Skip to content

TRITON-2542 Add support for ed25519 keys - #206

Open
travispaul wants to merge 18 commits into
masterfrom
ed25519
Open

TRITON-2542 Add support for ed25519 keys#206
travispaul wants to merge 18 commits into
masterfrom
ed25519

Conversation

@travispaul

@travispaul travispaul commented Apr 9, 2026

Copy link
Copy Markdown
Member

While running tests and the examples, I encountered a few other bugs:

I also removed deprecated govvv and dep tools, go now natively supports what they offered.

I am very slightly concerned someone might be relying on the current deleteAll behavior, it is broken and will only delete the first object in a directory and stop, now it actually deletes all objects in the directory and all directories if ForceDelete is true (Just like mrm -r.) However, I'm also not sure how the current broken behavior would be at all useful so I might be overthinking it. That being said, I'm open to backing out that change and addressing it separately.

Testing notes on ticket.

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

travispaul and others added 8 commits April 9, 2026 13:48
Add ed25519 signing support alongside existing RSA and ECDSA key types
for HTTP Signature Authentication used by Triton DataCenter APIs.

Changes:

  private_key_signer.go:
  - Add ed25519.PrivateKey case to SignRaw() type switch
  - Add ED25519_SHA512 algorithm constant
  - Refactor Sign() to delegate to SignRaw(), eliminating ~30 lines of
    duplicated type-switch logic
  - Refactor type switch to capture typed value directly, removing
    redundant type assertions
  - Add default case for unsupported key types
  - Fix pre-existing bug: unchecked error from asn1.Marshal in ECDSA
    signing path

  ssh_agent_signer.go:
  - Add ed25519 case to Sign() and SignRaw() signature type switches
  - Fix duplicate import of github.com/pkg/errors under two names
    (errors and pkgerrors); consolidate to bare import

  util.go:
  - Add ed25519.PrivateKey case to formatPublicKeyFingerprint()
  - Add ssh.PublicKey case to accept public keys directly
  - Refactor type switch to capture typed value, removing redundant
    type assertions

  ed25519_signature.go (new):
  - Implement ed25519Signature type satisfying httpAuthSignature
    interface
  - Add signature length validation (must be exactly 64 bytes)

  authentication_test.go (new):
  - Add 27 tests covering signature types, key format mapping,
    fingerprinting across all key types, PrivateKeySigner integration
    for ed25519/RSA/ECDSA (including cryptographic verification), error
    cases, and KeyID path generation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove tests that merely exercise standard library functions or
duplicate other tests:

  - TestEd25519Signature (base64 encoding and constant identity)
  - TestPrivateKeySignerEd25519/SignRaw (redundant with SignRaw verify)
  - TestPrivateKeySignerBadKeyMaterial (tests ssh.ParseRawPrivateKey)
  - TestPrivateKeySignerSignConsistency (merged into Sign subtest)
  - TestPrivateKeySignerRSA, TestPrivateKeySignerECDSA (pre-existing
    code paths, not changed on this branch)
  - TestFormatPublicKeyFingerprint RSA/ECDSA subtests (same)
  - TestEd25519SignatureValidation reduced from 4 cases to 1

Removes generateRSAKey and generateECDSAKey helpers. Test file reduced
from 535 to 290 lines; 18 focused tests remain.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CloudAPI's UpdateConfig endpoint (PUT /:login/config) expects HTTP PUT,
but the client was sending POST, causing MethodNotAllowedError against
live Triton environments. The unit tests masked this by mocking the
wrong HTTP method.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…right

- Storage examples now consistently use MANTA_USER, MANTA_KEY_ID, and
  MANTA_KEY_MATERIAL instead of TRITON_* equivalents
- Storage examples now consistently use MANTA_URL for MantaURL
- Add guard against empty MANTA_FOLDER in force_delete example
- Add note to services examples explaining TSG never left preview
- Update Edgecast copyright year from 2025 to 2026 across all files
  modified on this branch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Ensure all files modified on this branch follow the standard header
structure: copyright block first, then MPL license block. Adds missing
Edgecast copyright and corrects header ordering.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
deleteAll returned on the first loop iteration, silently skipping all
remaining entries. Subdirectories were also never removed after being
emptied, and Delete never removed the target directory itself.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR expands the authentication layer to support Ed25519 keys (both private-key signing and SSH-agent signing), fixes recursive directory force-delete behavior in storage, and aligns several examples/tests with corrected APIs and environment variables.

Changes:

  • Add Ed25519 support across authentication fingerprinting and signing, including SSH-agent signatures and new unit tests.
  • Fix ForceDelete directory deletion to fully recurse and delete all children; add storage tests to prevent regressions.
  • Correct UpdateConfig to use HTTP PUT and update examples to prefer MANTA_ environment variables.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
authentication/util.go Extends fingerprint formatting to handle Ed25519 private keys (and raw ssh.PublicKey).
authentication/private_key_signer.go Adds Ed25519 signing support and refactors Sign() to reuse SignRaw().
authentication/ssh_agent_signer.go Adds Ed25519 SSH-agent signature handling and simplifies error wrapping import usage.
authentication/ed25519_signature.go Introduces an Ed25519 signature wrapper for HTTP Signature formatting.
authentication/authentication_test.go Adds coverage for Ed25519 fingerprinting/signing and keyFormatToKeyType() behavior.
storage/directory.go Fixes ForceDelete recursion to delete all objects/subdirectories instead of returning early.
storage/delete_test.go Adds tests validating multi-object and nested-directory force delete behavior.
account/config.go Fixes UpdateConfig request method from POST to PUT.
account/config_test.go Updates tests to expect PUT for config update requests.
examples/storage/sign_url/main.go Switches storage example env vars to prefer MANTA_* and MANTA_URL.
examples/storage/object_put/main.go Switches storage example env vars to prefer MANTA_* and MANTA_URL.
examples/storage/mls/main.go Switches storage example env vars to prefer MANTA_* and MANTA_URL.
examples/storage/create_mpu/main.go Switches storage example env vars to prefer MANTA_*.
examples/storage/create_job/main.go Switches storage example env vars to prefer MANTA_* and MANTA_URL.
examples/storage/force_delete/main.go Adds a required MANTA_FOLDER validation check.
examples/compute/create_instance_with_volumes/main.go Fixes example tags typing to match expected map[string]interface{}.
examples/services/templates/list_templates.go Adds clarification note that TSG targets a separate API server, not CloudAPI.
examples/services/groups/list_groups.go Adds clarification note that TSG targets a separate API server, not CloudAPI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread authentication/private_key_signer.go
Comment thread authentication/private_key_signer.go
travispaul and others added 6 commits April 10, 2026 10:10
TRITON_USER was still being used for the subuser field in all storage
examples; replace with MANTA_SUBUSER. Also fix force_delete and
force_put which still used TRITON_KEY_ID and TRITON_KEY_MATERIAL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The existing delete tests only exercised the ForceDelete: true path.
Add TestDeleteDirectorySimple to verify that ForceDelete: false issues
a single DELETE without listing or recursing into the directory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
govvv is no longer needed — Go natively embeds VCS metadata (revision,
build time, dirty state) since Go 1.18 via runtime/debug.ReadBuildInfo.
dep is defunct — the project already uses Go modules.

Remove the tools target (dep), replace govvv calls with plain go build
and go install, add go vet to the check target, and expose VCS build
info in the triton and manta CLI version commands.

Also adds a GitHub Actions CI workflow that runs build, lint, and test
on pull requests via Makefile targets.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CloudAPI returns image tag values that include booleans and numbers,
not just strings. Change Tags from map[string]string to
map[string]interface{} in Image, CreateImageFromMachineInput, and
UpdateImageInput to match the established Instance.Tags pattern.

Add TestGetImageMixedTags to verify decoding of string, boolean,
and numeric tag values.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@travispaul travispaul changed the title TRITON-2378 - Add support for ed25519 keys TRITON-2542 Add support for ed25519 keys Apr 10, 2026
@travispaul
travispaul requested a review from Copilot April 10, 2026 18:23

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/ci.yml
Add Copyright 2026 Edgecast Cloud LLC. to four modified files that were
missing it, and fix "failed create" to "failed to create" in the RSA and
ECDSA signing error messages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@travispaul
travispaul marked this pull request as ready for review April 10, 2026 18:57
travispaul and others added 3 commits April 10, 2026 15:06
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Exercises directory creation, object upload, listing, retrieval,
non-empty deletion semantics, and recursive cleanup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants