This repository has been archived by the owner on Jan 17, 2023. It is now read-only.
Scope Keygrip usage #4882
Assignees
Milestone
Comments
ianb
added a commit
that referenced
this issue
Sep 12, 2018
This adds signing 'scopes', so that if you get something signed for one scope, you can't use it for another scope. E.g., you can't get a download URL and use that for an authentication key. This keeps the 'legacy' scope, which is the current single key. This can be used now to make sure everything works when people upgrade, but removed later as people have used to the new specific scopes. But nothing new will be signed with the legacy scope once this is deployed. This also updates some functions to use async/await.
Closed
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Per Bug 1389708, we shouldn't let you sign something for one purpose, then use the same thing to another purpose. To do this we'll use different Keygrip instances, and different secret keys.
This is instead of #4840
The text was updated successfully, but these errors were encountered: