sign bootstrap.tar content

cmd/dkl-dir2config/assemble.go

@@ -124,7 +124,7 @@ func eachFragment(path string, searchList []FS, walk func(io.Reader) error) (err
 				log.Print("#!gen ", cmdArgs)
 			}
 
-			cmd := "gen/" + cmdArgs[0]
+			cmd := *dir + "/gen/" + cmdArgs[0]
 			args := cmdArgs[1:]
 			genOutput, err := exec.Command(cmd, args...).Output()
 			if err != nil {

cmd/dkl-dir2config/render-context.go

@@ -203,7 +203,7 @@ func (ctx *renderContext) renderConfigTo(buf io.Writer, configTemplate *clusters
 	}
 }
 
-func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]interface{} {
+func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]any {
 	cluster := ctx.Cluster.Name
 
 	getKeyCert := func(name, funcName string) (s string, err error) {
@@ -229,14 +229,15 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]interf
 			key += "/" + ctx.Host.Name
 		}
 
-		if funcName == "tls_dir" {
+		switch funcName {
+		case "tls_dir":
 			// needs the dir name
 			dir := "/etc/tls/" + name
 
 			s = fmt.Sprintf("{{ %s %q %q %q %q %q %q %q }}", funcName,
 				dir, cluster, req.CA, key, req.Profile, req.Label, buf.String())
 
-		} else {
+		default:
 			s = fmt.Sprintf("{{ %s %q %q %q %q %q %q }}", funcName,
 				cluster, req.CA, key, req.Profile, req.Label, buf.String())
 		}
@@ -266,6 +267,9 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]interf
 		"tls_key": func(name string) (string, error) {
 			return getKeyCert(name, "tls_key")
 		},
+		"tls_pubkey": func(name string) string {
+			return fmt.Sprintf("{{ tls_pubkey %q %q }}", ctx.Cluster.Name, name)
+		},
 
 		"tls_crt": func(name string) (s string, err error) {
 			return getKeyCert(name, "tls_crt")

cmd/dkl-local-server/bootv2.go

@@ -2,6 +2,9 @@ package main
 
 import (
 	"archive/tar"
+	"bytes"
+	"crypto"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -93,13 +96,48 @@ func buildBootstrap(out io.Writer, ctx *renderContext) (err error) {
 	arch := tar.NewWriter(out)
 	defer arch.Close()
 
+	ca, err := getUsableClusterCA(ctx.Host.ClusterName, "boot-signer")
+	if err != nil {
+		return
+	}
+	signer, err := ca.ParseKey()
+	if err != nil {
+		return
+	}
+
+	hash := crypto.SHA512
+
+	sign := func(name string, digest []byte) (err error) {
+		sigBytes, err := signer.Sign(nil, digest, hash)
+		if err != nil {
+			err = fmt.Errorf("signing to %s failed: %w", name, err)
+			return err
+		}
+		sigBytes = []byte(base64.StdEncoding.EncodeToString(sigBytes))
+
+		if err = arch.WriteHeader(&tar.Header{
+			Name: name,
+			Size: int64(len(sigBytes)),
+			Mode: 0o644,
+		}); err != nil {
+			return
+		}
+
+		_, err = io.Copy(arch, bytes.NewReader(sigBytes))
+		return
+	}
+
 	// config
 	cfgBytes, cfg, err := ctx.Config()
 	if err != nil {
 		return err
 	}
 
-	err = arch.WriteHeader(&tar.Header{Name: "config.yaml", Size: int64(len(cfgBytes))})
+	err = arch.WriteHeader(&tar.Header{
+		Name: "config.yaml",
+		Size: int64(len(cfgBytes)),
+		Mode: 0o600,
+	})
 	if err != nil {
 		return
 	}
@@ -109,10 +147,19 @@ func buildBootstrap(out io.Writer, ctx *renderContext) (err error) {
 		return
 	}
 
+	{
+		h := hash.New()
+		h.Write(cfgBytes)
+		err = sign("config.yaml.sig", h.Sum(nil))
+		if err != nil {
+			return
+		}
+	}
+
 	// layers
 	for _, layer := range cfg.Layers {
 		if layer == "modules" {
-			continue // modules are with the kernel in boot v2
+			continue // modules are in the initrd with boot v2
 		}
 
 		layerVersion := ctx.Host.Versions[layer]
@@ -137,14 +184,24 @@ func buildBootstrap(out io.Writer, ctx *renderContext) (err error) {
 			return err
 		}
 
+		h := hash.New()
+		reader := io.TeeReader(f, h)
+
 		if err = arch.WriteHeader(&tar.Header{
 			Name: layer + ".fs",
 			Size: stat.Size(),
+			Mode: 0o600,
 		}); err != nil {
 			return err
 		}
 
-		_, err = io.Copy(arch, f)
+		_, err = io.Copy(arch, reader)
+		if err != nil {
+			return err
+		}
+
+		digest := h.Sum(nil)
+		err = sign(layer+".fs.sig", digest)
 		if err != nil {
 			return err
 		}

cmd/dkl-local-server/cluster-render-context.go

@@ -1,8 +1,11 @@
 package main
 
 import (
+	"crypto"
 	"crypto/rand"
+	"crypto/x509"
 	"encoding/base32"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"log"
@@ -12,6 +15,7 @@ import (
 
 	cfsslconfig "github.com/cloudflare/cfssl/config"
 	"github.com/cloudflare/cfssl/csr"
+	"github.com/cloudflare/cfssl/helpers"
 	yaml "gopkg.in/yaml.v2"
 
 	"novit.tech/direktil/pkg/bootstrapconfig"
@@ -19,6 +23,14 @@ import (
 )
 
 func templateFuncs(sslCfg *cfsslconfig.Config) map[string]any {
+	getKey := func(cluster, caName string) (key crypto.Signer, err error) {
+		ca, err := getUsableClusterCA(cluster, caName)
+		if err != nil {
+			return
+		}
+		key, err = helpers.ParsePrivateKeyPEM(ca.Key)
+		return
+	}
 	getKeyCert := func(cluster, caName, name, profile, label, reqJson string) (kc KeyCert, err error) {
 		certReq := &csr.CertificateRequest{
 			KeyRequest: csr.NewKeyRequest(),
@@ -133,6 +145,22 @@ func templateFuncs(sslCfg *cfsslconfig.Config) map[string]any {
 			return
 		},
 
+		"tls_pubkey": func(cluster, caName string) (s string, err error) {
+			priv, err := getKey(cluster, caName)
+			if err != nil {
+				return
+			}
+
+			ba, err := x509.MarshalPKIXPublicKey(priv)
+			if err != nil {
+				err = fmt.Errorf("marshal public key failed: %w", err)
+				return
+			}
+
+			s = base64.StdEncoding.EncodeToString(ba)
+			return
+		},
+
 		"tls_crt": func(cluster, caName, name, profile, label, reqJson string) (s string, err error) {
 			kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
 			if err != nil {

cmd/dkl-local-server/tls-ca.go

@@ -72,13 +72,20 @@ func (_ CA) newReq() *csr.CertificateRequest {
 	}
 }
 
+func (ca CA) ParseKey() (key crypto.Signer, err error) {
+	return helpers.ParsePrivateKeyPEM(ca.Key)
+}
+func (ca CA) ParseCert() (cert *x509.Certificate, err error) {
+	return helpers.ParseCertificatePEM(ca.Cert)
+}
+
 func (ca CA) Signer(policy *config.Signing) (result *local.Signer, err error) {
-	caCert, err := helpers.ParseCertificatePEM(ca.Cert)
+	caCert, err := ca.ParseCert()
 	if err != nil {
 		return
 	}
 
-	caKey, err := helpers.ParsePrivateKeyPEM(ca.Key)
+	caKey, err := ca.ParseKey()
 	if err != nil {
 		return
 	}

cmd/dkl-local-server/ws-host.go

@@ -180,22 +180,10 @@ func renderHost(w http.ResponseWriter, r *http.Request, what string, host *local
 
 	case "kernel":
 		err = renderKernel(w, r, ctx)
-
-	// boot v2
-	case "bootstrap-config":
-		err = renderBootstrapConfig(w, r, ctx, false)
-	case "bootstrap-config.json":
-		err = renderBootstrapConfig(w, r, ctx, true)
 	case "initrd":
 		err = renderCtx(w, r, ctx, what, buildInitrd)
 	case "bootstrap.tar":
 		err = renderCtx(w, r, ctx, what, buildBootstrap)
-	case "boot.iso":
-		err = renderCtx(w, r, ctx, what, buildBootISO)
-	case "boot.tar":
-		err = renderCtx(w, r, ctx, what, buildBootTar)
-	case "boot-efi.tar":
-		err = renderCtx(w, r, ctx, what, buildBootEFITar)
 
 	case "boot.img":
 		err = renderCtx(w, r, ctx, what, buildBootImg)
@@ -213,6 +201,19 @@ func renderHost(w http.ResponseWriter, r *http.Request, what string, host *local
 		err = renderCtx(w, r, ctx, what, qemuImgBootImg("vmdk"))
 	case "boot.vpc":
 		err = renderCtx(w, r, ctx, what, qemuImgBootImg("vpc"))
+	case "boot.iso":
+		err = renderCtx(w, r, ctx, what, buildBootISO)
+
+	case "boot.tar":
+		err = renderCtx(w, r, ctx, what, buildBootTar)
+	case "boot-efi.tar":
+		err = renderCtx(w, r, ctx, what, buildBootEFITar)
+
+	// boot v2
+	case "bootstrap-config":
+		err = renderBootstrapConfig(w, r, ctx, false)
+	case "bootstrap-config.json":
+		err = renderBootstrapConfig(w, r, ctx, true)
 
 	default:
 		http.NotFound(w, r)