Chapter 3. Updating The Update Framework metadata files
Chapter 3. Updating The Update Framework metadata files By default, The Update Framework (TUF) metadata files expire after 52 weeks from the deployment date of a Securesign instance. At a minimum, you have to update the TUF metadata files at least once every 52 weeks before they expire. Red Hat recommends updating the metadata files more often than once a year. This procedure walks you through refreshing the root, and non-root metadata files. Prerequisites Installation of the RHTAS operator running on Red Hat OpenShift Container Platform. A running Securesign instance. A workstation with the oc binary installed. Procedure Download the tuftool binary from the OpenShift cluster to your workstation. Important The tuftool binary is only available for Linux operating systems. From the home page, click the ? icon, click Command line tools , go to the tuftool download section, and click the link for your platform. Open a terminal on your workstation, decompress the binary .gz file, and set the execute bit: Example USD gunzip tuftool-amd64.gz USD chmod +x tuftool-amd64 Move and rename the binary to a location within your USDPATH environment: Example USD sudo mv tuftool-amd64 /usr/local/bin/tuftool Log in to OpenShift from the command line: Syntax oc login --token= TOKEN --server= SERVER_URL_AND_PORT Example USD oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443 Note You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command . Offer your user name and password again, if asked, and click Display Token to view the command. Switch to the RHTAS project: Example USD oc project trusted-artifact-signer Configure your shell environment: Example USD export WORK="USD{HOME}/trustroot-example" USD export ROOT="USD{WORK}/root/root.json" USD export KEYDIR="USD{WORK}/keys" USD export INPUT="USD{WORK}/input" USD export TUF_REPO="USD{WORK}/tuf-repo" USD export TUF_SERVER_POD="USD(oc get pod --selector=app.kubernetes.io/component=tuf --no-headers -o custom-columns=":metadata.name")" USD export TIMESTAMP_EXPIRATION="in 10 days" USD export SNAPSHOT_EXPIRATION="in 26 weeks" USD export TARGETS_EXPIRATION="in 26 weeks" USD export ROOT_EXPIRATION="in 26 weeks" Set the expiration durations according to your requirements. Create a temporary TUF directory structure: Example USD mkdir -p "USD{WORK}/root/" "USD{KEYDIR}" "USD{INPUT}" "USD{TUF_REPO}" Download the TUF contents to the temporary TUF directory structure: Example USD oc extract --to "USD{KEYDIR}/" secret/tuf-root-keys USD oc cp "USD{TUF_SERVER_POD}:/var/www/html" "USD{TUF_REPO}" USD cp "USD{TUF_REPO}/root.json" "USD{ROOT}" You can update the timestamp, snapshot, and targets metadata all in one command: Example USD tuftool update \ --root "USD{ROOT}" \ --key "USD{KEYDIR}/timestamp.pem" \ --key "USD{KEYDIR}/snapshot.pem" \ --key "USD{KEYDIR}/targets.pem" \ --timestamp-expires "USD{TIMESTAMP_EXPIRATION}" \ --snapshot-expires "USD{SNAPSHOT_EXPIRATION}" \ --targets-expires "USD{TARGETS_EXPIRATION}" \ --outdir "USD{TUF_REPO}" \ --metadata-url "file://USD{TUF_REPO}" Note You can also run the TUF metadata update on a subset of TUF metadata files. For example, the timestamp.json metadata file expires more often than the other metadata files. Therefore, you can just update the timestamp metadata file by running the following command: USD tuftool update \ --root "USD{ROOT}" \ --key "USD{KEYDIR}/timestamp.pem" \ --timestamp-expires "USD{TIMESTAMP_EXPIRATION}" \ --outdir "USD{TUF_REPO}" \ --metadata-url "file://USD{TUF_REPO}" Only update the root expiration date if it is about to expire: Example USD tuftool root expire "USD{ROOT}" "USD{ROOT_EXPIRATION}" Note You can skip this step if the root file is not close to expiring. Update the root version: Example USD tuftool root bump-version "USD{ROOT}" Sign the root metadata file again: Example USD tuftool root sign "USD{ROOT}" -k "USD{KEYDIR}/root.pem" Set the new root version, and copy the root metadata file in place: Example USD export NEW_ROOT_VERSION=USD(cat "USD{ROOT}" | jq -r ".signed.version") USD cp "USD{ROOT}" "USD{TUF_REPO}/root.json" USD cp "USD{ROOT}" "USD{TUF_REPO}/USD{NEW_ROOT_VERSION}.root.json" Upload these changes to the TUF server: Example USD oc rsync "USD{TUF_REPO}/" "USD{TUF_SERVER_POD}:/var/www/html"
gunzip tuftool-amd64.gz chmod +x tuftool-amd64 sudo mv tuftool-amd64 /usr/local/bin/tuftool login --token= TOKEN --server= SERVER_URL_AND_PORT oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443 oc project trusted-artifact-signer export WORK="USD{HOME}/trustroot-example" export ROOT="USD{WORK}/root/root.json" export KEYDIR="USD{WORK}/keys" export INPUT="USD{WORK}/input" export TUF_REPO="USD{WORK}/tuf-repo" export TUF_SERVER_POD="USD(oc get pod --selector=app.kubernetes.io/component=tuf --no-headers -o custom-columns=":metadata.name")" export TIMESTAMP_EXPIRATION="in 10 days" export SNAPSHOT_EXPIRATION="in 26 weeks" export TARGETS_EXPIRATION="in 26 weeks" export ROOT_EXPIRATION="in 26 weeks" mkdir -p "USD{WORK}/root/" "USD{KEYDIR}" "USD{INPUT}" "USD{TUF_REPO}" oc extract --to "USD{KEYDIR}/" secret/tuf-root-keys oc cp "USD{TUF_SERVER_POD}:/var/www/html" "USD{TUF_REPO}" cp "USD{TUF_REPO}/root.json" "USD{ROOT}" tuftool update --root "USD{ROOT}" --key "USD{KEYDIR}/timestamp.pem" --key "USD{KEYDIR}/snapshot.pem" --key "USD{KEYDIR}/targets.pem" --timestamp-expires "USD{TIMESTAMP_EXPIRATION}" --snapshot-expires "USD{SNAPSHOT_EXPIRATION}" --targets-expires "USD{TARGETS_EXPIRATION}" --outdir "USD{TUF_REPO}" --metadata-url "file://USD{TUF_REPO}" tuftool update --root "USD{ROOT}" --key "USD{KEYDIR}/timestamp.pem" --timestamp-expires "USD{TIMESTAMP_EXPIRATION}" --outdir "USD{TUF_REPO}" --metadata-url "file://USD{TUF_REPO}" tuftool root expire "USD{ROOT}" "USD{ROOT_EXPIRATION}" tuftool root bump-version "USD{ROOT}" tuftool root sign "USD{ROOT}" -k "USD{KEYDIR}/root.pem" export NEW_ROOT_VERSION=USD(cat "USD{ROOT}" | jq -r ".signed.version") cp "USD{ROOT}" "USD{TUF_REPO}/root.json" cp "USD{ROOT}" "USD{TUF_REPO}/USD{NEW_ROOT_VERSION}.root.json" oc rsync "USD{TUF_REPO}/" "USD{TUF_SERVER_POD}:/var/www/html"