feat: trust rootcertbundle public keys with libtrust keyid format #4417
Conversation
for the sake of backward compatibility Fix distribution#4096 Fix distribution#4299 Signed-off-by: Youfu Zhang <[email protected]>
| // SHA256(DER encoded ASN1) | ||
| // Then truncated to 240 bits and encoded into 12 base32 groups like so: | ||
| // ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ23:4567:ABCD:EFGH:IJKL:MNOP | ||
| func libtrustKeyIDFromPublicKey(pubKey any) string { |
There was a problem hiding this comment.
the issue we had with libtrust is it does things that are not standardized anywhere like this ID generation func.
That was actually the main reason we went for explicit JWKs defined on the consumer side.
There was a problem hiding this comment.
The intention to introduce breaking changes should be guided by the goal of minimizing disruption. For instance, when implementing breaking changes in Go, there are multiple phases such as opt-in, opt-out, and eventual removal.
I agree that non-standard key id generation like this is not good. But libtrust is already gone, the key id generation in this PR is more likely mental burden instead of maintainance burden. A phased deprecation plan with decent migration guidance would be helpful to the community.
PS: The document still states that rootcertbundle is a required configuration option. If I understand correctly, it should be optionally after the introduce of jwks.
Before #4096, the trusted keys always comes from
rootcertbundlepublic keys, thekids are generated using libtrust's non-standardkeyIDFromCryptoKey.distribution/registry/auth/token/accesscontroller.go
Lines 214 to 223 in 5d5c60f
After #4096, the public keys of
rootcertbundleis no longer trusted by default. The trusted keys must be configured viajwksoption pointing to a JWKS (JSON Web Key Set) file.distribution/registry/auth/token/accesscontroller.go
Lines 271 to 281 in fe21f43
It is not trivial to extract public key from PEM format public key, convert it to JWK, append a libtrust flavor
kidto the JWK, then compose a JWKS file. And in my opinion, this is the most troublesome part during my migration to distribution v3.This change replicated keyid generation logic from
libtrust, trusts public keys ofrootcertbundleby default. It is intended to help more people migrates to distribution v3 without experiencing auth issues like #4299.