44 lines
1.3 KiB
Python
44 lines
1.3 KiB
Python
"""Local publisher signing-key storage."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
from typing import Optional, Tuple
|
|
|
|
from .attestation import generate_keypair
|
|
from .config import CONFIG_DIR
|
|
|
|
SIGNING_KEY_FILE = CONFIG_DIR / "release-signing-key.json"
|
|
|
|
|
|
def load_signing_key(path: Path = SIGNING_KEY_FILE) -> Optional[Tuple[str, str]]:
|
|
if not path.exists():
|
|
return None
|
|
data = json.loads(path.read_text(encoding="utf-8"))
|
|
private_key = data.get("private_key", "")
|
|
public_key = data.get("public_key", "")
|
|
if not private_key or not public_key:
|
|
raise ValueError("Signing key file is incomplete")
|
|
return private_key, public_key
|
|
|
|
|
|
def initialize_signing_key(
|
|
path: Path = SIGNING_KEY_FILE, *, overwrite: bool = False
|
|
) -> Tuple[str, str]:
|
|
if path.exists() and not overwrite:
|
|
existing = load_signing_key(path)
|
|
if existing is None:
|
|
raise ValueError("Signing key file could not be loaded")
|
|
return existing
|
|
private_key, public_key = generate_keypair()
|
|
path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
|
|
path.write_text(json.dumps({
|
|
"algorithm": "ed25519",
|
|
"private_key": private_key,
|
|
"public_key": public_key,
|
|
}, indent=2) + "\n", encoding="utf-8")
|
|
os.chmod(path, 0o600)
|
|
return private_key, public_key
|