keys

Ed25519 keys, their fingerprints, and certificates for the platform's keys.

A runner pins one root public key at install. The platform signs its responses with a separate key, and a certificate made with the root key vouches for it, so the platform key can be replaced without reinstalling runners. The root's private key is kept offline and is used only to certify.

Every signed answer carries the certificate of the key that signed it, in the :data:CERTIFICATE_HEADER header, so a runner learns a new key from the first answer signed with it. Each certificate has a serial, and a runner refuses a serial lower than the highest it has seen: replacing a key retires every certificate issued before it, once a runner has seen the new one. :class:PlatformSigner signs an answer that way.

PlatformSigner dataclass

The platform's signing key, and the root's certificate for it.

:meth:sign signs an answer to a runner the way :class:~yousleep_common.runner.client.RunnerClient checks it: the certificate goes with the signature, so the runner checks the certificate against its pinned root, then the answer against the certified key.

__post_init__()

Refuse a certificate for another key, whose every answer would fail to verify.

sign(response, request, request_signature, created)

Return the headers that sign response as the answer to request.

request_signature is the request's own signature, which the answer covers so that it answers that request alone. The headers include the certificate, in :data:CERTIFICATE_HEADER.

certify(root, kid, serial, public_key, not_after)

Certify public_key as kid until not_after with the root key.

serial must be higher than every earlier certificate's: runners that have seen it refuse the earlier ones.

decode_certificate(value)

Read a :data:CERTIFICATE_HEADER value, or raise SignatureError.

encode_certificate(certificate)

Return a certificate as the value of :data:CERTIFICATE_HEADER.

fingerprint(raw)

Return a key's fingerprint, as SHA256: and unpadded base64.

This is the form OpenSSH shows, so an administrator compares it the way they already compare host keys.

load_public_key(raw)

Load a public key from its 32 raw bytes.

public_key_bytes(key)

Return a public key's 32 raw bytes.

verify_certificate(root, certificate, now)

Return the certified key, or raise SignatureError.