Skip to content

Remove internal use of securesystemslib.hash #977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lukpueh merged 6 commits into from
Mar 20, 2025
Merged

Remove internal use of securesystemslib.hash #977

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a275405
Remove securesystemslib.hash
Mar 19, 2025
f5f162f
Fix unsupported hash algo exception in GCPSigner
Mar 20, 2025
d5016ae
Refactor hash algo check in GCPSigner
Mar 20, 2025
74c71a5
Revert "Refactor hash algo check in GCPSigner"
Mar 20, 2025
b3f05c8
Re-add securesystemslib hash module
Mar 20, 2025
3574b50
Improve todo comment in GCPSigner
Mar 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions securesystemslib/signer/_azure_signer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@

from __future__ import annotations

import hashlib
import logging
from urllib import parse

import securesystemslib.hash as sslib_hash
from securesystemslib.exceptions import UnsupportedLibraryError
from securesystemslib.signer._key import Key, SSlibKey
from securesystemslib.signer._signer import SecretsHandler, Signature, Signer
Expand Down Expand Up @@ -245,7 +245,7 @@ def sign(self, payload: bytes) -> Signature:
Signature.
"""

hasher = sslib_hash.digest(self.hash_algorithm)
hasher = hashlib.new(self.hash_algorithm)
hasher.update(payload)
digest = hasher.digest()
response = self.crypto_client.sign(self.signature_algorithm, digest)
Expand Down
11 changes: 8 additions & 3 deletions securesystemslib/signer/_gcp_signer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@

from __future__ import annotations

import hashlib
import logging
from urllib import parse

import securesystemslib.hash as sslib_hash
from securesystemslib import exceptions
from securesystemslib.signer._key import Key, SSlibKey
from securesystemslib.signer._signer import SecretsHandler, Signature, Signer
Expand Down Expand Up @@ -180,7 +180,12 @@ def _get_hash_algorithm(public_key: Key) -> str:
)

# trigger UnsupportedAlgorithm if appropriate
Copy link
Copy Markdown
Member Author

@lukpueh lukpueh Mar 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is now a ValueError, which breaks the API and is also inconsistent with above, where we raise an UnsupportedAlgorithmError for some unsupported algorithms. Same is true for other signers in this PR

I'll mark the PR as draft until I fix this.

Copy link
Copy Markdown
Member Author

@lukpueh lukpueh Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Turns out, other signers exhaustively check public key schemes prior to using the hash algorithm name. This menas UnsupportedAlgorithmError is not expected when a digest object is created in those signers.

d5016ae adds a similar scheme check to GCPSigner to make use of the already existing raise UnsupportedAlgorithmError, previously only used for invalid key types.

f5f162f proposes an alternative, less invasive but IMO more clunky fix, which just re-raises hashlib's exception as UnsupportedAlgorithmError.

Either way, we may want to consider a more comprehensive solution in #593 and #766.

_ = sslib_hash.digest(algo)
# TODO: deduplicate scheme parsing and improve validation (#594, #766)
try:
_ = hashlib.new(algo)
except (ValueError, TypeError) as e:
raise exceptions.UnsupportedAlgorithmError(algo) from e

return algo

def sign(self, payload: bytes) -> Signature:
Expand All @@ -198,7 +203,7 @@ def sign(self, payload: bytes) -> Signature:
# NOTE: request and response can contain CRC32C of the digest/sig:
# Verifying could be useful but would require another dependency...

hasher = sslib_hash.digest(self.hash_algorithm)
hasher = hashlib.new(self.hash_algorithm)
hasher.update(payload)
digest = {self.hash_algorithm: hasher.digest()}
request = {"name": self.gcp_keyid, "digest": digest}
Expand Down
4 changes: 2 additions & 2 deletions securesystemslib/signer/_hsm_signer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@
from __future__ import annotations

import binascii
import hashlib
from collections.abc import Iterator
from contextlib import contextmanager
from urllib import parse

from securesystemslib.exceptions import UnsupportedLibraryError
from securesystemslib.hash import digest
from securesystemslib.signer._key import Key, SSlibKey
from securesystemslib.signer._signature import Signature
from securesystemslib.signer._signer import SecretsHandler, Signer
Expand Down Expand Up @@ -370,7 +370,7 @@ def sign(self, payload: bytes) -> Signature:
Signature.
"""

hasher = digest(algorithm=f"sha{self.public_key.scheme[-3:]}")
hasher = hashlib.new(name=f"sha{self.public_key.scheme[-3:]}")
hasher.update(payload)

pin = self.pin_handler(self.SECRETS_HANDLER_MSG)
Expand Down
7 changes: 3 additions & 4 deletions securesystemslib/signer/_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@

from __future__ import annotations

import hashlib
from typing import Any

from securesystemslib.exceptions import FormatError
from securesystemslib.formats import encode_canonical
from securesystemslib.hash import digest


def compute_default_keyid(keytype: str, scheme, keyval: dict[str, Any]) -> str:
Expand All @@ -22,6 +22,5 @@ def compute_default_keyid(keytype: str, scheme, keyval: dict[str, Any]) -> str:
byte_data: bytes = data.encode("utf-8")
else:
raise FormatError("Failed to encode data into canonical json")
hasher = digest("sha256")
hasher.update(byte_data)
return hasher.hexdigest()

return hashlib.sha256(byte_data).hexdigest()