Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Duplicate baker pkh in signatory list #142

Open
michaelkernaghan opened this issue Nov 2, 2021 · 1 comment
Open

Duplicate baker pkh in signatory list #142

michaelkernaghan opened this issue Nov 2, 2021 · 1 comment
Labels
yubihsm Issues related to the YubiHSM

Comments

@michaelkernaghan
Copy link
Contributor

michaelkernaghan commented Nov 2, 2021

I imported my baker key tz1TfGsL6o754mfxcntSzDDTh9RrjZVNocjP into Signatory twice.
using:

./signatory-cli import --config ./signatory.yaml --vault yubi

to see the list

./signatory-cli list

Public Key Hash:    tz1gmj9EBXqQqQBmEVaCHBfunPJ67N82YJcz
Vault:              YubiHSM
ID:                 5cfd
Status:             FOUND_NOT_CONFIGURED
*DISABLED*

Public Key Hash:    tz1TfGsL6o754mfxcntSzDDTh9RrjZVNocjP
Vault:              YubiHSM
ID:                 bce7
Status:             ACTIVE
Allowed Operations: [block endorsement generic]
Allowed Kinds:      [delegation endorsement reveal transaction]

Public Key Hash:    tz1TfGsL6o754mfxcntSzDDTh9RrjZVNocjP
Vault:              YubiHSM
ID:                 caa0
Status:             ACTIVE
Allowed Operations: [block endorsement generic]
Allowed Kinds:      [delegation endorsement reveal transaction]
@jevonearth jevonearth added the yubihsm Issues related to the YubiHSM label Jun 8, 2022
@jevonearth
Copy link
Contributor

Marginally related to #106

The ID: property here represents the identity of a key on yubihsm. I think that yubihsm can import the same secret many times, and it will give a different ID to each (identical) secret. We could have signatory-cli enforce/prevent import of duplicate secrets, but that won't eliminate the possibility of having dupe keys. We should handle this some other way in signatory.

This issue also highlights an inconsistency in the Vault/Key abstraction around ID:. In yubi, ID is the identity of a specific key on the yubiHSM, but on ledger the ID is derived from the root key that is provisioned on the ledger.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
yubihsm Issues related to the YubiHSM
Projects
Status: No status
Development

No branches or pull requests

2 participants