Add signing of SQL export #78
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
export command extented by --signKey and --certificate options, defaults to spacewalk keys. Export SQL file is then signed by this key and cert is packaged together with export import command exteded by --verifyKey, --skip-verify and --ca options. Verify key is first validated against CA, then SQL file signature is checked by verify key.
- add checks for certificate existence - add debug logs
|
Added new commit with checks if certs exists and also option to read private key passphrase from the file. Suggested by @cbosdo |
|
Rewrote the PR to be compatible with openssl1.1 and openssl3. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
--signKeyand--certificateoptions, defaults to spacewalk keys. Export SQL file is then signed by this key and cert is packaged together with export--verifyKey,--skip-verifyand--caoptions. Verify key is first validated against CA, then SQL file signature is checked by verify key.Public certificate for validating the export is included in the export and is validated by CA on import.
Optionally it is possible to pass different verification key on import, which too is validated by CA and custom CA option is also provided.
OpenSSL is added as a dependency of the ISSv2.
Issues: https://github.com/SUSE/spacewalk/issues/27004 and https://github.com/SUSE/spacewalk/issues/27015