Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Use multiple yubikeys at same time #503

Conversation

ronantakizawa
Copy link
Contributor

@ronantakizawa ronantakizawa commented Aug 14, 2024

Description (e.g. "Related to ...", etc.)

Use multiple yubikeys at same time (Key generation, repo generation, target signing). Resolves issue #244

Code review checklist (for code reviewer to complete)

  • Pull request represents a single change (i.e. not fixing disparate/unrelated things in a single PR)
  • Title summarizes what is changing
  • Commit messages are meaningful (see this for details)
  • Tests have been included and/or updated, as appropriate
  • Docstrings have been included and/or updated, as appropriate
  • Changelog has been updated, as needed (see CHANGELOG.md)

echo "install nfc /bin/false" | sudo tee -a /etc/modprobe.d/blacklist.conf
echo "install pn533 /bin/false" | sudo tee -a /etc/modprobe.d/blacklist.conf

- name: Build and install pyscard from source
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I remember having to build pyscard from source a while back, but at some point, it was no longer necessary. If this is a temporary workaround, please create an issue and provide some details, so that we don't forget about it.

.github/workflows/ci.yml Outdated Show resolved Hide resolved
taf/api/yubikey.py Outdated Show resolved Hide resolved
taf/api/yubikey.py Outdated Show resolved Hide resolved
serial = yk.get_serial_num(inserted_key)
else:
print(f"Final confirmation for {name} key")
serial = yk.verify_yubikey_serial()
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am currently unable to test this since I am not able to insert two yubikeys at the same time, but based on the code, it looks like you have to manually enter each of the yubikey's serial number. This is probably less user-friendly compared to having to remove and insert the devices. A bigger issue, however, is that we want to be able to sign metadata using YubiKeys plugged into our server. So, this should iterate over all inserted YubiKeys and simply try to sign using all of them, instead of asking for any input. So, let's say that you have timestamp and snapshot keys inserted and you need to sign timestamp metadata. We need to automatically detect the key that can sign the timestamp metadata. At the moment, the user will have to enter pins too, but we don't need to address that in this PR.

@renatav renatav changed the base branch from master to feature/multiple-yubikeys August 23, 2024 16:34
Copy link
Collaborator

@renatav renatav left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll merge this into a feature branch, to move this code off of the fork. Makes sense at first glance, but I am not able to test this since I am not able to plug in two YubiKeys at the same time.

@renatav renatav merged commit d3c45c1 into openlawlibrary:feature/multiple-yubikeys Aug 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants