panic using ed25519 signing key
Open
Nobody has claimed this yet.
kind/bug
- Dominant language
- Go
- Stars
- 277
- Forks
- 164
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
Expected Behavior
Signing taksruns with ed25519 private key shoudl work according to the doc
Actual Behavior
panic
{"level":"info","ts":"2024-08-27T14:14:54.450Z","logger":"watcher","caller":"x509/x509.go:180","msg":"Found x509 key...","knative.dev/controller":"github.com.tektoncd.chains.pkg.reconciler.taskrun.Reconciler","knative.dev/kind":"tekton.dev.TaskRun","knative.dev/traceid":"589829b2-f182-466b-bc24-561ad0d06f9b","knative.dev/key":"default/pipelinerun-test-6-hello2"}
panic: interface conversion: interface {} is ed25519.PrivateKey, not *ecdsa.PrivateKey
goroutine 152 [running]:
github.com/tektoncd/chains/pkg/chains/signing/x509.x509Signer({0x3d32f48?, 0xc000fc3d40?}, {0xc000d76e00, 0x77, 0x200})
github.com/tektoncd/chains/pkg/chains/signing/x509/x509.go:190 +0x1b8
github.com/tektoncd/chains/pkg/chains/signing/x509.NewSigner({_, _}, {_, _}, {{{{0x33f6b89, 0xd}, 0xc000fc3ce0, {0x33e6186, 0x4}, 0x0}, ...}, ...})
github.com/tektoncd/chains/pkg/chains/signing/x509/x509.go:62 +0x205
github.com/tektoncd/chains/pkg/chains.allSigners({_, _}, {_, _}, {{{{0x33f6b89, 0xd}, 0xc000fc3ce0, {0x33e6186, 0x4}, 0x0}, ...}, ...})
github.com/tektoncd/chains/pkg/chains/signing.go:73 +0x3b8
github.com/tektoncd/chains/pkg/chains.(*ObjectSigner).Sign(0xc000b94900, {0x3d32f48, 0xc000fc3d40}, {0x3d6bc88, 0xc00062a4a8})
github.com/tektoncd/chains/pkg/chains/signing.go:128 +0x16d
github.com/tektoncd/chains/pkg/reconciler/taskrun.(*Reconciler).FinalizeKind(0xc00082aca0, {0x3d32f48, 0xc000fc3d40}, 0xc000a9c008)
github.com/tektoncd/chains/pkg/reconciler/taskrun/taskrun.go:67 +0xe9
github.com/tektoncd/chains/pkg/reconciler/taskrun.(*Reconciler).ReconcileKind(0xc000fd18e8?, {0x3d32f48?, 0xc000fc3d40?}, 0x0?)
github.com/tektoncd/chains/pkg/reconciler/taskrun/taskrun.go:45 +0x1d
github.com/tektoncd/chains/vendor/github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1/taskrun.(*reconcilerImpl).Reconcile(0xc0003b1e00, {0x3d32f48, 0xc000fc3c80}, {0xc00093c210, 0x21})
github.com/tektoncd/chains/vendor/github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1/taskrun/reconciler.go:236 +0x4f2
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).processNextWorkItem(0xc00066bb00)
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:542 +0x508
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).RunContext.func3()
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:491 +0x59
created by github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).RunContext in goroutine 146
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:489 +0x325
Steps to Reproduce the Problem
- Install chains controller
- create an ed25519 key pair and secret
openssl genpkey -algorithm ed25519 -out x509.pem
openssl pkey -in private.pem -pubout -out x509-pub.pem
k -n tekton-chains create secret generic signing-secrets --from-file=x509.pem --from-file=x509-pub.pem - create a taskrun and check controller log
Additional Info
-
Kubernetes version:
Output of
kubectl version:
Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.1", GitCommit:"4c9411232e10168d7b050c49a1b59f6df9d7ea4b", GitTreeState:"clean", BuildDate:"2023-04-14T13:14:41Z", GoVersion:"go1.20.3", Compiler:"gc", Platform:"darwin/amd64"}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:"1", Minor:"28", GitVersion:"v1.28.0", GitCommit:"855e7c48de7388eb330da0f8d9d2394ee818fb8d", GitTreeState:"clean", BuildDate:"2023-08-15T21:24:51Z", GoVersion:"go1.20.7", Compiler:"gc", Platform:"linux/amd64"}
-
Tekton Pipeline version:
Output of
tkn versionorkubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'
tkn version
Client version: 0.37.0
Chains version: v0.22.0
Pipeline version: v0.62.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in pkg/chains/signing/x509/x509.go at the x509Signer call around line 190, then trace how it is invoked from pkg/chains/signing.go. Reproduce the issue with the provided ed25519 key-generation and secret steps; done means the TaskRun signs without a panic and the ed25519 key is handled successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100