TRITON-2542 Add support for ed25519 keys - #206
Open
travispaul wants to merge 18 commits into
Open
Conversation
Add ed25519 signing support alongside existing RSA and ECDSA key types
for HTTP Signature Authentication used by Triton DataCenter APIs.
Changes:
private_key_signer.go:
- Add ed25519.PrivateKey case to SignRaw() type switch
- Add ED25519_SHA512 algorithm constant
- Refactor Sign() to delegate to SignRaw(), eliminating ~30 lines of
duplicated type-switch logic
- Refactor type switch to capture typed value directly, removing
redundant type assertions
- Add default case for unsupported key types
- Fix pre-existing bug: unchecked error from asn1.Marshal in ECDSA
signing path
ssh_agent_signer.go:
- Add ed25519 case to Sign() and SignRaw() signature type switches
- Fix duplicate import of github.com/pkg/errors under two names
(errors and pkgerrors); consolidate to bare import
util.go:
- Add ed25519.PrivateKey case to formatPublicKeyFingerprint()
- Add ssh.PublicKey case to accept public keys directly
- Refactor type switch to capture typed value, removing redundant
type assertions
ed25519_signature.go (new):
- Implement ed25519Signature type satisfying httpAuthSignature
interface
- Add signature length validation (must be exactly 64 bytes)
authentication_test.go (new):
- Add 27 tests covering signature types, key format mapping,
fingerprinting across all key types, PrivateKeySigner integration
for ed25519/RSA/ECDSA (including cryptographic verification), error
cases, and KeyID path generation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove tests that merely exercise standard library functions or
duplicate other tests:
- TestEd25519Signature (base64 encoding and constant identity)
- TestPrivateKeySignerEd25519/SignRaw (redundant with SignRaw verify)
- TestPrivateKeySignerBadKeyMaterial (tests ssh.ParseRawPrivateKey)
- TestPrivateKeySignerSignConsistency (merged into Sign subtest)
- TestPrivateKeySignerRSA, TestPrivateKeySignerECDSA (pre-existing
code paths, not changed on this branch)
- TestFormatPublicKeyFingerprint RSA/ECDSA subtests (same)
- TestEd25519SignatureValidation reduced from 4 cases to 1
Removes generateRSAKey and generateECDSAKey helpers. Test file reduced
from 535 to 290 lines; 18 focused tests remain.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CloudAPI's UpdateConfig endpoint (PUT /:login/config) expects HTTP PUT, but the client was sending POST, causing MethodNotAllowedError against live Triton environments. The unit tests masked this by mocking the wrong HTTP method. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…right - Storage examples now consistently use MANTA_USER, MANTA_KEY_ID, and MANTA_KEY_MATERIAL instead of TRITON_* equivalents - Storage examples now consistently use MANTA_URL for MantaURL - Add guard against empty MANTA_FOLDER in force_delete example - Add note to services examples explaining TSG never left preview - Update Edgecast copyright year from 2025 to 2026 across all files modified on this branch Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Ensure all files modified on this branch follow the standard header structure: copyright block first, then MPL license block. Adds missing Edgecast copyright and corrects header ordering. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
deleteAll returned on the first loop iteration, silently skipping all remaining entries. Subdirectories were also never removed after being emptied, and Delete never removed the target directory itself. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR expands the authentication layer to support Ed25519 keys (both private-key signing and SSH-agent signing), fixes recursive directory force-delete behavior in storage, and aligns several examples/tests with corrected APIs and environment variables.
Changes:
- Add Ed25519 support across authentication fingerprinting and signing, including SSH-agent signatures and new unit tests.
- Fix
ForceDeletedirectory deletion to fully recurse and delete all children; add storage tests to prevent regressions. - Correct
UpdateConfigto use HTTPPUTand update examples to preferMANTA_environment variables.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
authentication/util.go |
Extends fingerprint formatting to handle Ed25519 private keys (and raw ssh.PublicKey). |
authentication/private_key_signer.go |
Adds Ed25519 signing support and refactors Sign() to reuse SignRaw(). |
authentication/ssh_agent_signer.go |
Adds Ed25519 SSH-agent signature handling and simplifies error wrapping import usage. |
authentication/ed25519_signature.go |
Introduces an Ed25519 signature wrapper for HTTP Signature formatting. |
authentication/authentication_test.go |
Adds coverage for Ed25519 fingerprinting/signing and keyFormatToKeyType() behavior. |
storage/directory.go |
Fixes ForceDelete recursion to delete all objects/subdirectories instead of returning early. |
storage/delete_test.go |
Adds tests validating multi-object and nested-directory force delete behavior. |
account/config.go |
Fixes UpdateConfig request method from POST to PUT. |
account/config_test.go |
Updates tests to expect PUT for config update requests. |
examples/storage/sign_url/main.go |
Switches storage example env vars to prefer MANTA_* and MANTA_URL. |
examples/storage/object_put/main.go |
Switches storage example env vars to prefer MANTA_* and MANTA_URL. |
examples/storage/mls/main.go |
Switches storage example env vars to prefer MANTA_* and MANTA_URL. |
examples/storage/create_mpu/main.go |
Switches storage example env vars to prefer MANTA_*. |
examples/storage/create_job/main.go |
Switches storage example env vars to prefer MANTA_* and MANTA_URL. |
examples/storage/force_delete/main.go |
Adds a required MANTA_FOLDER validation check. |
examples/compute/create_instance_with_volumes/main.go |
Fixes example tags typing to match expected map[string]interface{}. |
examples/services/templates/list_templates.go |
Adds clarification note that TSG targets a separate API server, not CloudAPI. |
examples/services/groups/list_groups.go |
Adds clarification note that TSG targets a separate API server, not CloudAPI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
TRITON_USER was still being used for the subuser field in all storage examples; replace with MANTA_SUBUSER. Also fix force_delete and force_put which still used TRITON_KEY_ID and TRITON_KEY_MATERIAL. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The existing delete tests only exercised the ForceDelete: true path. Add TestDeleteDirectorySimple to verify that ForceDelete: false issues a single DELETE without listing or recursing into the directory. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
govvv is no longer needed — Go natively embeds VCS metadata (revision, build time, dirty state) since Go 1.18 via runtime/debug.ReadBuildInfo. dep is defunct — the project already uses Go modules. Remove the tools target (dep), replace govvv calls with plain go build and go install, add go vet to the check target, and expose VCS build info in the triton and manta CLI version commands. Also adds a GitHub Actions CI workflow that runs build, lint, and test on pull requests via Makefile targets. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CloudAPI returns image tag values that include booleans and numbers,
not just strings. Change Tags from map[string]string to
map[string]interface{} in Image, CreateImageFromMachineInput, and
UpdateImageInput to match the established Instance.Tags pattern.
Add TestGetImageMixedTags to verify decoding of string, boolean,
and numeric tag values.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add Copyright 2026 Edgecast Cloud LLC. to four modified files that were missing it, and fix "failed create" to "failed to create" in the RSA and ECDSA signing error messages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
travispaul
marked this pull request as ready for review
April 10, 2026 18:57
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Exercises directory creation, object upload, listing, retrieval, non-empty deletion semantics, and recursive cleanup. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
While running tests and the examples, I encountered a few other bugs:
MANTA_env varsI also removed deprecated
govvvanddeptools, go now natively supports what they offered.I am very slightly concerned someone might be relying on the current deleteAll behavior, it is broken and will only delete the first object in a directory and stop, now it actually deletes all objects in the directory and all directories if ForceDelete is true (Just like
mrm -r.) However, I'm also not sure how the current broken behavior would be at all useful so I might be overthinking it. That being said, I'm open to backing out that change and addressing it separately.Testing notes on ticket.
Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com