Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Add CLI task for rotating keys (#8466)

Browse source 
* If an Update is signed with known key, skip re-following procedure

Because it means the remote actor did *not* lose their database

* Add CLI method for rotating keys

    bin/tootctl accounts rotate [USERNAME]

Generates a new RSA key per account and sends out an Update activity
signed with the old key.

* Key rotation: Space out Update fan-outs every 5 minutes per 1000 accounts

* Skip suspended accounts in key rotation
This commit is contained in:
Eugen Rochko 2018-08-26 20:21:03 +02:00 • committed by GitHub
parent 8adf485c0f
commit cabdbb7f9c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 79 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/lib/activitypub/linked_data_signature.rb
View file

@ -32,7 +32,7 @@ class ActivityPub::LinkedDataSignature
end
end
def sign!(creator)
def sign!(creator, sign_with: nil)
options = {
'type' => 'RsaSignature2017',
'creator' => [ActivityPub::TagManager.instance.uri_for(creator), '#main-key'].join,
@ -42,8 +42,9 @@ class ActivityPub::LinkedDataSignature
options_hash = hash(options.without('type', 'id', 'signatureValue').merge('@context' => CONTEXT))
document_hash = hash(@json.without('signature'))
to_be_signed = options_hash + document_hash
keypair = sign_with.present? ? OpenSSL::PKey::RSA.new(sign_with) : creator.keypair
signature = Base64.strict_encode64(creator.keypair.sign(OpenSSL::Digest::SHA256.new, to_be_signed))
signature = Base64.strict_encode64(keypair.sign(OpenSSL::Digest::SHA256.new, to_be_signed))
@json.merge('signature' => options.merge('signatureValue' => signature))
end