Refactor keys to allow more key types and add RSA key verifier

client/client_test.go

@@ -14,6 +14,7 @@ import (
 	cjson "github.com/tent/canonical-json-go"
 	tuf "github.com/theupdateframework/go-tuf"
 	"github.com/theupdateframework/go-tuf/data"
+	"github.com/theupdateframework/go-tuf/pkg/keys"
 	"github.com/theupdateframework/go-tuf/sign"
 	"github.com/theupdateframework/go-tuf/util"
 	"github.com/theupdateframework/go-tuf/verify"
@@ -342,17 +343,18 @@ func (s *ClientSuite) TestNewRoot(c *C) {
 	for _, ids := range s.keyIDs {
 		c.Assert(len(ids) > 0, Equals, true)
 		for _, id := range ids {
-			c.Assert(client.db.GetKey(id), IsNil)
+			_, err := client.db.GetKey(id)
+			c.Assert(err, NotNil)
 		}
 	}
 
 	// check new keys are in db
 	for name, ids := range newKeyIDs {
 		c.Assert(len(ids) > 0, Equals, true)
 		for _, id := range ids {
-			key := client.db.GetKey(id)
-			c.Assert(key, NotNil)
-			c.Assert(key.IDs(), DeepEquals, ids)
+			key, err := client.db.GetKey(id)
+			c.Assert(err, IsNil)
+			c.Assert(key.MarshalKey().IDs(), DeepEquals, ids)
 		}
 		role := client.db.GetRole(name)
 		c.Assert(role, NotNil)
@@ -405,12 +407,13 @@ func (s *ClientSuite) TestNewTimestampKey(c *C) {
 
 	// check key has been replaced in db
 	for _, oldID := range oldIDs {
-		c.Assert(client.db.GetKey(oldID), IsNil)
+		_, err := client.db.GetKey(oldID)
+		c.Assert(err, NotNil)
 	}
 	for _, newID := range newIDs {
-		key := client.db.GetKey(newID)
-		c.Assert(key, NotNil)
-		c.Assert(key.IDs(), DeepEquals, newIDs)
+		key, err := client.db.GetKey(newID)
+		c.Assert(err, IsNil)
+		c.Assert(key.MarshalKey().IDs(), DeepEquals, newIDs)
 	}
 	role := client.db.GetRole("timestamp")
 	c.Assert(role, NotNil)
@@ -444,12 +447,13 @@ func (s *ClientSuite) TestNewSnapshotKey(c *C) {
 
 	// check key has been replaced in db
 	for _, oldID := range oldIDs {
-		c.Assert(client.db.GetKey(oldID), IsNil)
+		_, err := client.db.GetKey(oldID)
+		c.Assert(err, NotNil)
 	}
 	for _, newID := range newIDs {
-		key := client.db.GetKey(newID)
-		c.Assert(key, NotNil)
-		c.Assert(key.IDs(), DeepEquals, newIDs)
+		key, err := client.db.GetKey(newID)
+		c.Assert(err, IsNil)
+		c.Assert(key.MarshalKey().IDs(), DeepEquals, newIDs)
 	}
 	role := client.db.GetRole("snapshot")
 	c.Assert(role, NotNil)
@@ -486,12 +490,13 @@ func (s *ClientSuite) TestNewTargetsKey(c *C) {
 
 	// check key has been replaced in db
 	for _, oldID := range oldIDs {
-		c.Assert(client.db.GetKey(oldID), IsNil)
+		_, err := client.db.GetKey(oldID)
+		c.Assert(err, NotNil)
 	}
 	for _, newID := range newIDs {
-		key := client.db.GetKey(newID)
-		c.Assert(key, NotNil)
-		c.Assert(key.IDs(), DeepEquals, newIDs)
+		key, err := client.db.GetKey(newID)
+		c.Assert(err, IsNil)
+		c.Assert(key.MarshalKey().IDs(), DeepEquals, newIDs)
 	}
 	role := client.db.GetRole("targets")
 	c.Assert(role, NotNil)
@@ -914,7 +919,7 @@ func (s *ClientSuite) TestUnknownKeyIDs(c *C) {
 	c.Assert(json.Unmarshal(rootJSON, &root), IsNil)
 
 	// update remote root.json to add a new key with an unknown id
-	key, err := sign.GenerateEd25519Key()
+	key, err := keys.GenerateEd25519Key()
 	c.Assert(err, IsNil)
 
 	root.Signed.Keys["unknown-key-id"] = key.PublicData()

client/python_interop/python_interop_test.go

@@ -15,6 +15,7 @@ import (
 	tuf "github.com/theupdateframework/go-tuf"
 	client "github.com/theupdateframework/go-tuf/client"
 	"github.com/theupdateframework/go-tuf/data"
+	"github.com/theupdateframework/go-tuf/pkg/keys"
 	"github.com/theupdateframework/go-tuf/util"
 	"golang.org/x/crypto/ed25519"
 	. "gopkg.in/check.v1"
@@ -64,7 +65,9 @@ func (InteropSuite) TestGoClientPythonGenerated(c *C) {
 		key := &data.Key{}
 		c.Assert(json.NewDecoder(f).Decode(key), IsNil)
 		c.Assert(key.Type, Equals, "ed25519")
-		c.Assert(key.Value.Public, HasLen, ed25519.PublicKeySize)
+		pk, err := keys.GetVerifier(key)
+		c.Assert(err, IsNil)
+		c.Assert(pk.Public(), HasLen, ed25519.PublicKeySize)
 		client := client.NewClient(client.MemoryLocalStore(), remote)
 		c.Assert(client.Init([]*data.Key{key}, 1), IsNil)
 

client/testdata/go-tuf-transition-M3/generate.go

@@ -11,14 +11,15 @@ import (
 	"time"
 
 	tuf "github.com/theupdateframework/go-tuf"
-	"github.com/theupdateframework/go-tuf/sign"
+	"github.com/theupdateframework/go-tuf/data"
+	"github.com/theupdateframework/go-tuf/pkg/keys"
 )
 
 var expirationDate = time.Date(2100, time.January, 1, 0, 0, 0, 0, time.UTC)
 
 type persistedKeys struct {
 	Encrypted bool               `json:"encrypted"`
-	Data      []*sign.PrivateKey `json:"data"`
+	Data      []*data.PrivateKey `json:"data"`
 }
 
 func assertNotNil(err error) {
@@ -48,10 +49,12 @@ func commit(dir string, repo *tuf.Repo) {
 	assertNotNil(os.RemoveAll(filepath.Join(dir, "keys")))
 }
 
-func addKeys(repo *tuf.Repo, roleKeys map[string][]*sign.PrivateKey) {
-	for role, keys := range roleKeys {
-		for _, key := range keys {
-			assertNotNil(repo.AddPrivateKeyWithExpires(role, key, expirationDate))
+func addKeys(repo *tuf.Repo, roleKeys map[string][]*data.PrivateKey) {
+	for role, keyList := range roleKeys {
+		for _, key := range keyList {
+			signer, err := keys.GetSigner(key)
+			assertNotNil(err)
+			assertNotNil(repo.AddPrivateKeyWithExpires(role, signer, expirationDate))
 		}
 	}
 }
@@ -67,22 +70,24 @@ func addTargets(repo *tuf.Repo, dir string, files map[string][]byte) {
 	assertNotNil(repo.AddTargetsWithExpires(paths, nil, expirationDate))
 }
 
-func revokeKeys(repo *tuf.Repo, role string, keys []*sign.PrivateKey) {
-	for _, key := range keys {
-		assertNotNil(repo.RevokeKeyWithExpires(role, key.PublicData().IDs()[0], expirationDate))
+func revokeKeys(repo *tuf.Repo, role string, keyList []*data.PrivateKey) {
+	for _, key := range keyList {
+		signer, err := keys.GetSigner(key)
+		assertNotNil(err)
+		assertNotNil(repo.RevokeKeyWithExpires(role, signer.PublicData().IDs()[0], expirationDate))
 	}
 }
 
 func generateRepos(dir string, consistentSnapshot bool) {
 	f, err := os.Open("../keys.json")
 	assertNotNil(err)
 
-	var roleKeys map[string][][]*sign.PrivateKey
+	var roleKeys map[string][][]*data.PrivateKey
 	assertNotNil(json.NewDecoder(f).Decode(&roleKeys))
 
 	// Collect all the initial keys we'll use when creating repositories.
 	// We'll modify this to reflect rotated keys.
-	keys := map[string][]*sign.PrivateKey{
+	keys := map[string][]*data.PrivateKey{
 		"root":      roleKeys["root"][0],
 		"targets":   roleKeys["targets"][0],
 		"snapshot":  roleKeys["snapshot"][0],
@@ -110,7 +115,7 @@ func generateRepos(dir string, consistentSnapshot bool) {
 
 		// Actually rotate the keys
 		revokeKeys(repo, role, roleKeys[role][0])
-		addKeys(repo, map[string][]*sign.PrivateKey{
+		addKeys(repo, map[string][]*data.PrivateKey{
 			role: roleKeys[role][1],
 		})
 		keys[role] = roleKeys[role][1]

client/testdata/go-tuf-transition-M4/generate.go

@@ -11,14 +11,15 @@ import (
 	"time"
 
 	tuf "github.com/theupdateframework/go-tuf"
-	"github.com/theupdateframework/go-tuf/sign"
+	"github.com/theupdateframework/go-tuf/data"
+	"github.com/theupdateframework/go-tuf/pkg/keys"
 )
 
 var expirationDate = time.Date(2100, time.January, 1, 0, 0, 0, 0, time.UTC)
 
 type persistedKeys struct {
 	Encrypted bool               `json:"encrypted"`
-	Data      []*sign.PrivateKey `json:"data"`
+	Data      []*data.PrivateKey `json:"data"`
 }
 
 func assertNotNil(err error) {
@@ -48,7 +49,7 @@ func commit(dir string, repo *tuf.Repo) {
 	assertNotNil(os.RemoveAll(filepath.Join(dir, "keys")))
 }
 
-func addKeys(repo *tuf.Repo, roleKeys map[string][]*sign.PrivateKey) {
+func addKeys(repo *tuf.Repo, roleKeys map[string][]*data.PrivateKey) {
 	for role, keys := range roleKeys {
 		for _, key := range keys {
 			assertNotNil(repo.AddPrivateKeyWithExpires(role, key, expirationDate))
@@ -67,22 +68,24 @@ func addTargets(repo *tuf.Repo, dir string, files map[string][]byte) {
 	assertNotNil(repo.AddTargetsWithExpires(paths, nil, expirationDate))
 }
 
-func revokeKeys(repo *tuf.Repo, role string, keys []*sign.PrivateKey) {
-	for _, key := range keys {
-		assertNotNil(repo.RevokeKeyWithExpires(role, key.PublicData().IDs()[0], expirationDate))
+func revokeKeys(repo *tuf.Repo, role string, keyList []*data.PrivateKey) {
+	for _, key := range keyList {
+		signer, err := keys.GetSigner(key)
+		assertNotNil(err)
+		assertNotNil(repo.RevokeKeyWithExpires(role, signer.PublicData().IDs()[0], expirationDate))
 	}
 }
 
 func generateRepos(dir string, consistentSnapshot bool) {
 	f, err := os.Open("../keys.json")
 	assertNotNil(err)
 
-	var roleKeys map[string][][]*sign.PrivateKey
+	var roleKeys map[string][][]*data.PrivateKey
 	assertNotNil(json.NewDecoder(f).Decode(&roleKeys))
 
 	// Collect all the initial keys we'll use when creating repositories.
 	// We'll modify this to reflect rotated keys.
-	keys := map[string][]*sign.PrivateKey{
+	keys := map[string][]*data.PrivateKey{
 		"root":      roleKeys["root"][0],
 		"targets":   roleKeys["targets"][0],
 		"snapshot":  roleKeys["snapshot"][0],
@@ -110,7 +113,7 @@ func generateRepos(dir string, consistentSnapshot bool) {
 
 		// Actually rotate the keys
 		revokeKeys(repo, role, roleKeys[role][0])
-		addKeys(repo, map[string][]*sign.PrivateKey{
+		addKeys(repo, map[string][]*data.PrivateKey{
 			role: roleKeys[role][1],
 		})
 		keys[role] = roleKeys[role][1]

client/testdata/go-tuf/generator/generator.go

@@ -11,14 +11,15 @@ import (
 	"time"
 
 	tuf "github.com/theupdateframework/go-tuf"
-	"github.com/theupdateframework/go-tuf/sign"
+	"github.com/theupdateframework/go-tuf/data"
+	"github.com/theupdateframework/go-tuf/pkg/keys"
 )
 
 var expirationDate = time.Date(2100, time.January, 1, 0, 0, 0, 0, time.UTC)
 
 type persistedKeys struct {
 	Encrypted bool               `json:"encrypted"`
-	Data      []*sign.PrivateKey `json:"data"`
+	Data      []*data.PrivateKey `json:"data"`
 }
 
 func assertNotNil(err error) {
@@ -48,10 +49,12 @@ func commit(dir string, repo *tuf.Repo) {
 	assertNotNil(os.RemoveAll(filepath.Join(dir, "keys")))
 }
 
-func addKeys(repo *tuf.Repo, roleKeys map[string][]*sign.PrivateKey) {
-	for role, keys := range roleKeys {
-		for _, key := range keys {
-			assertNotNil(repo.AddPrivateKeyWithExpires(role, key, expirationDate))
+func addKeys(repo *tuf.Repo, roleKeys map[string][]*data.PrivateKey) {
+	for role, keyList := range roleKeys {
+		for _, key := range keyList {
+			signer, err := keys.GetSigner(key)
+			assertNotNil(err)
+			assertNotNil(repo.AddPrivateKeyWithExpires(role, signer, expirationDate))
 		}
 	}
 }
@@ -67,16 +70,18 @@ func addTargets(repo *tuf.Repo, dir string, files map[string][]byte) {
 	assertNotNil(repo.AddTargetsWithExpires(paths, nil, expirationDate))
 }
 
-func revokeKeys(repo *tuf.Repo, role string, keys []*sign.PrivateKey) {
-	for _, key := range keys {
-		assertNotNil(repo.RevokeKeyWithExpires(role, key.PublicData().IDs()[0], expirationDate))
+func revokeKeys(repo *tuf.Repo, role string, keyList []*data.PrivateKey) {
+	for _, key := range keyList {
+		signer, err := keys.GetSigner(key)
+		assertNotNil(err)
+		assertNotNil(repo.RevokeKeyWithExpires(role, signer.PublicData().IDs()[0], expirationDate))
 	}
 }
 
-func generateRepos(dir string, roleKeys map[string][][]*sign.PrivateKey, consistentSnapshot bool) {
+func generateRepos(dir string, roleKeys map[string][][]*data.PrivateKey, consistentSnapshot bool) {
 	// Collect all the initial keys we'll use when creating repositories.
 	// We'll modify this to reflect rotated keys.
-	keys := map[string][]*sign.PrivateKey{
+	keys := map[string][]*data.PrivateKey{
 		"root":      roleKeys["root"][0],
 		"targets":   roleKeys["targets"][0],
 		"snapshot":  roleKeys["snapshot"][0],
@@ -104,7 +109,7 @@ func generateRepos(dir string, roleKeys map[string][][]*sign.PrivateKey, consist
 
 		// Actually rotate the keys
 		revokeKeys(repo, role, roleKeys[role][0])
-		addKeys(repo, map[string][]*sign.PrivateKey{
+		addKeys(repo, map[string][]*data.PrivateKey{
 			role: roleKeys[role][1],
 		})
 		keys[role] = roleKeys[role][1]
@@ -131,7 +136,7 @@ func Generate(dir string, keysPath string, consistentSnapshot bool) {
 	f, err := os.Open(keysPath)
 	assertNotNil(err)
 
-	var roleKeys map[string][][]*sign.PrivateKey
+	var roleKeys map[string][][]*data.PrivateKey
 	assertNotNil(json.NewDecoder(f).Decode(&roleKeys))
 
 	log.Printf("generating %s", dir)

client/testdata/tools/gen-keys.go

@@ -10,7 +10,7 @@ import (
 	"io/ioutil"
 	"time"
 
-	sign "github.com/theupdateframework/go-tuf/sign"
+	"github.com/theupdateframework/go-tuf/data"
 )
 
 var expirationDate = time.Date(2100, time.January, 1, 0, 0, 0, 0, time.UTC)
@@ -23,15 +23,15 @@ func main() {
 		"timestamp",
 	}
 
-	roles := make(map[string][][]*sign.PrivateKey)
+	roles := make(map[string][][]*data.PrivateKey)
 
 	for _, name := range rolenames {
-		keys := [][]*sign.PrivateKey{}
+		keys := [][]*data.PrivateKey{}
 
 		for i := 0; i < 2; i++ {
-			key, err := sign.GenerateEd25519Key()
+			key, err := keys.GenerateEd25519Key()
 			assertNotNil(err)
-			keys = append(keys, []*sign.PrivateKey{key})
+			keys = append(keys, []*data.PrivateKey{key})
 		}
 
 		roles[name] = keys