github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2025-08-28 11:24:05 +00:00
Code Issues Projects Releases Wiki Activity

Load libtrust KeyIDs from certificate bundle

Browse Source 
Resolves issue where legacy Key IDs were not loaded from CA bundles, necessitating use of JWKS JSON

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
This commit is contained in:
Brad Davidson 2024-12-03 11:18:14 +00:00
parent e3007cd2bc
commit e4835f759a
No known key found for this signature in database
GPG Key ID: FFB7A9376A9349B9
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
registry/auth/token/accesscontroller.go
View File

@ -346,6 +346,9 @@ func newAccessController(options map[string]interface{}) (auth.AccessController,
if key := GetRFC7638Thumbprint(rootCert.PublicKey); key != "" {
trustedKeys[key] = rootCert.PublicKey
}
if key := GetLibtrustKeyID(rootCert.PublicKey); key != "" {
trustedKeys[key] = rootCert.PublicKey
}
}
if jwks != nil {

27
registry/auth/token/util.go
View File

@ -1,13 +1,17 @@
package token
import (
"bytes"
"crypto"
"crypto/ecdsa"
"crypto/rsa"
"crypto/sha256"
"crypto/x509"
"encoding/base32"
"encoding/base64"
"fmt"
"math/big"
"strings"
)
// actionSet is a special type of stringSet.
@ -84,3 +88,26 @@ func GetRFC7638Thumbprint(publickey crypto.PublicKey) string {
return hashAndEncode(payload)
}
// Returns a libtrust-compatible Key ID, for backwards compatibility
// with JWT headers expected by distribution/v2
func GetLibtrustKeyID(publickey crypto.PublicKey) string {
keyBytes, err := x509.MarshalPKIXPublicKey(publickey)
if err != nil {
return ""
}
sum := sha256.Sum256(keyBytes)
b64 := strings.TrimRight(base32.StdEncoding.EncodeToString(sum[:30]), "=")
var buf bytes.Buffer
var i int
for i = 0; i < len(b64)/4-1; i++ {
start := i * 4
end := start + 4
buf.WriteString(b64[start:end] + ":")
}
buf.WriteString(b64[i*4:])
return buf.String()
}