@@ -79,14 +79,15 @@ packages:
79
79
80
80
1 . http-parser - `` http-parser-devel ``
81
81
2 . systemd - `` systemd ``
82
- 3 . jose - `` jose `` , `` libjose-zlib-devel `` , `` libjose-openssl-devel ``
82
+ 3 . jose >= 8 - `` jose `` , `` libjose-devel ``
83
+ 4 . curl - curl (only needed for running tests)
83
84
84
85
### Building and Installing from Source
85
86
86
87
Building Tang is fairly straightforward:
87
88
88
89
$ autoreconf -if
89
- $ ./configure --prefix=/usr
90
+ $ ./configure --prefix=/usr --libdir=/usr/lib64
90
91
$ make
91
92
$ sudo make install
92
93
@@ -107,18 +108,19 @@ keys will be generated automatically.
107
108
That's it! You're up and running!
108
109
109
110
### Key Rotation
111
+
110
112
It is important to periodically rotate your keys. This is a simple three step
111
113
process. In this example, we will rotate only a signing key; but all key types
112
114
should be rotated.
113
115
114
116
First, generate the new keys (see jose documentation for more options):
115
117
116
118
$ sudo jose jwk gen -i '{"alg":"ES512"}' -o /var/db/tang/newsig.jwk
117
- $ sudo jose jwk gen -i '{"alg":"ECDH "}' -o /var/db/tang/newexc.jwk
119
+ $ sudo jose jwk gen -i '{"alg":"ECMR "}' -o /var/db/tang/newexc.jwk
118
120
119
121
Second, disable advertisement of the previous key:
120
122
121
- # sudo mv /var/db/tang/oldsig.jwk /var/db/tang/.oldsig.jwk
123
+ $ sudo mv /var/db/tang/oldsig.jwk /var/db/tang/.oldsig.jwk
122
124
123
125
Third, after some reasonable period of time you may delete the old keys. You
124
126
should only delete the old keys when you are sure that no client require them
0 commit comments