{"action":"created","comment":{"url":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments/201065188","pull_request_review_id":135494020,"id":201065188,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIwMTA2NTE4OA==","diff_hunk":"@@ -51,7 +51,7 @@ func (s *XPISigner) generateCOSEKeyPair(coseAlg *cose.Algorithm) (eeKey crypto.P\n \tcase nil:\n \t\terr = fmt.Errorf(\"Cannot generate private key for nil cose Algorithm\")\n \tcase cose.PS256:\n-\t\tconst size = 2048\n+\t\tsize := s.issuerKey.(*rsa.PrivateKey).N.BitLen()","path":"signer/xpi/cose.go","position":null,"original_position":5,"commit_id":"f9dc49baf186474bff9a1b5d0401f1609cbe4a0f","original_commit_id":"0415a58177f970dd5cdbfa63984734836d271e6b","user":{"login":"g-k","id":226605,"node_id":"MDQ6VXNlcjIyNjYwNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/226605?v=4","gravatar_id":"","url":"https://api.github.com/users/g-k","html_url":"https://github.com/g-k","followers_url":"https://api.github.com/users/g-k/followers","following_url":"https://api.github.com/users/g-k/following{/other_user}","gists_url":"https://api.github.com/users/g-k/gists{/gist_id}","starred_url":"https://api.github.com/users/g-k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/g-k/subscriptions","organizations_url":"https://api.github.com/users/g-k/orgs","repos_url":"https://api.github.com/users/g-k/repos","events_url":"https://api.github.com/users/g-k/events{/privacy}","received_events_url":"https://api.github.com/users/g-k/received_events","type":"User","site_admin":false},"body":":+1: \r\n\r\nhttps://github.com/mozilla-services/autograph/pull/76/commits/f9dc49baf186474bff9a1b5d0401f1609cbe4a0f","created_at":"2018-07-09T16:24:22Z","updated_at":"2018-07-09T16:24:22Z","html_url":"https://github.com/mozilla-services/autograph/pull/76#discussion_r201065188","pull_request_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments/201065188"},"html":{"href":"https://github.com/mozilla-services/autograph/pull/76#discussion_r201065188"},"pull_request":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76"}},"in_reply_to_id":200983928},"pull_request":{"url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76","id":180476652,"node_id":"MDExOlB1bGxSZXF1ZXN0MTgwNDc2NjUy","html_url":"https://github.com/mozilla-services/autograph/pull/76","diff_url":"https://github.com/mozilla-services/autograph/pull/76.diff","patch_url":"https://github.com/mozilla-services/autograph/pull/76.patch","issue_url":"https://api.github.com/repos/mozilla-services/autograph/issues/76","number":76,"state":"open","locked":false,"title":"XPI cose signing","user":{"login":"g-k","id":226605,"node_id":"MDQ6VXNlcjIyNjYwNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/226605?v=4","gravatar_id":"","url":"https://api.github.com/users/g-k","html_url":"https://github.com/g-k","followers_url":"https://api.github.com/users/g-k/followers","following_url":"https://api.github.com/users/g-k/following{/other_user}","gists_url":"https://api.github.com/users/g-k/gists{/gist_id}","starred_url":"https://api.github.com/users/g-k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/g-k/subscriptions","organizations_url":"https://api.github.com/users/g-k/orgs","repos_url":"https://api.github.com/users/g-k/repos","events_url":"https://api.github.com/users/g-k/events{/privacy}","received_events_url":"https://api.github.com/users/g-k/received_events","type":"User","site_admin":false},"body":"WIP branch to add COSE signatures to addons\r\n\r\n~~Assume one signer per addon (i.e. we don't need multiple signatures on the COSE message)?~~\r\n\r\nedit: @jvehent I'm thinking we change the signer config as follows:\r\n\r\n* add a `cose_signers` key \r\n* its value is an array with required keys algorithm, certificate, and privatekey with values:\r\n  * algorithm: from the \"Name\" column of https://www.iana.org/assignments/cose/cose.xhtml#header-algorithm-parameters Might need quotes.\r\n  * certificate and privatekey: same PEM blocks as top level signer values\r\n\r\nFor example:\r\n\r\n```yaml\r\nsigners:\r\n- id: extensions-pkcs7-ecdsa\r\n   type: xpi\r\n   certificate: |\r\n        -----BEGIN CERTIFICATE-----\r\n        ... \r\n   privatekey: | \r\n        -----BEGIN EC PARAMETERS----- \r\n        ...\r\n- id: extensions-signer-pkcs7-and-cose\r\n   type: xpi\r\n   certificate: |  # an optional PKCS7 signer\r\n        -----BEGIN CERTIFICATE----- # probably the same as the first cose\r\n        ... \r\n   privatekey: | \r\n        -----BEGIN EC PARAMETERS----- \r\n        ...\r\n   cose_signers: # enables cose signing when present and makes PKCS7 signing optional\r\n     - algorithm: ES256\r\n       certificate: |\r\n        -----BEGIN CERTIFICATE-----\r\n        ... \r\n       privatekey: |\r\n       -----BEGIN EC PARAMETERS----- \r\n       ...\r\n     - algorithm: PS256\r\n       certificate: |\r\n        -----BEGIN CERTIFICATE-----\r\n        ... \r\n       privatekey: |\r\n       -----BEGIN PRIVATE KEY-----\r\n       ...\r\n```\r\n \r\nThis lets us:\r\n\r\n* use multiple or different intermediates for COSE signing\r\n* enable and disable PKCS7 signing with COSE signing using a different intermediate if necessary \r\n* keep existing PKCS7 signers by having a client's authorizations default to the non-COSE signer but allowing clients to select a COSE signer with an explicit signer keyid","created_at":"2018-04-10T02:51:43Z","updated_at":"2018-07-09T16:24:22Z","closed_at":null,"merged_at":null,"merge_commit_sha":"da20571089c454ff0fc4e1a90426001bea365990","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/commits","review_comments_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/comments","review_comment_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mozilla-services/autograph/issues/76/comments","statuses_url":"https://api.github.com/repos/mozilla-services/autograph/statuses/f9dc49baf186474bff9a1b5d0401f1609cbe4a0f","head":{"label":"mozilla-services:xpi-cose-signing","ref":"xpi-cose-signing","sha":"f9dc49baf186474bff9a1b5d0401f1609cbe4a0f","user":{"login":"mozilla-services","id":1066228,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwNjYyMjg=","avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":49082801,"node_id":"MDEwOlJlcG9zaXRvcnk0OTA4MjgwMQ==","name":"autograph","full_name":"mozilla-services/autograph","owner":{"login":"mozilla-services","id":1066228,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwNjYyMjg=","avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/autograph","description":"Digital signature micro-services","fork":false,"url":"https://api.github.com/repos/mozilla-services/autograph","forks_url":"https://api.github.com/repos/mozilla-services/autograph/forks","keys_url":"https://api.github.com/repos/mozilla-services/autograph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/autograph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/autograph/teams","hooks_url":"https://api.github.com/repos/mozilla-services/autograph/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/autograph/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/autograph/events","assignees_url":"https://api.github.com/repos/mozilla-services/autograph/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/autograph/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/autograph/tags","blobs_url":"https://api.github.com/repos/mozilla-services/autograph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/autograph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/autograph/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/autograph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/autograph/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/autograph/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/autograph/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/autograph/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/autograph/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/autograph/subscription","commits_url":"https://api.github.com/repos/mozilla-services/autograph/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/autograph/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/autograph/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/autograph/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/autograph/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/autograph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/autograph/merges","archive_url":"https://api.github.com/repos/mozilla-services/autograph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/autograph/downloads","issues_url":"https://api.github.com/repos/mozilla-services/autograph/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/autograph/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/autograph/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/autograph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/autograph/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/autograph/releases{/id}","deployments_url":"https://api.github.com/repos/mozilla-services/autograph/deployments","created_at":"2016-01-05T17:55:26Z","updated_at":"2018-07-04T01:50:09Z","pushed_at":"2018-07-09T16:20:59Z","git_url":"git://github.com/mozilla-services/autograph.git","ssh_url":"git@github.com:mozilla-services/autograph.git","clone_url":"https://github.com/mozilla-services/autograph.git","svn_url":"https://github.com/mozilla-services/autograph","homepage":"","size":63160,"stargazers_count":57,"watchers_count":57,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":13,"mirror_url":null,"archived":false,"open_issues_count":14,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0","node_id":"MDc6TGljZW5zZTE0"},"forks":13,"open_issues":14,"watchers":57,"default_branch":"master"}},"base":{"label":"mozilla-services:master","ref":"master","sha":"4f8034af2dfc21e7e801819635e2fdaa0dd9e733","user":{"login":"mozilla-services","id":1066228,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwNjYyMjg=","avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":49082801,"node_id":"MDEwOlJlcG9zaXRvcnk0OTA4MjgwMQ==","name":"autograph","full_name":"mozilla-services/autograph","owner":{"login":"mozilla-services","id":1066228,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwNjYyMjg=","avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/autograph","description":"Digital signature micro-services","fork":false,"url":"https://api.github.com/repos/mozilla-services/autograph","forks_url":"https://api.github.com/repos/mozilla-services/autograph/forks","keys_url":"https://api.github.com/repos/mozilla-services/autograph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/autograph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/autograph/teams","hooks_url":"https://api.github.com/repos/mozilla-services/autograph/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/autograph/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/autograph/events","assignees_url":"https://api.github.com/repos/mozilla-services/autograph/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/autograph/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/autograph/tags","blobs_url":"https://api.github.com/repos/mozilla-services/autograph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/autograph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/autograph/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/autograph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/autograph/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/autograph/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/autograph/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/autograph/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/autograph/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/autograph/subscription","commits_url":"https://api.github.com/repos/mozilla-services/autograph/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/autograph/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/autograph/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/autograph/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/autograph/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/autograph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/autograph/merges","archive_url":"https://api.github.com/repos/mozilla-services/autograph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/autograph/downloads","issues_url":"https://api.github.com/repos/mozilla-services/autograph/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/autograph/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/autograph/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/autograph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/autograph/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/autograph/releases{/id}","deployments_url":"https://api.github.com/repos/mozilla-services/autograph/deployments","created_at":"2016-01-05T17:55:26Z","updated_at":"2018-07-04T01:50:09Z","pushed_at":"2018-07-09T16:20:59Z","git_url":"git://github.com/mozilla-services/autograph.git","ssh_url":"git@github.com:mozilla-services/autograph.git","clone_url":"https://github.com/mozilla-services/autograph.git","svn_url":"https://github.com/mozilla-services/autograph","homepage":"","size":63160,"stargazers_count":57,"watchers_count":57,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":13,"mirror_url":null,"archived":false,"open_issues_count":14,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0","node_id":"MDc6TGljZW5zZTE0"},"forks":13,"open_issues":14,"watchers":57,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76"},"html":{"href":"https://github.com/mozilla-services/autograph/pull/76"},"issue":{"href":"https://api.github.com/repos/mozilla-services/autograph/issues/76"},"comments":{"href":"https://api.github.com/repos/mozilla-services/autograph/issues/76/comments"},"review_comments":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/comments"},"review_comment":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/commits"},"statuses":{"href":"https://api.github.com/repos/mozilla-services/autograph/statuses/f9dc49baf186474bff9a1b5d0401f1609cbe4a0f"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"g-k"}}