Skip to content

Commit f4c8234

Browse files
author
Kairo Araujo
committed
Include to dev enviroment RSTUF bootstrap inittuf
Include the RSTUF `bootstrap.json` payload in the `dev/rstuf/` folder. The bootstrap payload has the RSTUF complete ceremony process. It uses the keys available in the `dev/rstuf/keys` This commit also includes the `inittuf` in Makefile. The information in the development docs. - context (PEP 458) - command (bootstrap) - use (try out API) Signed-off-by: Kairo Araujo <[email protected]> Signed-off-by: Lukas Puehringer <[email protected]>
1 parent aa9144e commit f4c8234

File tree

3 files changed

+134
-0
lines changed

3 files changed

+134
-0
lines changed

‎Makefile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,9 @@ resetdb: .state/docker-build-base
125125
initdb: .state/docker-build-base .state/db-populated
126126
$(MAKE) reindex
127127

128+
inittuf: .state/docker-build-base
129+
docker compose run --rm web rstuf admin ceremony -b -u -f dev/rstuf/bootstrap.json --api-server http://rstuf-api
130+
128131
runmigrations: .state/docker-build-base
129132
docker compose run --rm web python -m warehouse db upgrade head
130133

‎dev/rstuf/bootstrap.json

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"settings": {
3+
"roles": {
4+
"root": {
5+
"expiration": 365
6+
},
7+
"targets": {
8+
"expiration": 365
9+
},
10+
"snapshot": {
11+
"expiration": 1
12+
},
13+
"timestamp": {
14+
"expiration": 1
15+
},
16+
"bins": {
17+
"expiration": 1,
18+
"number_of_delegated_bins": 4
19+
}
20+
}
21+
},
22+
"metadata": {
23+
"root": {
24+
"signatures": [
25+
{
26+
"keyid": "c6d8bf2e4f48b41ac2ce8eca21415ca8ef68c133b47fc33df03d4070a7e1e9cc",
27+
"sig": "19dd6b1d5da8149b5a490efc8137beedb85ae036255244b2eba909efe05561636e56c0f9a3fe219601602c142b74cc9d2ab5ba18016cb1f3fb81f16f4cb89100"
28+
}
29+
],
30+
"signed": {
31+
"_type": "root",
32+
"version": 1,
33+
"spec_version": "1.0.31",
34+
"expires": "2025-02-21T13:58:51Z",
35+
"consistent_snapshot": true,
36+
"keys": {
37+
"50d7e110ad65f3b2dba5c3cfc8c5ca259be9774cc26be3410044ffd4be3aa5f3": {
38+
"keytype": "ecdsa",
39+
"scheme": "ecdsa-sha2-nistp256",
40+
"keyval": {
41+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcLYSZyFGeKdWNt5dWFbnv6N9NyHC\noUNLcG6GZIxLwN8Q8MUdHdOOxGkDnyBRSJpIZ/r/oDECSTwfCYhdogweLA==\n-----END PUBLIC KEY-----\n"
42+
},
43+
"x-rstuf-key-name": "my ecdsa root key"
44+
},
45+
"c6d8bf2e4f48b41ac2ce8eca21415ca8ef68c133b47fc33df03d4070a7e1e9cc": {
46+
"keytype": "ed25519",
47+
"scheme": "ed25519",
48+
"keyval": {
49+
"public": "4f66dabebcf30628963786001984c0b75c175cdcf3bc4855933a2628f0cd0a0f"
50+
},
51+
"x-rstuf-key-name": "my ed25519 root key"
52+
},
53+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241": {
54+
"keytype": "rsa",
55+
"scheme": "rsassa-pss-sha256",
56+
"keyval": {
57+
"public": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhX6rioiL/cX5Ys32InF\nU52H8tL14QeX0tacZdb+AwcH6nIh97h3RSHvGD7Xy6uaMRmGldAnSVYwJHqoJ5j2\nynVzU/RFpr+6n8Ps0QFg5GmlEqZboFjLbS0bsRQcXXnqJNsVLEPT3ULvu1rFRbWz\nAMFjNtNNk5W/u0GEzXn3D03jIdhD8IKAdrTRf0VMD9TRCXLdMmEU2vkf1NVUnOTb\n/dRX5QA8TtBylVnouZknbavQ0J/pPlHLfxUgsKzodwDlJmbPG9BWwXqQCmP0DgOG\nNIZ1X281MOBaGbkNVEuntNjCSaQxQjfALVVU5NAfal2cwMINtqaoc7Wa+TWvpFEI\nWwIDAQAB\n-----END PUBLIC KEY-----\n"
58+
},
59+
"x-rstuf-online-key-uri": "fn:2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
60+
}
61+
},
62+
"roles": {
63+
"root": {
64+
"keyids": [
65+
"50d7e110ad65f3b2dba5c3cfc8c5ca259be9774cc26be3410044ffd4be3aa5f3",
66+
"c6d8bf2e4f48b41ac2ce8eca21415ca8ef68c133b47fc33df03d4070a7e1e9cc"
67+
],
68+
"threshold": 1
69+
},
70+
"targets": {
71+
"keyids": [
72+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
73+
],
74+
"threshold": 1
75+
},
76+
"timestamp": {
77+
"keyids": [
78+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
79+
],
80+
"threshold": 1
81+
},
82+
"snapshot": {
83+
"keyids": [
84+
"2f685fa7546f1856b123223ab086b3def14c89d24eef18f49c32508c2f60e241"
85+
],
86+
"threshold": 1
87+
}
88+
}
89+
}
90+
}
91+
}
92+
}

‎docs/dev/development/getting-started.rst

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,45 @@ or that the ``static`` container has finished compiling the static assets:
242242
243243
or maybe something else.
244244

245+
Bootstrapping the TUF Metadata Repository
246+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
247+
248+
To enable PyPI Index Signing (`PEP 458 <https://peps.python.org/pep-0458/>`_),
249+
you have to first bootstrap the TUF metadata repository.
250+
251+
Wait until `make serve` has finished, then run:
252+
253+
.. code-block:: console
254+
255+
make inittuf
256+
257+
You should see the following line at the bottom of the output:
258+
259+
.. code-block:: console
260+
261+
Bootstrap completed using `dev/rstuf/bootstrap.json`. 🔐 🎉
262+
263+
264+
This command sends a static *bootstrap payload* to the RSTUF API. The payload
265+
includes the TUF trust root for development and other configuration.
266+
267+
By calling this API, RSTUF creates the TUF metadata repository, installs the
268+
TUF trust root for development, and creates the initial set of TUF metadata.
269+
270+
.. note::
271+
272+
The RSTUF API is exposed only for development purposes and will not be
273+
available in production. Currently, no upload hooks or automatic metadata
274+
update tasks are configured to interact with RSTUF.
275+
276+
Take a look at the `RSTUF API documentation
277+
<https://repository-service-tuf.readthedocs.io/en/stable/guide/general/usage.html#adding-artifacts>`_
278+
to see how you can simulate artifact upload or removal, and how they affect
279+
the TUF metadata repository:
280+
281+
* RSTUF API: http://localhost:8001
282+
* TUF Metadata Repository: http://localhost:9001/tuf-metadata/
283+
245284

246285
Resetting the development database
247286
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

0 commit comments

Comments
 (0)