Skip to content

Commit 4634f70

Browse files
FiloSottileFiloSottile
committed
cmd/witnessctl: separate add-log and add/del-key commands
Fixes #17
1 parent fa6d4df commit 4634f70

File tree

3 files changed

+77
-174
lines changed

3 files changed

+77
-174
lines changed

‎README.md

+14-3
Original file line numberDiff line numberDiff line change
@@ -74,11 +74,22 @@ successfully. If the connection drops after establishing, litewitness exits.
7474
witnessctl is a CLI tool to operate on the litewitness database. It can be used
7575
while litewitness is running.
7676

77-
witnessctl add-log -db <path> -origin <origin> -key <base64-encoded Ed25519 key>
77+
witnessctl add-log -db <path> -origin <origin>
78+
79+
The `add-log` command adds a new known log starting at a size of zero. Removing
80+
a log is not supported, as it presents the risk of signing a split view if
81+
re-added. To disable a log, remove all its keys.
82+
83+
witnessctl add-key -db <path> -origin <origin> -key <verifier key>
84+
witnessctl del-key -db <path> -origin <origin> -key <verifier key>
85+
86+
The `add-key` and `del-key` commands add and remove verifier keys for a known
87+
log. The name of the key must match the log origin.
88+
7889
witnessctl add-sigsum-log -db <path> -key <hex-encoded key>
7990

80-
The `add-log` and `add-sigsum-log` commands add a new known log starting at a
81-
size of zero.
91+
The `add-sigsum-log` command is a helper that adds a new Sigsum log, computing
92+
the origin and key from a 32-byte hex-encoded Ed25519 public key.
8293

8394
witnessctl list-logs -db <path>
8495

‎cmd/litewitness/testdata/audit-log.txt

-137
This file was deleted.

‎cmd/witnessctl/witnessctl.go

+63-34
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package main
22

33
import (
4-
"crypto/ed25519"
54
"encoding/base64"
65
"encoding/hex"
76
"flag"
@@ -20,7 +19,9 @@ import (
2019
func usage() {
2120
fmt.Printf("Usage: %s <command> [options]\n", os.Args[0])
2221
fmt.Println("Commands:")
23-
fmt.Println(" add-log -db <path> -origin <origin> -key <base64-encoded Ed25519 key>")
22+
fmt.Println(" add-log -db <path> -origin <origin>")
23+
fmt.Println(" add-key -db <path> -origin <origin> -key <verifier key>")
24+
fmt.Println(" del-key -db <path> -origin <origin> -key <verifier key>")
2425
fmt.Println(" add-sigsum-log -db <path> -key <hex-encoded key>")
2526
fmt.Println(" list-logs -db <path>")
2627
os.Exit(1)
@@ -30,39 +31,36 @@ func main() {
3031
if len(os.Args) < 2 {
3132
usage()
3233
}
34+
fs := flag.NewFlagSet(os.Args[0], flag.ExitOnError)
35+
dbFlag := fs.String("db", "litewitness.db", "path to sqlite database")
3336
switch os.Args[1] {
3437
case "add-log":
35-
fs := flag.NewFlagSet("add-log", flag.ExitOnError)
36-
dbFlag := fs.String("db", "litewitness.db", "path to sqlite database")
3738
originFlag := fs.String("origin", "", "log name")
38-
keyFlag := fs.String("key", "", "base64-encoded key")
3939
fs.Parse(os.Args[2:])
40-
key, err := base64.StdEncoding.DecodeString(*keyFlag)
41-
if err != nil {
42-
log.Fatal(err)
43-
}
4440
db := openDB(*dbFlag)
45-
addLog(db, *originFlag, key)
41+
addLog(db, *originFlag)
42+
43+
case "add-key":
44+
originFlag := fs.String("origin", "", "log name")
45+
keyFlag := fs.String("key", "", "verifier key")
46+
fs.Parse(os.Args[2:])
47+
db := openDB(*dbFlag)
48+
addKey(db, *originFlag, *keyFlag)
49+
50+
case "del-key":
51+
originFlag := fs.String("origin", "", "log name")
52+
keyFlag := fs.String("key", "", "verifier key")
53+
fs.Parse(os.Args[2:])
54+
db := openDB(*dbFlag)
55+
delKey(db, *originFlag, *keyFlag)
4656

4757
case "add-sigsum-log":
48-
fs := flag.NewFlagSet("add-sigsum-log", flag.ExitOnError)
49-
dbFlag := fs.String("db", "litewitness.db", "path to sqlite database")
5058
keyFlag := fs.String("key", "", "hex-encoded key")
5159
fs.Parse(os.Args[2:])
52-
if len(*keyFlag) != sigsum.PublicKeySize*2 {
53-
log.Println(*keyFlag)
54-
log.Fatal("key must be 32 hex-encoded bytes")
55-
}
56-
var key sigsum.PublicKey
57-
if _, err := hex.Decode(key[:], []byte(*keyFlag)); err != nil {
58-
log.Fatal(err)
59-
}
6060
db := openDB(*dbFlag)
61-
addSigsumLog(db, key)
61+
addSigsumLog(db, *keyFlag)
6262

6363
case "list-logs":
64-
fs := flag.NewFlagSet("list-logs", flag.ExitOnError)
65-
dbFlag := fs.String("db", "litewitness.db", "path to sqlite database")
6664
fs.Parse(os.Args[2:])
6765
db := openDB(*dbFlag)
6866
listLogs(db)
@@ -75,31 +73,62 @@ func main() {
7573
func openDB(dbPath string) *sqlite.Conn {
7674
db, err := witness.OpenDB(dbPath)
7775
if err != nil {
78-
log.Fatalf("opening database: %v", err)
76+
log.Fatalf("Error opening database: %v", err)
7977
}
8078
return db
8179
}
8280

83-
func addLog(db *sqlite.Conn, origin string, key ed25519.PublicKey) {
81+
func addLog(db *sqlite.Conn, origin string) {
8482
treeHash := merkle.HashEmptyTree()
8583
if err := sqlitex.Exec(db, "INSERT INTO log (origin, tree_size, tree_hash) VALUES (?, 0, ?)",
8684
nil, origin, base64.StdEncoding.EncodeToString(treeHash[:])); err != nil {
87-
log.Fatal(err)
85+
log.Fatalf("Error adding log: %v", err)
8886
}
89-
k, err := note.NewEd25519VerifierKey(origin, key[:])
87+
log.Printf("Added log %q.", origin)
88+
}
89+
90+
func addKey(db *sqlite.Conn, origin string, vk string) {
91+
v, err := note.NewVerifier(vk)
9092
if err != nil {
91-
log.Fatal(err)
93+
log.Fatalf("Error parsing verifier key: %v", err)
9294
}
93-
if sqlitex.Exec(db, "INSERT INTO key (origin, key) VALUES (?, ?)", nil, origin, k); err != nil {
94-
log.Fatal(err)
95+
if v.Name() != origin {
96+
log.Fatalf("Verifier key name %q does not match origin %q.", v.Name(), origin)
9597
}
96-
log.Printf("Added log %q.", key)
98+
err = sqlitex.Exec(db, "INSERT INTO key (origin, key) VALUES (?, ?)", nil, origin, vk)
99+
if err != nil {
100+
log.Fatalf("Error adding key: %v", err)
101+
}
102+
log.Printf("Added key %q.", vk)
103+
}
104+
105+
func delKey(db *sqlite.Conn, origin string, vk string) {
106+
err := sqlitex.Exec(db, "DELETE FROM key WHERE origin = ? AND key = ?", nil, origin, vk)
107+
if err != nil {
108+
log.Fatalf("Error deleting key: %v", err)
109+
}
110+
if db.Changes() == 0 {
111+
log.Fatalf("Key %q not found.", vk)
112+
}
113+
log.Printf("Deleted key %q.", vk)
97114
}
98115

99-
func addSigsumLog(db *sqlite.Conn, key sigsum.PublicKey) {
116+
func addSigsumLog(db *sqlite.Conn, keyFlag string) {
117+
if len(keyFlag) != sigsum.PublicKeySize*2 {
118+
log.Fatal("Key must be 32 hex-encoded bytes.")
119+
}
120+
var key sigsum.PublicKey
121+
if _, err := hex.Decode(key[:], []byte(keyFlag)); err != nil {
122+
log.Fatalf("Error decoding key: %v", err)
123+
}
100124
keyHash := sigsum.HashBytes(key[:])
101125
origin := fmt.Sprintf("sigsum.org/v1/tree/%x", keyHash)
102-
addLog(db, origin, key[:])
126+
vk, err := note.NewEd25519VerifierKey(origin, key[:])
127+
if err != nil {
128+
log.Fatalf("Error computing verifier key: %v", err)
129+
}
130+
addLog(db, origin)
131+
addKey(db, origin, vk)
103132
}
104133

105134
func listLogs(db *sqlite.Conn) {
@@ -120,6 +149,6 @@ func listLogs(db *sqlite.Conn) {
120149
_, err := fmt.Printf("%s\n", stmt.ColumnText(0))
121150
return err
122151
}); err != nil {
123-
log.Fatal(err)
152+
log.Fatalf("Error listing logs: %v", err)
124153
}
125154
}

0 commit comments

Comments
 (0)