tektoncd / tektoncd/chains

panic using ed25519 signing key

Open
#1,189 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

kind/bug
Dominant language
Go
Stars
277
Forks
164
Avg merge
2d 3h
Merged PRs (30d)
61

Description

Expected Behavior

Signing taksruns with ed25519 private key shoudl work according to the doc

Actual Behavior

panic

{"level":"info","ts":"2024-08-27T14:14:54.450Z","logger":"watcher","caller":"x509/x509.go:180","msg":"Found x509 key...","knative.dev/controller":"github.com.tektoncd.chains.pkg.reconciler.taskrun.Reconciler","knative.dev/kind":"tekton.dev.TaskRun","knative.dev/traceid":"589829b2-f182-466b-bc24-561ad0d06f9b","knative.dev/key":"default/pipelinerun-test-6-hello2"}
panic: interface conversion: interface {} is ed25519.PrivateKey, not *ecdsa.PrivateKey

goroutine 152 [running]:
github.com/tektoncd/chains/pkg/chains/signing/x509.x509Signer({0x3d32f48?, 0xc000fc3d40?}, {0xc000d76e00, 0x77, 0x200})
	github.com/tektoncd/chains/pkg/chains/signing/x509/x509.go:190 +0x1b8
github.com/tektoncd/chains/pkg/chains/signing/x509.NewSigner({_, _}, {_, _}, {{{{0x33f6b89, 0xd}, 0xc000fc3ce0, {0x33e6186, 0x4}, 0x0}, ...}, ...})
	github.com/tektoncd/chains/pkg/chains/signing/x509/x509.go:62 +0x205
github.com/tektoncd/chains/pkg/chains.allSigners({_, _}, {_, _}, {{{{0x33f6b89, 0xd}, 0xc000fc3ce0, {0x33e6186, 0x4}, 0x0}, ...}, ...})
	github.com/tektoncd/chains/pkg/chains/signing.go:73 +0x3b8
github.com/tektoncd/chains/pkg/chains.(*ObjectSigner).Sign(0xc000b94900, {0x3d32f48, 0xc000fc3d40}, {0x3d6bc88, 0xc00062a4a8})
	github.com/tektoncd/chains/pkg/chains/signing.go:128 +0x16d
github.com/tektoncd/chains/pkg/reconciler/taskrun.(*Reconciler).FinalizeKind(0xc00082aca0, {0x3d32f48, 0xc000fc3d40}, 0xc000a9c008)
	github.com/tektoncd/chains/pkg/reconciler/taskrun/taskrun.go:67 +0xe9
github.com/tektoncd/chains/pkg/reconciler/taskrun.(*Reconciler).ReconcileKind(0xc000fd18e8?, {0x3d32f48?, 0xc000fc3d40?}, 0x0?)
	github.com/tektoncd/chains/pkg/reconciler/taskrun/taskrun.go:45 +0x1d
github.com/tektoncd/chains/vendor/github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1/taskrun.(*reconcilerImpl).Reconcile(0xc0003b1e00, {0x3d32f48, 0xc000fc3c80}, {0xc00093c210, 0x21})
	github.com/tektoncd/chains/vendor/github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1/taskrun/reconciler.go:236 +0x4f2
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).processNextWorkItem(0xc00066bb00)
	github.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:542 +0x508
github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).RunContext.func3()
	github.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:491 +0x59
created by github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).RunContext in goroutine 146
	github.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:489 +0x325

Steps to Reproduce the Problem

  1. Install chains controller
  2. create an ed25519 key pair and secret
    openssl genpkey -algorithm ed25519 -out x509.pem
    openssl pkey -in private.pem -pubout -out x509-pub.pem
    k -n tekton-chains create secret generic signing-secrets --from-file=x509.pem --from-file=x509-pub.pem
  3. create a taskrun and check controller log

Additional Info

  • Kubernetes version:

    Output of kubectl version:

 Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.1", GitCommit:"4c9411232e10168d7b050c49a1b59f6df9d7ea4b", GitTreeState:"clean", BuildDate:"2023-04-14T13:14:41Z", GoVersion:"go1.20.3", Compiler:"gc", Platform:"darwin/amd64"}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:"1", Minor:"28", GitVersion:"v1.28.0", GitCommit:"855e7c48de7388eb330da0f8d9d2394ee818fb8d", GitTreeState:"clean", BuildDate:"2023-08-15T21:24:51Z", GoVersion:"go1.20.7", Compiler:"gc", Platform:"linux/amd64"}
  • Tekton Pipeline version:

    Output of tkn version or kubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'

tkn version
Client version: 0.37.0
Chains version: v0.22.0
Pipeline version: v0.62.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in pkg/chains/signing/x509/x509.go at the x509Signer call around line 190, then trace how it is invoked from pkg/chains/signing.go. Reproduce the issue with the provided ed25519 key-generation and secret steps; done means the TaskRun signs without a panic and the ed25519 key is handled successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.