Notary key rotate should take key ID/file #1118
Milestone
Comments
|
Hi @endophage good idea. we are thinking about working on this feature. Currently |
|
Agreed on all points!
…On May 1, 2017, 09:35 -0700, Mike Chen ***@***.***>, wrote:
Hi @endophage (https://github.com/endophage) good idea. we are thinking about working on this feature. Currently notary init has a flag --rootkey path/to/key.key implemented allowing a root key to specified during initialization. A similar flag for key rotate could be desirable. Additionally a --rootcert flag could also be useful in specifying the path to the certificate corresponding to the key.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub (#1118 (comment)), or mute the thread (https://github.com/notifications/unsubscribe-auth/ABPeS7j0NKwylvrmQ0d7GzN3SCbQuXg-ks5r1gnLgaJpZM4Mi0gS).
|
cyc115
pushed a commit
to cyc115/notary
that referenced
this issue
Oct 10, 2017
This will allow user to rotate a repository's root key to a pinned trust, make trust pinning more useful. - add `--rootcert` flag to key rotation - add `-y` flag to key rotate to allow auto-confirmation of rotating root keys (no user interaction required) - allow mismatched key-certificate pair to be provided. an example usage would be : The PR includes the following: `notary key rotate [GUN] root --key path/to/key.key --rootcert path/to/rootcert.pem` related issues: notaryproject#1144, notaryproject#1118, notaryproject#731 Signed-off-by: Chen Yuechuan-XJQW46 <[email protected]>
endophage
pushed a commit
to cyc115/notary
that referenced
this issue
Oct 26, 2017
This will allow user to rotate a repository's root key to a pinned trust, make trust pinning more useful. - add `--rootcert` flag to key rotation - add `-y` flag to key rotate to allow auto-confirmation of rotating root keys (no user interaction required) - allow mismatched key-certificate pair to be provided. an example usage would be : The PR includes the following: `notary key rotate [GUN] root --key path/to/key.key --rootcert path/to/rootcert.pem` related issues: notaryproject#1144, notaryproject#1118, notaryproject#731 Signed-off-by: Chen Yuechuan-XJQW46 <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently
notary key rotatealways generates keys for you. For local keys, we should allow a key ID (of a key already existing in the key storage), or a key file (in the same format asimportaccepts) to be provided.There can (should?) be separate flags for an ID vs a file. It might also be useful and to some degree future proofing to allow multiple IDs/files (in any combination) to be provided. For now all the keys would be added as signing keys with a threshold of 1. In the future,
key rotatecould also take a threshold flag.The text was updated successfully, but these errors were encountered: