| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115 |
- Subject: Add tangd-rotate-keys helper script
- Origin: v9-5-gfd69796 <https://github.com/latchset/tang/commit/v9-5-gfd69796>
- Upstream-Author: Sergio Correia <scorreia@redhat.com>
- Date: Sun Nov 29 11:47:09 2020 -0300
- So that it becomes simpler to perform key rotation on the server side.
- Usage: tangd-rotate-keys [-h] [-v] -d <KEYDIR>
- Example:
- $ sudo tangd-rotate-keys -d /var/db/tang -v
- Disabled advertisement of key 5AiUA4IhvOFdXzFavO78TKJ8hEsfGk8I6ymy4rBPWi8.jwk -> .5AiUA4IhvOFdXzFavO78TKJ8hEsfGk8I6ymy4rBPWi8.jwk
- Disabled advertisement of key dDC74X-o31Fq5VJaM9iZ4baZD2hhHw-RrIMkxEz35Xc.jwk -> .dDC74X-o31Fq5VJaM9iZ4baZD2hhHw-RrIMkxEz35Xc.jwk
- Created new key bIGVyIP2D_NJGQeFA9cf9oix5KEVQyVq9ZGjjv0s3D8.jwk
- Created new key BL4IR73UhG8yyYbvGJspPIlLvG6AzTnM850tlCKrcII.jwk
- Keys rotated successfully
- --- a/src/meson.build
- +++ b/src/meson.build
- @@ -9,5 +9,6 @@
-
- bins += join_paths(meson.current_source_dir(), 'tang-show-keys')
- libexecbins += join_paths(meson.current_source_dir(), 'tangd-keygen')
- +libexecbins += join_paths(meson.current_source_dir(), 'tangd-rotate-keys')
-
- # vim:set ts=2 sw=2 et:
- --- /dev/null
- +++ b/src/tangd-rotate-keys
- @@ -0,0 +1,85 @@
- +#!/bin/sh -e
- +# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
- +#
- +# Copyright (c) 2020 Red Hat, Inc.
- +# Author: Sergio Correia <scorreia@redhat.com>
- +#
- +# This program is free software: you can redistribute it and/or modify
- +# it under the terms of the GNU General Public License as published by
- +# the Free Software Foundation, either version 3 of the License, or
- +# (at your option) any later version.
- +#
- +# This program is distributed in the hope that it will be useful,
- +# but WITHOUT ANY WARRANTY; without even the implied warranty of
- +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- +# GNU General Public License for more details.
- +#
- +# You should have received a copy of the GNU General Public License
- +# along with this program. If not, see <http://www.gnu.org/licenses/>.
- +#
- +
- +SUMMARY="Perform rotation of tang keys"
- +
- +usage() {
- + local _ret="${1:-1}"
- + exec >&2
- + echo "Usage: ${0} [-h] [-v] -d <KEYDIR>"
- + echo
- + echo "${SUMMARY}"
- + echo
- + echo " -d KEYDIR The directory with the keys, e.g. /var/db/tang"
- + echo
- + echo " -h Display this usage information"
- + echo
- + echo " -v Verbose. Display additional info on keys created/rotated"
- + echo
- + exit "${_ret}"
- +}
- +
- +log() {
- + local _msg="${1}"
- + local _verbose="${2:-}"
- + [ -z "${_verbose}" ] && return 0
- + echo "${_msg}" >&2
- +}
- +
- +error() {
- + log "${1}" 1
- + usage 1
- +}
- +
- +JWKDIR=
- +VERBOSE=
- +while getopts "hvd:" o; do
- + case "${o}" in
- + d) JWKDIR="${OPTARG}";;
- + h) usage 0;;
- + v) VERBOSE=1;;
- + *) usage 1;;
- + esac
- +done
- +
- +[ -z "${JWKDIR}" ] && error "Please specify the keys directory with -d switch"
- +[ -r "${JWKDIR}" ] || error "Error trying to access JWK directory '${JWKDIR}'"
- +
- +cd "${JWKDIR}" || error "Unable to change to keys directory '${JWKDIR}'"
- + # Disable advertisement of current keys.
- + for key in *.jwk; do
- + [ -r "${key}" ] || continue
- + mv -f -- "${key}" ."${key}"
- + log "Disabled advertisement of key ${key} -> .${key}" "${VERBOSE}"
- + done
- +
- + # Create a new set of keys.
- + DEFAULT_THP_HASH="S256"
- + for alg in "ES512" "ECMR"; do
- + json="$(printf '{"alg": "%s"}' "${alg}")"
- + jwe="$(jose jwk gen --input "${json}")"
- + thp="$(printf '%s' "${jwe}" | jose jwk thp --input=- \
- + -a "${DEFAULT_THP_HASH}")"
- + echo "${jwe}" > "${thp}.jwk"
- + log "Created new key ${thp}.jwk" "${VERBOSE}"
- + done
- +cd - >/dev/null
- +
- +log "Keys rotated successfully" "${VERBOSE}"
|
