How to add a binary target file with offline keys

[doanac]

I've been able to add binary target files to the repo server via the API(eg PUT api/v1/user_repo/targets/) and Web UI when I have online keys. However, my production instance uses offline keys. I'm not quite sure how to upload a file to the reposerver and have it added to my targets.json properly?

[doanac]

Another thing I've noticed is a more serious bug: When you add a target file through this API, all custom data not known by ota-tuf will be lost for all targets. I have a field target["custom"]["docker_apps"] that's getting wiped out for all my existing targets each time I use this API.

[simao]

wrt to the 1st question, you'd have to use garage-sign to add that binary target. The server will not accept binary packages directly if the keys are offline, as it cannot sign the resulting metadata.

About the 2nd question, which version of tuf-repo are you using? This case is handled explicitly (

ota-tuf/reposerver/src/main/scala/com/advancedtelematic/tuf/reposerver/http/OfflineSignedRoleStorage.scala

Line 97 in dd3fab7

def saveTargetRole(targetStore: TargetStore)

) So this would definitely be bug...

[doanac]

I just discovered I'm running an out-of-tree version based on this PR:

#221

However, that PR include the commit you just referenced. Here's a simplified list of steps I can do to reproduce the issue:

#!/bin/sh -ex

garage-sign init --repo /tufrepo --credentials /credentials.zip
garage-sign targets pull --repo /tufrepo

cp /tufrepo/roles/unsigned/targets.json /tmp/targets-before.json

$data > app.txt

/tmp/ci-scripts/factory-containers/ota-dockerapp.py publish app.txt /credentials.zip 12 /tufrepo/roles/unsigned/targets.json

garage-sign targets pull --repo /tufrepo

I can the run something like the following:

~ # cat /tmp/targets-before.json  | grep docker_apps
        "docker_apps" : {
        "docker_apps" : {
~ # cat /tufrepo/
config.json      credentials.zip  keys/            roles/
~ # cat /tufrepo/roles/
root.json              targets.json.checksum  unsigned/
~ # cat /tufrepo/roles/unsigned/targets.json | grep docker_apps
~ # 

which shows that all the targets with "docker_apps" in the custom data get lost.

[simao]

What is app.txt and ota-dockerapp.py ? Which apis are they calling?

[simao]

In any case, I just managed to reproduce this. We will create a ticket to fix this.

[tkfu]

Should be fixed by #252. @doanac, can you verify?

[jochenschneider]

Not deployed to production, yet, but will be soon.