@eudiplo/cli 9.1.0-main.c121f07 → 9.1.0-main.cd87b41

package/templates/schemas/KeyChainDefaultsConfigFile.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "./KeyChainDefaultsConfigFile.schema.json",
+  "title": "KeyChainDefaultsConfigFile",
+  "description": "Configuration file identified by its $schema URL.",
+  "oneOf": [
+    {
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v1/KeyChainDefaultsConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ]
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "type": "object",
+          "properties": {
+            "access": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+        }
+      },
+      "required": [
+        "$schema",
+        "metadata",
+        "spec"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "access": {
+          "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "additionalProperties": false,
+      "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+    }
+  ]
+}

package/templates/schemas/KeyChainImportDto.schema.json

@@ -64,10 +64,19 @@
         "attestation",
         "trustList",
         "statusList",
+        "federation",
         "encrypt"
       ],
       "description": "Key usage category for the imported key chain."
     },
+    "type": {
+      "description": "Key chain type. `standalone`: `key` is the signing key and `crt` its chain, leaf first. `internalChain`: `key` is a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted); the import generates a new signing key with a certificate issued by it. Without `type`, `key` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA.",
+      "type": "string",
+      "enum": [
+        "standalone",
+        "internalChain"
+      ]
+    },
     "crt": {
       "description": "Optional certificate chain values in PEM or base64 DER.",
       "type": "array",

package/templates/schemas/KmsConfigDto.schema.json

@@ -64,6 +64,37 @@
                     "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
                   }
                 ]
+              },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
               }
             },
             "required": [
@@ -115,6 +146,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "vaultUrl": {
                 "anyOf": [
                   {
@@ -199,6 +261,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "region": {
                 "anyOf": [
                   {
@@ -298,6 +391,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "library": {
                 "anyOf": [
                   {
@@ -400,6 +524,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "baseUrl": {
                 "anyOf": [
                   {
@@ -713,6 +868,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "baseUrl": {
                 "anyOf": [
                   {