-
Notifications
You must be signed in to change notification settings - Fork 100
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Decouple signing #594
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Moved from rdimitrov/go-tuf-metadata#62, raised by @udf2457
Is your feature request related to a problem? Please describe.
From my brief reading of the
metadata
code, at present your library appears to make the same mistake astheupdateframework/go-tuf
in that key signing is tighly coupled to primitive and crude on-disk keyfiles.This means that real-world secure key storage such as PKCS#11 (#427), AWS KMS (#525) and others e.g. Yubikey are not readily supported and require hacky work-around kludges to work (e.g. manually hacking json files).
Describe the solution you'd like
Of course support for signing from local keyfiles stored on disk should remain, but integration with real world applications where the private key is stored in a non-exfilterable format should be supported.
Describe alternatives you've considered
No response
Additional context
No response
The text was updated successfully, but these errors were encountered: