Metadata API: Add Key.from_securesystemslib_key()?

[jku]

I've been playing with repository code / metadata creation and this is a mistake that's bit too easy to make:

sslib_key = generate_ed25519_key()
key = Key.from_dict(sslib_key["keyid"], sslib_key) # key for public TUF metadata
signer = SSlibSigner(sslib_key) # signing key

This works just fine... and results in public metadata that includes your private key (TUF key doesn't handle the private key of course but we allow unrecognised fields in the format). Oops.

We should probably have a function for this use case: The securesystemslib key format might be opaque to us (can't be 100% sure what's in there) but I think in this case making some assumptions about that is better than allowing the above to happen

So something like

from_securesystemslib_key(key_dict: Dict[str, Any]):
    return Key(
        keydict["keyid"],
        keydict["keytype"],
        keydict["scheme"],
        {"public": keydict["keyval"]["public"]}
    )

?

[trishankatdatadog]

Very good point. Also making it clear in the function name itself whether you are also getting private or just public key.

[avelichka]

I'd like to give it a try, pls :)

[jku]

actually securesystemslib.keys.format_keyval_to_metadata(keytype, scheme, key_value, private=False) probably does what we want? I think adding a helper still makes sense but it could call that instead of trying to parse key_value itself, and then I think the return value would be usable in Key.from_dict(sslib_key["keyid"], sslib_key)... It's still quite ugly but at least we wouldn't assume keyval contents