autograph

autograph copied to clipboard

use explicit hsm label key in signer configs

3

Instead of trying to load `signer.PrivateKey` as PEM then falling back to loading it as an HSM label use explicit hsmlabels as the config key e.g. ```yaml signers: - id:...

g-k

Extracted from [this comment](https://github.com/mozilla-services/autograph/issues/202#issuecomment-454426438) Likely a set of script to issue HSM commands, but there are some parsing challenges of output of the HSM being needed for the next step.

hwine

Update RelEng key management docs as keys migrated

2

There are at least two (2) sets of docs that should be updated as each key is migrated: 1. [Key generation docs] 2. [Key replacement workflow] sub-pages (includes unplanned replacement...

hwine

monitor and warn for unused keys and disable them after N days

3

refs: signing meetings notes for 2018-09-10 and https://bugzilla.mozilla.org/show_bug.cgi?id=1471730 First for autograph-edge then for autograph though this might need to wait on HSM migration in case ops are signing things locally.

g-k

Write scripts to measure signing latency and throughput for different key types and sizes we typically use (for MAR, content signature, XPI, and APK signing): * without an HSM (just...

g-k

Currently, we need debug output `-D` to output the signature field of a /sign/hash request (`-a`) from autograph-client. Instead: * base64 decode the output the signature field's value and print...

g-k

https://godoc.org/go.mozilla.org/mar#pkg-variables

g-k

Support being able to pin, restrict, or reify allowed options for an authorization

3

We want to be able to issue creds that only work with specific signer params (i.e. make sure they're least privileged) to protect against misuse and reduce the blast radius...

g-k

Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.10.4 to 1.10.7. Commits d5affd5 Merge pull request #1088 from kelvich/sni_support d65e6ae Merge pull request #1083 from nhooyr/fix-receiver-51e2 957fc0b Set SNI for TSL connections 89fee89 Use pointer...

dependabot[bot]

Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.42.15 to 1.44.109. Release notes Sourced from github.com/aws/aws-sdk-go's releases. Release v1.44.109 (2022-09-30) Service Client Updates service/codedeploy: Updates service API and documentation This release allows you to override...

dependabot[bot]