-
Notifications
You must be signed in to change notification settings - Fork 212
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Submit challenge with poet cert pubkey hint #6313
base: develop
Are you sure you want to change the base?
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #6313 +/- ##
=========================================
- Coverage 79.8% 79.8% -0.1%
=========================================
Files 343 343
Lines 44505 44514 +9
=========================================
- Hits 35548 35546 -2
- Misses 6952 6970 +18
+ Partials 2005 1998 -7 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The change in poet to support extra trusted keys was backward compatible - the poet will accept registrations with certs signed by the main certifier without the hint. Hence, I think this change is not really required.
It would be more interesting to allow loading certificates from disk and using them instead of certifying at the certifier service (then the hint would be required).
info, err := c.getInfo(ctx) | ||
if err != nil { | ||
return nil, err | ||
} | ||
|
||
return &PoetAuth{PoetCert: cert, CertPubKey: info.Certifier.Pubkey}, nil |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It should continue to work the way it was (without passing the hint).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't understand? Sure the node just chose to not provide the certifier pubkey hint and then everything works like before (after the fix in this PR: spacemeshos/poet#523), but if the nodes certificate has been signed by a different Certifier than the one returned from /info
of the PoET it is using then it should be able to at least try to still submit in case the PoET accepts certificates from the certifier the node is using or not?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I mean: if the cert is signed by the certifier exposed on info.Certfier.URL, then you don't need to pass the hint (legacy support). If it is not signed by this certifier, then passing info.Certifier.Pubkey
makes no sense (as it will be rejected)
Motivation
Add cetifier pubkey hint to poet
Submit
request to support changes on poet service side spacemeshos/poet#501Description
Pass first 4 bytes of cerifier pubkey as hint for poet + new tests.
Test Plan
TODO