with a unified CLI interface as well?

mkosi/config.py Outdated Show resolved Hide resolved
mkosi/config.py Outdated Show resolved Hide resolved
mkosi/__init__.py Outdated Show resolved Hide resolved
mkosi/__init__.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from c57403e to 3b88281 Compare October 2, 2024 10:51
@wiktor-k
Copy link
Contributor Author

wiktor-k commented Oct 2, 2024

I'm curious about hardware tokens. Will those be supported with a unified CLI interface as well?

Yes, I actually tested that with my Yubikey and found a couple of issues I fixed. This, of course, depends on the underlying SOP implementation that's used. rsop implements it.

@wiktor-k
Copy link
Contributor Author

wiktor-k commented Oct 2, 2024

Okay folks, thanks for the great feedback! I need to install the type-checking tools locally not to spam the CI. I'll be back with the adjustments (all valid points! 🙇 )

@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from 3b88281 to 43a85d8 Compare October 3, 2024 10:40
@wiktor-k wiktor-k marked this pull request as ready for review October 3, 2024 10:41
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 2 times, most recently from 5028264 to 49e8075 Compare October 3, 2024 11:13
@wiktor-k wiktor-k marked this pull request as draft October 3, 2024 11:35
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from 49e8075 to 84a0f98 Compare October 3, 2024 12:30
mkosi/config.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 5 times, most recently from 7de844c to efc0a77 Compare October 4, 2024 13:43
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 2 times, most recently from aa13165 to efc0a77 Compare October 7, 2024 07:53
tests/test_signing.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 3 times, most recently from 9231cb6 to a949723 Compare October 7, 2024 11:05
tests/test_signing.py Fixed Show fixed Hide fixed
tests/test_signing.py Fixed Show fixed Hide fixed
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 3 times, most recently from 12f445e to 396ccdb Compare October 23, 2024 08:40
@wiktor-k
Copy link
Contributor Author

Okay, I've adjusted the PR and included manpage changes. The CI failures don't look to be related (please correct me if I'm wrong). Thanks! 👋

tests/test_signing.py Outdated Show resolved Hide resolved
tests/test_signing.py Outdated Show resolved Hide resolved
tests/test_signing.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from 396ccdb to 331132d Compare October 23, 2024 11:23
@wiktor-k wiktor-k marked this pull request as ready for review October 23, 2024 11:28
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 3 times, most recently from 3cc7fd4 to d8201f8 Compare October 23, 2024 12:16
Copy link
Contributor

@behrmann behrmann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, apart from the nits.

tests/__init__.py Outdated Show resolved Hide resolved
tests/__init__.py Outdated Show resolved Hide resolved
@wiktor-k
Copy link
Contributor Author

LGTM, apart from the nits.

Phew, thanks for your time! Nits resolved 😅

tests/__init__.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from 8666c94 to 5a1e85a Compare October 28, 2024 12:12
mkosi/__init__.py Outdated Show resolved Hide resolved
mkosi/__init__.py Outdated Show resolved Hide resolved
mkosi/config.py Outdated Show resolved Hide resolved
mkosi/resources/man/mkosi.1.md Outdated Show resolved Hide resolved
tests/test_signing.py Outdated Show resolved Hide resolved
tests/test_signing.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch 2 times, most recently from 46ccdad to 94ac780 Compare October 28, 2024 12:46
mkosi/__init__.py Outdated Show resolved Hide resolved
mkosi/__init__.py Outdated Show resolved Hide resolved
mkosi/__init__.py Outdated Show resolved Hide resolved
mkosi/config.py Outdated Show resolved Hide resolved
@wiktor-k wiktor-k force-pushed the wiktor/teach-mkosi-sop branch from 94ac780 to c315931 Compare October 28, 2024 12:59
@behrmann behrmann merged commit f509490 into systemd:main Oct 28, 2024
34 of 36 checks passed
@wiktor-k wiktor-k deleted the wiktor/teach-mkosi-sop branch October 29, 2024 13:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

Extend OpenPGP signing support with Stateless OpenPGP
3 participants