111 lines
3.4 KiB
Python
111 lines
3.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate and sign a GovOPlaN OCI runtime distribution manifest."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import base64
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
from cryptography.hazmat.primitives import serialization
|
|
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
|
|
|
|
|
META_ROOT = Path(__file__).resolve().parents[2]
|
|
sys.path.insert(0, str(META_ROOT / "tools" / "deployment"))
|
|
|
|
from govoplan_deploy.distribution import ( # noqa: E402
|
|
DistributionError,
|
|
canonical_json,
|
|
canonical_signed_payload,
|
|
validate_manifest,
|
|
)
|
|
|
|
|
|
def build_parser() -> argparse.ArgumentParser:
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--descriptor", type=Path, required=True)
|
|
parser.add_argument("--output", type=Path, required=True)
|
|
parser.add_argument(
|
|
"--signing-key",
|
|
action="append",
|
|
default=[],
|
|
metavar="KEY_ID=PRIVATE_PEM",
|
|
required=True,
|
|
)
|
|
return parser
|
|
|
|
|
|
def sign_manifest(
|
|
descriptor: dict[str, object],
|
|
signing_keys: tuple[tuple[str, Path], ...],
|
|
) -> dict[str, object]:
|
|
payload = dict(descriptor)
|
|
payload["signatures"] = [
|
|
_signature(payload, key_id=key_id, path=path)
|
|
for key_id, path in signing_keys
|
|
]
|
|
validate_manifest(payload)
|
|
return payload
|
|
|
|
|
|
def _signature(
|
|
payload: dict[str, object],
|
|
*,
|
|
key_id: str,
|
|
path: Path,
|
|
) -> dict[str, str]:
|
|
try:
|
|
key = serialization.load_pem_private_key(path.read_bytes(), password=None)
|
|
except (OSError, ValueError, TypeError) as exc:
|
|
raise DistributionError(f"cannot load signing key {key_id!r}") from exc
|
|
if not isinstance(key, Ed25519PrivateKey):
|
|
raise DistributionError(f"signing key {key_id!r} is not Ed25519")
|
|
return {
|
|
"key_id": key_id,
|
|
"algorithm": "ed25519",
|
|
"value": base64.b64encode(key.sign(canonical_signed_payload(payload))).decode(
|
|
"ascii"
|
|
),
|
|
}
|
|
|
|
|
|
def _parse_signing_key(value: str) -> tuple[str, Path]:
|
|
if "=" not in value:
|
|
raise DistributionError("--signing-key must use KEY_ID=PRIVATE_PEM")
|
|
key_id, raw_path = value.split("=", 1)
|
|
if not key_id or not raw_path:
|
|
raise DistributionError("--signing-key must use KEY_ID=PRIVATE_PEM")
|
|
return key_id, Path(raw_path).expanduser().resolve()
|
|
|
|
|
|
def main() -> int:
|
|
args = build_parser().parse_args()
|
|
try:
|
|
descriptor = json.loads(args.descriptor.read_text(encoding="utf-8"))
|
|
if not isinstance(descriptor, dict):
|
|
raise DistributionError("descriptor root must be an object")
|
|
if "signatures" in descriptor:
|
|
raise DistributionError("descriptor must not contain signatures")
|
|
payload = sign_manifest(
|
|
descriptor,
|
|
tuple(_parse_signing_key(value) for value in args.signing_key),
|
|
)
|
|
encoded = canonical_json(payload)
|
|
args.output.parent.mkdir(parents=True, exist_ok=True)
|
|
temporary = args.output.with_suffix(args.output.suffix + ".tmp")
|
|
temporary.write_bytes(encoded)
|
|
temporary.chmod(0o644)
|
|
temporary.replace(args.output)
|
|
except (DistributionError, OSError, ValueError, json.JSONDecodeError) as exc:
|
|
print(f"error: {exc}", file=sys.stderr)
|
|
return 1
|
|
print(f"Runtime distribution manifest written to {args.output}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|