diff options
author | Eugen Rochko <eugen@zeonfederated.com> | 2018-08-26 20:21:03 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-08-26 20:21:03 +0200 |
commit | cabdbb7f9c1df8007749d07a2e186bb3ad35f62b (patch) | |
tree | 68e2ea8b16dc6fbf3d63f09b3301a0c4ad8edc39 /app/lib/request.rb | |
parent | 8adf485c0fc553fafc6af70144c3f3954dac2307 (diff) |
Add CLI task for rotating keys (#8466)
* If an Update is signed with known key, skip re-following procedure Because it means the remote actor did *not* lose their database * Add CLI method for rotating keys bin/tootctl accounts rotate [USERNAME] Generates a new RSA key per account and sends out an Update activity signed with the old key. * Key rotation: Space out Update fan-outs every 5 minutes per 1000 accounts * Skip suspended accounts in key rotation
Diffstat (limited to 'app/lib/request.rb')
-rw-r--r-- | app/lib/request.rb | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/app/lib/request.rb b/app/lib/request.rb index 576ed23ca..21bdaa700 100644 --- a/app/lib/request.rb +++ b/app/lib/request.rb @@ -22,10 +22,11 @@ class Request set_digest! if options.key?(:body) end - def on_behalf_of(account, key_id_format = :acct) + def on_behalf_of(account, key_id_format = :acct, sign_with: nil) raise ArgumentError unless account.local? @account = account + @keypair = sign_with.present? ? OpenSSL::PKey::RSA.new(sign_with) : @account.keypair @key_id_format = key_id_format self @@ -70,7 +71,7 @@ class Request def signature algorithm = 'rsa-sha256' - signature = Base64.strict_encode64(@account.keypair.sign(OpenSSL::Digest::SHA256.new, signed_string)) + signature = Base64.strict_encode64(@keypair.sign(OpenSSL::Digest::SHA256.new, signed_string)) "keyId=\"#{key_id}\",algorithm=\"#{algorithm}\",headers=\"#{signed_headers}\",signature=\"#{signature}\"" end |