Merge ~cjwatson/launchpad-mojo-specs:lp-separate-signing-keys into launchpad-mojo-specs:master

[Colin Watson]

lp: Use separate signing client public keys for each publisher

This was a mistake when converting our legacy deployments to charms: each publisher has always had its own client public key authorizing it to use the signing service, which is important because they have access to different sets of keys held there.

I added signing configuration for the copy archive publisher while I was here.

Deploying this also requires making sure that the corresponding private keys are correct in `deploy-secrets`.

[Ines Almeida (ines-almeida)]

Makes sense

review: Approve

diff --git a/lp/bundle.yaml b/lp/bundle.yaml
index abbd49d..14c41d7 100644
--- a/lp/bundle.yaml
+++ b/lp/bundle.yaml
@@ -66,11 +66,14 @@
 {%- set launchpad_codehosting_lb_constraints = "" %}
 {%- set launchpad_codehosting_workers = 1 %}
 {%- set launchpad_copy_archive_publisher_active = False %}
+{%- set launchpad_copy_archive_publisher_signing_client_public_key = "" %}
 {%- set launchpad_ftpmaster_publisher_active = False %}
+{%- set launchpad_ftpmaster_publisher_signing_client_public_key = "" %}
 {%- set launchpad_ftpmaster_uploader_active = False %}
 {%- set launchpad_loggerhead_nagios_check_branch = "" %}
 {%- set launchpad_loggerhead_num_units = 1 %}
 {%- set launchpad_ppa_publisher_active = False %}
+{%- set launchpad_ppa_publisher_signing_client_public_key = "" %}
 {%- set launchpad_ppa_publisher_storm_cache_size = 10000 %}
 {%- set launchpad_ppa_uploader_active = False %}
 {%- set launchpad_scripts_active = False %}
@@ -105,7 +108,6 @@
 {%- set process_inbound_email_host = "mail.canonical.com" %}
 {%- set require_signing_keys = False %}
 {%- set signing_endpoint = "" %}
-{%- set signing_client_public_key = "" %}
 {%- set snap_store_secrets_public_key = "" %}
 {%- set snap_store_url = "" %}
 {%- set swift_feed_workers = 1 %}
@@ -195,6 +197,7 @@
 {#-   On PS5, the separate attached data volume needs to be on fast Ceph. #}
 {%-   set launchpad_copy_archive_publisher_constraints = "cores=4 mem=8G root-disk-source=volume root-disk=50G" %}
 {%-   set launchpad_copy_archive_publisher_database_name = "launchpad_prod_copy_archive_publisher" %}
+{%-   set launchpad_copy_archive_publisher_signing_client_public_key = "iRHBwUIS6QB29fWtwNnNsPlA//o728mnyZqOqwjKWxc=" %}
 {%-   set launchpad_buildd_manager_authentication_timeout = 180 %}
 {#-   On PS5, this needs to be on fast Ceph. #}
 {%-   set launchpad_buildd_manager_constraints = "cores=8 mem=16G root-disk-source=volume root-disk=300G" %}
@@ -204,6 +207,7 @@
 {#-   On PS5, the separate attached data volume needs to be on fast Ceph. #}
 {%-   set launchpad_ftpmaster_publisher_constraints = "cores=4 mem=16G root-disk-source=volume root-disk=50G" %}
 {%-   set launchpad_ftpmaster_publisher_database_name = "launchpad_prod_ftpmaster_publisher" %}
+{%-   set launchpad_ftpmaster_publisher_signing_client_public_key = "TZ02gE4a0065aTYj6nBNGLytRa5CLfyTjHy0dp1XlmQ=" %}
 {%-   set launchpad_ftpmaster_uploader_constraints = "cores=4 mem=8G root-disk-source=volume root-disk=100G" %}
 {%-   set launchpad_ftpmaster_uploader_database_name = "launchpad_prod_ftpmaster_uploader" %}
 {#-   On PS5, the separate attached data volume needs to be on fast Ceph. #}
@@ -215,6 +219,7 @@
 {#-   On PS5, the separate attached data volume needs to be on fast Ceph. #}
 {%-   set launchpad_ppa_publisher_constraints = "cores=8 mem=64G root-disk-source=volume root-disk=50G" %}
 {%-   set launchpad_ppa_publisher_database_name = "launchpad_prod_ppa_publisher" %}
+{%-   set launchpad_ppa_publisher_signing_client_public_key = "qmOdkDIIcEV4fYcgBZWHnNJ64mm+83md1DYd6/AOiHs=" %}
 {%-   set launchpad_ppa_publisher_storm_cache_size = 500000 %}
 {%-   set launchpad_ppa_uploader_active = True %}
 {%-   set launchpad_ppa_uploader_constraints = "cores=4 mem=8G root-disk-source=volume root-disk=100G" %}
@@ -261,7 +266,6 @@
 {%-   set session_cookie_name = "lp" %}
 {%-   set session_database_name = "session_prod" %}
 {%-   set signing_endpoint = "http://signing.lp.internal:8000/" %}
-{%-   set signing_client_public_key = "TZ02gE4a0065aTYj6nBNGLytRa5CLfyTjHy0dp1XlmQ=" %}
 {%-   set snap_store_secrets_public_key = "BFsvdzROlS0oEEvXGMejlCospBdFSoVemKxUd+O8iyI=" %}
 {%-   set snap_store_upload_url = "https://upload.apps.ubuntu.com/" %}
 {%-   set snap_store_url = "https://myapps.developer.ubuntu.com/" %}
@@ -484,7 +488,6 @@
 {%-   set session_cookie_name = "qastaging" %}
 {%-   set session_database_name = "session_qastaging" %}
 {%-   set signing_endpoint = "http://signing.staging.lp.internal:8000/" %}
-{%-   set signing_client_public_key = "" %}
 {%-   set statsd_environment = "qastaging" %}
 {%-   set uploader_default_recipient = "Launchpad Archiver <[e-mail]>" %}
 {%-   set uploader_default_sender = "Ubuntu Installer <[e-mail]>" %}
@@ -1050,7 +1053,7 @@ applications:
       publisher_parts_repository: "lp:ubuntu-archive-publishing"
       publisher_parts_revision: 125
       signing_endpoint: "{{ signing_endpoint }}"
-      signing_client_public_key: "{{ signing_client_public_key }}"
+      signing_client_public_key: "{{ launchpad_ftpmaster_publisher_signing_client_public_key }}"
       ubuntu_dists_hosts_allow: "{{ ubuntu_dists_hosts_allow }}"
       ubuntu_germinate_hosts_allow: "{{ ubuntu_germinate_hosts_allow }}"
       webmaster_email: "webmaster@{{ domain }}"
@@ -1097,6 +1100,8 @@ applications:
       domain_test_rebuild_aliases: "{{ domain_test_rebuild_aliases }}"
       publisher_parts_repository: "lp:ubuntu-archive-publishing"
       publisher_parts_revision: 125
+      signing_endpoint: "{{ signing_endpoint }}"
+      signing_client_public_key: "{{ launchpad_copy_archive_publisher_signing_client_public_key }}"
   frontend-copy-archive-publisher:
     charm: ch:apache2
     channel: stable
@@ -1127,7 +1132,7 @@ applications:
       oval_data_rsync_endpoint: "{{ oval_data_rsync_endpoint }}"
       require_signing_keys: {{ require_signing_keys }}
       signing_endpoint: "{{ signing_endpoint }}"
-      signing_client_public_key: "{{ signing_client_public_key }}"
+      signing_client_public_key: "{{ launchpad_ppa_publisher_signing_client_public_key }}"
       storm_cache_size: {{ launchpad_ppa_publisher_storm_cache_size }}
   launchpad-ppa-uploader:
     charm: ch:launchpad-ppa-uploader