Update The Update Framework metadata files

By default, TUF metadata files expire 52 weeks after RHTAS deployment. Update the metadata at least once every 52 weeks before expiration. Red Hat recommends updating TUF metadata more frequently than once a year to avoid expiration.

Before you begin

  • Installation of the RHTAS operator running on Red Hat OpenShift Container Platform.
  • A running Securesign instance.
  • A workstation with the oc binary installed.

About this task

This procedure walks you through refreshing the root, and non-root metadata files.

Procedure

  1. Download the tufcli binary from the OpenShift cluster to your workstation.
  3. From the home page, click the ? icon, click Command line tools, go to the tufcli download section, and click the link for your platform.
  4. Open a terminal on your workstation, extract the `.tar.gz` archive, and set the execution bit: 
    $ tar -xzf tufcli_linux_amd64.tar.gz
$ chmod +x tufcli-amd64

    2. Move the binary to a location within your $PATH environment: 
      $ sudo mv tufcli-amd64 /usr/local/bin/tuftool
  5. Log in to OpenShift from the command line: 
    oc login --token=TOKEN --server=SERVER_URL_AND_PORT
     
    $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
    Note

    You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.
  6. Switch to the RHTAS project: 
    $ oc project trusted-artifact-signer
  7. Configure your shell environment: 
    $ export WORK="${HOME}/trustroot-example"
$ export ROOT="${WORK}/root/root.json"
$ export KEYDIR="${WORK}/keys"
$ export INPUT="${WORK}/input"
$ export TUF_REPO="${WORK}/tuf-repo"
$ export TUF_SERVER_POD="$(oc get pods -l app.kubernetes.io/component=tuf,\!job-name -o jsonpath='{.items[0].metadata.name}')"
$ export TIMESTAMP_EXPIRATION="in 10 days"
$ export SNAPSHOT_EXPIRATION="in 26 weeks"
$ export TARGETS_EXPIRATION="in 26 weeks"
$ export ROOT_EXPIRATION="in 26 weeks"

    Set the expiration durations according to your requirements.

  8. Create a temporary TUF directory structure: 
    $ mkdir -p "${WORK}/root/" "${KEYDIR}" "${INPUT}" "${TUF_REPO}"
  9. Download the TUF contents to the temporary TUF directory structure: 
    $ oc extract --to "${KEYDIR}/" secret/tuf-root-keys
$ oc cp "${TUF_SERVER_POD}:/var/www/html" "${TUF_REPO}"
$ cp "${TUF_REPO}/root.json" "${ROOT}"
  10. You can update the timestamp, snapshot, and targets metadata all in one command: 
    $ tufcli update \
  --root "${ROOT}" \
  --key "${KEYDIR}/timestamp.pem" \
  --key "${KEYDIR}/snapshot.pem" \
  --key "${KEYDIR}/targets.pem" \
  --timestamp-expires "${TIMESTAMP_EXPIRATION}" \
  --snapshot-expires "${SNAPSHOT_EXPIRATION}" \
  --targets-expires "${TARGETS_EXPIRATION}" \
  --outdir "${TUF_REPO}" \
  --metadata-url "file://${TUF_REPO}"
    Note

    You can also run the TUF metadata update on a subset of TUF metadata files. For example, the timestamp.json metadata file expires more often than the other metadata files. Therefore, you can just update the timestamp metadata file by running the following command: 

    $ tufcli update \
  --root "${ROOT}" \
  --key "${KEYDIR}/timestamp.pem" \
  --timestamp-expires "${TIMESTAMP_EXPIRATION}" \
  --outdir "${TUF_REPO}" \
  --metadata-url "file://${TUF_REPO}"
  11. Only update the root expiration date if it is about to expire: 
    $ tufcli root expire "${ROOT}" "${ROOT_EXPIRATION}"
    Note
    You can skip this step if the root file is not close to expiring.
  12. Update the root version: 
    $ tufcli root bump-version "${ROOT}"
  13. Sign the root metadata file again: 
    $ tufcli root sign "${ROOT}" -k "${KEYDIR}/root.pem"
  14. Set the new root version, and copy the root metadata file in place: 
    $ export NEW_ROOT_VERSION=$(cat "${ROOT}" | jq -r ".signed.version")
$ cp "${ROOT}" "${TUF_REPO}/root.json"
$ cp "${ROOT}" "${TUF_REPO}/${NEW_ROOT_VERSION}.root.json"
  15. Upload these changes to the TUF server: 
    $ oc rsync --no-perms "${TUF_REPO}/" "${TUF_SERVER_POD}:/var/www/html"