Signing scheme fixes

CHANGELOG.md

@@ -11,8 +11,14 @@ and this project adheres to [Semantic Versioning][semver].
 
 ### Changed
 
+- Remove unused `scheme` parameters ([757])
+
 ### Fixed
 
+- Detect signing scheme from key material instead of assuming RSA ([757])
+
+
+[757]: https://github.com/openlawlibrary/taf/pull/757
 
 ## [0.39.0]
 

taf/api/api_workflow.py

@@ -10,7 +10,6 @@
 )
 from taf.auth_repo import AuthenticationRepository
 from taf.config import load_config
-from taf.constants import DEFAULT_RSA_SIGNATURE_SCHEME
 from taf.exceptions import InvalidConfigError, PushFailedError, TAFError
 from taf.keys import load_signers
 from taf.messages import git_commit_message
@@ -257,7 +256,6 @@ def manage_repo_and_signers(
     auth_repo: AuthenticationRepository,
     roles: Optional[List[str]] = None,
     keystore: Optional[Union[str, Path]] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     prompt_for_keys: Optional[bool] = False,
     paths_to_reset_on_error: Optional[List[Union[str, Path]]] = None,
     load_roles: Optional[bool] = True,
@@ -279,7 +277,6 @@ def manage_repo_and_signers(
         auth_repo (AuthenticationRepository): Already instantiated authentication repository.
         roles (Optional[List[str]]): List of roles that are expected to be updated.
         keystore (Optional[Union[str, Path]]): Path to the keystore containing signing keys.
-        scheme (Optional[str]): The signature scheme.
         prompt_for_keys (Optional[bool]): If True, prompts for keys if not found. Defaults to False.
         paths_to_reset_on_error (Optional[List[Union[str, Path]]]): Paths to reset if an error occurs.
         load_roles (Optional[bool]): If True, loads signing keys of the roles specified using the argument of the same name.
@@ -314,7 +311,6 @@ def manage_repo_and_signers(
                         auth_repo,
                         role,
                         keystore=keystore_path,
-                        scheme=scheme,
                         prompt_for_keys=prompt_for_keys,
                     )
                     auth_repo.add_signers_to_cache({role: keystore_signers})

taf/api/dependencies.py

@@ -12,7 +12,6 @@
 from pathlib import Path
 
 from taf.auth_repo import AuthenticationRepository
-from taf.constants import DEFAULT_RSA_SIGNATURE_SCHEME
 from taf.exceptions import TAFError
 from taf.git import GitRepository
 from taf.log import taf_logger
@@ -74,7 +73,6 @@ def add_dependency(
     dependency_path: Optional[str] = None,
     dependency_url: Optional[str] = None,
     library_dir: Optional[str] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     custom: Optional[Dict] = None,
     prompt_for_keys: Optional[bool] = False,
     commit: Optional[bool] = True,
@@ -97,7 +95,6 @@ def add_dependency(
         keystore: Location of the keystore files.
         dependency_path (optional): Path to the dependency repository which is to be added. Can be omitted if dependency_name
         library_dir (optional): Path to the library's root directory. Determined based on the authentication repository's path if not provided.
-        scheme (optional): Signing scheme. Set to rsa-pkcs1v15-sha256 by default.
         custom (optional): Additional data that will be added to dependencies.json if specified.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
@@ -180,7 +177,6 @@ def add_dependency(
         pin_manager=pin_manager,
         keystore=keystore,
         commit=commit,
-        scheme=scheme,
         auth_repo=auth_repo,
         update_snapshot_and_timestamp=True,
         prompt_for_keys=prompt_for_keys,
@@ -206,7 +202,6 @@ def remove_dependency(
     pin_manager: PinManager,
     dependency_name: str,
     keystore: str,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     prompt_for_keys: Optional[bool] = False,
     commit: Optional[bool] = True,
     push: Optional[bool] = True,
@@ -219,7 +214,6 @@ def remove_dependency(
         path: Path to the authentication repository.
         dependency_name: Name of the dependency which should be removed.
         keystore: Location of the keystore files.
-        scheme (optional): Signing scheme. Set to rsa-pkcs1v15-sha256 by default.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
         push (optional): Flag specifying whether to push to remote
@@ -269,7 +263,6 @@ def remove_dependency(
         pin_manager=pin_manager,
         keystore=keystore,
         commit=commit,
-        scheme=scheme,
         auth_repo=auth_repo,
         update_snapshot_and_timestamp=True,
         prompt_for_keys=prompt_for_keys,

taf/api/metadata.py

@@ -9,7 +9,6 @@
 from taf.api.utils._git import check_if_clean_and_synced
 from taf.api.api_workflow import manage_repo_and_signers
 from taf.exceptions import TAFError
-from taf.constants import DEFAULT_RSA_SIGNATURE_SCHEME
 from taf.messages import git_commit_message
 from taf.tuf.repository import MetadataRepository as TUFRepository
 from taf.log import Path, taf_logger
@@ -28,7 +27,6 @@ def add_key_names(
     path: str,
     keys_description: Path,
     pin_manager: PinManager,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     keystore: Optional[str] = None,
     commit: Optional[bool] = True,
     commit_msg: Optional[str] = None,
@@ -69,10 +67,9 @@ def add_key_names(
 
     with manage_repo_and_signers(
         auth_repo,
-        list(parent_roles),
-        keystore,
-        scheme,
-        prompt_for_keys,
+        roles=list(parent_roles),
+        keystore=keystore,
+        prompt_for_keys=prompt_for_keys,
         load_snapshot_and_timestamp=update_snapshot_and_timestamp,
         commit=commit,
         commit_msg=commit_msg,
@@ -161,7 +158,6 @@ def update_metadata_expiration_date(
     roles: List[str],
     interval: Optional[int] = None,
     keystore: Optional[str] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     start_date: Optional[datetime] = None,
     commit: Optional[bool] = True,
     commit_msg: Optional[str] = None,
@@ -181,7 +177,6 @@ def update_metadata_expiration_date(
         interval: Number of days added to the start date in order to calculate the
             expiration date.
         keystore (optional): Keystore directory's path
-        scheme (optional): Signature scheme.
         start_date (optional): Date to which expiration interval is added.
             Set to today if not specified.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
@@ -216,10 +211,9 @@ def update_metadata_expiration_date(
 
     with manage_repo_and_signers(
         auth_repo,
-        roles,
-        keystore,
-        scheme,
-        prompt_for_keys,
+        roles=roles,
+        keystore=keystore,
+        prompt_for_keys=prompt_for_keys,
         load_snapshot_and_timestamp=update_snapshot_and_timestamp,
         commit=commit,
         commit_msg=commit_msg,
@@ -254,7 +248,6 @@ def update_snapshot_and_timestamp(
     pin_manager: PinManager,
     keystore: Optional[str] = None,
     roles_to_sync: Optional[List[str]] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     commit: Optional[bool] = True,
     commit_msg: Optional[str] = None,
     prompt_for_keys: Optional[bool] = False,
@@ -268,7 +261,6 @@ def update_snapshot_and_timestamp(
     Arguments:
         path: Authentication repository's location.
         keystore (optional): Keystore directory's path
-        scheme (optional): Signature scheme.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
         commit_msg (optional): Custom commit messages.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
@@ -289,10 +281,9 @@ def update_snapshot_and_timestamp(
 
     with manage_repo_and_signers(
         auth_repo,
-        [],
-        keystore,
-        scheme,
-        prompt_for_keys,
+        roles=[],
+        keystore=keystore,
+        prompt_for_keys=prompt_for_keys,
         load_snapshot_and_timestamp=True,
         commit=commit,
         commit_msg=commit_msg,

taf/api/roles.py

@@ -123,6 +123,7 @@ def add_role(
     new_role.number = keys_number
     new_role.threshold = threshold
     new_role.yubikey = yubikey
+    new_role.scheme = scheme
 
     signers, verification_keys = load_sorted_keys_of_new_roles(
         roles=new_role,
@@ -136,7 +137,6 @@ def add_role(
         auth_repo,
         roles=[parent_role],
         keystore=keystore_path,
-        scheme=scheme,
         prompt_for_keys=prompt_for_keys,
         load_roles=True,
         load_snapshot_and_timestamp=True,
@@ -244,7 +244,6 @@ def add_roles(
     pin_manager: PinManager,
     keystore: Optional[str] = None,
     roles_key_infos: Optional[str] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     prompt_for_keys: Optional[bool] = False,
     commit: Optional[bool] = True,
     push: Optional[bool] = True,
@@ -258,7 +257,6 @@ def add_roles(
         path: Path to the authentication repository.
         keystore (optional): Location of the keystore files.
         roles_key_infos: Path to a json file which contains information about repository's roles and keys.
-        scheme (optional): Signing scheme. Set to rsa-pkcs1v15-sha256 by default.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
         push (optional): Flag specifying whether to push to remote.
@@ -321,7 +319,6 @@ def add_roles(
         auth_repo,
         roles=roles_to_load,
         keystore=keystore_path,
-        scheme=scheme,
         prompt_for_keys=prompt_for_keys,
         load_snapshot_and_timestamp=True,
         commit_msg=commit_msg,
@@ -353,7 +350,6 @@ def add_signing_key(
     pub_key_path: Optional[str] = None,
     pub_key: Optional[SSlibKey] = None,
     keystore: Optional[str] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     commit: Optional[bool] = True,
     prompt_for_keys: Optional[bool] = False,
     push: Optional[bool] = True,
@@ -370,7 +366,6 @@ def add_signing_key(
         pub_key_path (optional): path to the file containing the public component of the new key. If not provided,
             it will be necessary to ender the key when prompted.
         keystore (optional): Location of the keystore files.
-        scheme (optional): Signing scheme. Set to rsa-pkcs1v15-sha256 by default.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
         push (optional): Flag specifying whether to push to remote.
@@ -384,7 +379,7 @@ def add_signing_key(
     """
 
     pub_key = pub_key or _load_pub_key_from_file(
-        pub_key_path, prompt_for_keys=prompt_for_keys, scheme=scheme
+        pub_key_path, prompt_for_keys=prompt_for_keys
     )
 
     roles_keys = {role: [pub_key] for role in roles}
@@ -395,10 +390,9 @@ def add_signing_key(
 
     with manage_repo_and_signers(
         auth_repo,
-        roles,
-        keystore,
-        scheme,
-        prompt_for_keys,
+        roles=roles,
+        keystore=keystore,
+        prompt_for_keys=prompt_for_keys,
         load_snapshot_and_timestamp=True,
         load_parents=True,
         load_roles=False,
@@ -436,7 +430,6 @@ def revoke_signing_key(
     key_id: str,
     roles: Optional[List[str]] = None,
     keystore: Optional[str] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     commit: Optional[bool] = True,
     prompt_for_keys: Optional[bool] = False,
     push: Optional[bool] = True,
@@ -452,7 +445,6 @@ def revoke_signing_key(
         roles: A list of roles whose signing keys need to be extended.
         key_id: id of the key to be removed
         keystore (optional): Location of the keystore files.
-        scheme (optional): Signing scheme. Set to rsa-pkcs1v15-sha256 by default.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
         push (optional): Flag specifying whether to push to remote.
@@ -473,10 +465,9 @@ def revoke_signing_key(
 
     with manage_repo_and_signers(
         auth_repo,
-        roles_to_update,
-        keystore,
-        scheme,
-        prompt_for_keys,
+        roles=roles_to_update,
+        keystore=keystore,
+        prompt_for_keys=prompt_for_keys,
         load_snapshot_and_timestamp=True,
         load_parents=True,
         load_roles=False,
@@ -521,7 +512,6 @@ def rotate_signing_key(
     pub_key_path: Optional[str] = None,
     roles: Optional[List[str]] = None,
     keystore: Optional[str] = None,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     prompt_for_keys: Optional[bool] = False,
     push: Optional[bool] = True,
     revoke_commit_msg: Optional[str] = None,
@@ -541,7 +531,6 @@ def rotate_signing_key(
         pub_key_path (optional): path to the file containing the public component of the new key. If not provided,
             it will be necessary to ender the key when prompted.
         keystore (optional): Location of the keystore files.
-        scheme (optional): Signing scheme. Set to rsa-pkcs1v15-sha256 by default.
         prompt_for_keys (optional): Whether to ask the user to enter their key if it is not located inside the keystore directory.
         commit (optional): Indicates if the changes should be committed and pushed automatically.
         push (optional): Flag specifying whether to push to remote.
@@ -555,9 +544,7 @@ def rotate_signing_key(
         None
     """
 
-    pub_key = _load_pub_key_from_file(
-        pub_key_path, prompt_for_keys=prompt_for_keys, scheme=scheme
-    )
+    pub_key = _load_pub_key_from_file(pub_key_path, prompt_for_keys=prompt_for_keys)
     auth_repo = AuthenticationRepository(path=path, pin_manager=pin_manager)
     keys_name_mappings = read_keys_name_mapping(keys_description)
     auth_repo.add_key_names(keys_name_mappings)
@@ -570,7 +557,6 @@ def rotate_signing_key(
             key_id=key_id,
             roles=roles,
             keystore=keystore,
-            scheme=scheme,
             commit=commit,
             prompt_for_keys=prompt_for_keys,
             push=False,
@@ -583,7 +569,6 @@ def rotate_signing_key(
             roles=roles,
             pub_key=pub_key,
             keystore=keystore,
-            scheme=scheme,
             commit=commit,
             prompt_for_keys=prompt_for_keys,
             push=push,
@@ -706,15 +691,15 @@ def _enter_role_info(
     return role_info
 
 
-def _load_pub_key_from_file(pub_key_path, prompt_for_keys, scheme) -> SSlibKey:
+def _load_pub_key_from_file(pub_key_path, prompt_for_keys) -> SSlibKey:
     pub_key_pem = None
     if pub_key_path is not None:
         pub_key_pem_path = Path(pub_key_path)
         if pub_key_pem_path.is_file():
             pub_key_pem = Path(pub_key_path).read_text()
 
     if pub_key_pem is None and prompt_for_keys:
-        pub_key_pem = new_public_key_cmd_prompt(scheme)["keyval"]["public"]
+        pub_key_pem = new_public_key_cmd_prompt()["keyval"]["public"]
 
     if pub_key_pem is None:
         raise TAFError("Public key not provided or invalid")
@@ -1100,7 +1085,6 @@ def remove_paths(
     pin_manager: PinManager,
     paths: List[str],
     keystore: str,
-    scheme: Optional[str] = DEFAULT_RSA_SIGNATURE_SCHEME,
     commit: Optional[bool] = True,
     commit_msg: Optional[str] = None,
     prompt_for_keys: Optional[bool] = False,
@@ -1144,7 +1128,6 @@ def remove_paths(
         auth_repo,
         roles=list(paths_to_remove_from_roles.keys()),
         keystore=keystore,
-        scheme=scheme,
         prompt_for_keys=prompt_for_keys,
         load_roles=False,
         load_parents=True,