The release signing key
Holger's releases are signed with ONE key: the owner's release key, made on his YubiKey (serial 34569904, PIV slot 9c, ECDSA P-256, PIN policy once, touch policy always). The private key was generated on the device and never leaves it; every signature needs the PIN and a touch. Holger and Gunnar use the same key.
| File | What it is |
release-signing-key.pub |
the public key (PEM, SubjectPublicKeyInfo) |
release-signing-key.attestation.pem |
the YubiKey's attestation certificate for that key: generated on the device, with that PIN and touch policy |
yubikey-piv-attestation-ca.pem |
the YubiKey's own attestation certificate (slot f9), which signs the attestation; it is issued by Yubico PIV Attestation B 1, which chains to Yubico's PIV root CA |
Key id (sha256 of the SubjectPublicKeyInfo DER):
d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249eopenssl pkey -pubin -in release-signing-key.pub -outform DER | sha256sumCheck the key's attestation
# the attestation is signed by the YubiKey's attestation CA
openssl verify -partial_chain -CAfile yubikey-piv-attestation-ca.pem release-signing-key.attestation.pem
# the attested key is the release key (both commands print the same digest)
openssl x509 -in release-signing-key.attestation.pem -pubkey -noout | openssl pkey -pubin -outform DER | sha256sum
openssl pkey -pubin -in release-signing-key.pub -outform DER | sha256sum
# the policy: extension 1.3.6.1.4.1.41482.3.8 holds two bytes, the PIN policy then the
# touch policy (02 = once, 02 = always); this prints 060a2b0601040182c40a030804020202
openssl x509 -in release-signing-key.attestation.pem -outform DER | od -An -tx1 -v | tr -d ' \n' \
| grep -o '060a2b0601040182c40a0308040202..'To go up to Yubico, verify yubikey-piv-attestation-ca.pem against Yubico's intermediate (Yubico PIV Attestation B 1) and PIV root CA, both published at https://developers.yubico.com/PIV/Introduction/PIV_attestation.html.
Verify a release bundle
Each release has one bundle, attestations/<release>.intoto.jsonl (a DSSE envelope with an in-toto SLSA v1 statement). With dwarves-slsa (dwarves release-build verify), which also checks the builder and the build type:
dwarves release-build verify --key slsa/release-signing-key.pub \
--bundle attestations/holger-2.0.1.intoto.jsonl --artifact holger-2.0.1.crateWith plain openssl (the signature is ECDSA P-256 with SHA-256 over the DSSE PAE):
B=attestations/holger-2.0.1.intoto.jsonl
T=$(jq -r .payloadType "$B")
jq -r .payload "$B" | base64 -d > statement.json
jq -r '.signatures[0].sig' "$B" | base64 -d > sig.der
{ printf 'DSSEv1 %d %s %d ' ${#T} "$T" $(wc -c < statement.json); cat statement.json; } > pae.bin
openssl dgst -sha256 -verify slsa/release-signing-key.pub -signature sig.der pae.bin # Verified OK
# then the artifact: its sha256 must be one of the statement's subjects
sha256sum holger-2.0.1.crate
jq -r '.subject[] | "\(.digest.sha256) \(.name)"' statement.jsoncosign and Holger's provenance scanner work too; see docs/v2/07-build-thing.md.