You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Anton Tolchanov 151b77f9d6 cmd/tl-longchain: tool to re-sign nodes with long rotation signatures ... In Tailnet Lock, there is an implicit limit on the number of rotation signatures that can be chained before the signature becomes too long. This program helps tailnet admins to identify nodes that have signatures with long chains and prints commands to re-sign those node keys with a fresh direct signature. It's a temporary mitigation measure, and we will remove this tool as we design and implement a long-term approach for rotation signatures. Example output: ``` 2024/08/20 18:25:03 Self: does not need re-signing 2024/08/20 18:25:03 Visible peers with valid signatures: 2024/08/20 18:25:03 Peer xxx2.yy.ts.net. (100.77.192.34) nodeid=nyDmhiZiGA11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx3.yy.ts.net. (100.84.248.22) nodeid=ndQ64mDnaB11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx4.yy.ts.net. (100.85.253.53) nodeid=nmZfVygzkB21KTM59, current signature kind=rotation: chain length 4, printing command to re-sign tailscale lock sign nodekey:530bddbfbe69e91fe15758a1d6ead5337aa6307e55ac92dafad3794f8b3fc661 tlpub:4bf07597336703395f2149dce88e7c50dd8694ab5bbde3d7c2a1c7b3e231a3c2 ``` To support this, the NetworkLockStatus localapi response now includes information about signatures of all peers rather than just the invalid ones. This is not displayed by default in `tailscale lock status`, but will be surfaced in `tailscale lock status --json`. Updates #13185 Signed-off-by: Anton Tolchanov <anton@tailscale.com>		3 months ago
..
aum.go	all: use new AppendEncode methods available in Go 1.22 (#11079)	10 months ago
aum_test.go	all: update copyright and license headers	2 years ago
builder.go	all: update copyright and license headers	2 years ago
builder_test.go	all: update copyright and license headers	2 years ago
chaintest_test.go	all: use Go 1.22 range-over-int	7 months ago
deeplink.go	tka: add function for generating signing deeplinks (#8385)	1 year ago
deeplink_test.go	tka: add function for generating signing deeplinks (#8385)	1 year ago
key.go	tka: guard against key-length panics when verifying signatures	1 year ago
key_test.go	all: update copyright and license headers	2 years ago
scenario_test.go	all: cleanup unused code, part 1 (#10661)	11 months ago
sig.go	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	3 months ago
sig_test.go	ipn/ipnlocal: allow multiple signature chains from the same SigCredential	5 months ago
state.go	tka: clarify field comment	1 year ago
state_test.go	various: add golangci-lint, fix issues (#7905)	2 years ago
sync.go	all: use Go 1.22 range-over-int	7 months ago
sync_test.go	all: update copyright and license headers	2 years ago
tailchonk.go	all: use Go 1.22 range-over-int	7 months ago
tailchonk_test.go	tka: fix go vet complaint on copy of lock value in tailchonk_test.go (#8208)	2 years ago
tka.go	ipn/ipnlocal: discard node keys that have been rotated out	6 months ago
tka_clone.go	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	3 months ago
tka_test.go	all: implement lock revoke-keys command	1 year ago