Remove deprecated CLI/API arguments and legacy securesystemslib integration #739
Conversation
Replace docs related to deprecated key interfaces with up-to-date docs. Signed-off-by: Lukas Puehringer <[email protected]>
Rewrite cli docs to use: - signing-key instead of key and key-type - verification-keys instead of layout-keys Signed-off-by: Lukas Puehringer <[email protected]>
Key generation is costly and the used interface is deprecated. Mocking the test data is good enough. This commit also removes redundant and unrelated tests. Signed-off-by: Lukas Puehringer <[email protected]>
Remove in-toto-verify cli tests related to the deprecated --layout-keys argument. Similar tests, which use the replacement argument --verification-key, have been added previously (see TestInTotoVerifySubjectPublicKeyInfoKeys). A few missing test cases are ported. Signed-off-by: Lukas Puehringer <[email protected]>
Use in-memory test key store instead of loading them from file. This is faster and does not require deprecated key file loading functions. Signed-off-by: Lukas Puehringer <[email protected]>
Remove or replace in-toto-sign and in-toto-record cli tests related to the the deprecated --key argument, and runlib tests related to the deprecated signing_key argument. Similar tests, which use the replacement --signing-key (cli) or signer (runlib) argument have been added previously. A few missing test cases are ported. The commit also switches to the in-memory test key store, instead of loading keys from files. Signed-off-by: Lukas Puehringer <[email protected]>
Tests use an in-memory test key store now, which is populated from key files only once. This increases test speed significantly, compared to generating keys on the fly, and doesn't need any deprecated key interfaces. Signed-off-by: Lukas Puehringer <[email protected]>
Signed-off-by: Lukas Puehringer <[email protected]>
Removes --layout-keys and the related --key-types in favor of --verification-keys. Signed-off-by: Lukas Puehringer <[email protected]>
Removes --key and the related --key-type in favor of --signing-key (cli), and removes signing_key argument in favor of signer (runlib). Signed-off-by: Lukas Puehringer <[email protected]>
Removes Metadata.sign in favor of the replacement create_signature method.. Signed-off-by: Lukas Puehringer <[email protected]>
Signed-off-by: Lukas Puehringer <[email protected]>
Signed-off-by: Lukas Puehringer <[email protected]>
securesystemslib no longer requires pynacl for ed25519 keys, instead pyca/cryptography can be used for all supported key types. Signed-off-by: Lukas Puehringer <[email protected]>
lukpueh
force-pushed
the
adopt-sslib-legacy-removal
branch
from
fec4bb7 to
8eae1a4
Compare
|
test failures in sslib main are expected an will be addressed in a separate PR |
These constants will no longer exist in securesystemslib 1.0.0. Signed-off-by: Lukas Puehringer <[email protected]>
There was a problem hiding this comment.
I didn't take the most detailed pass at this, but this looks good to me, minus some questions about versioning. If this is going to be a "breaking change" release (edit: I see from the last release notes that we call out a major release), maybe we can preserve some of the CLI arg names. --layout-keys, to me, is a lot clearer than --verification-keys, for example.
Yes, we could. Though, it would surely upset users, who "migrated" from IMO having a new different successor arg name, instead of repurposing the existing one, is a more transparent API break. |
|
Seems reasonable! I'll take another pass later today, sorry for the multiple go-s at this. :) |
see in-toto#739 (comment) Signed-off-by: Lukas Puehringer <[email protected]>
Co-authored-by: Aditya Sirish <[email protected]> Signed-off-by: Lukas Pühringer <[email protected]>
this is still true. merging... |
Fixes #697
This PR removes deprecated CLI and API arguments related to signature creation and verification. See deprecation and replacement note v2.2.0 release notes for details.
Docs and tests are updated accordingly.
I suggest to review commit by commit, and maybe skim test changes (coverage remains the same.
Nice side-effects are:
pynacloptional dependency is removed