Let cryptogen set attributes in certificates - #5417
Open
johannww wants to merge 1 commit into
Open
Conversation
This extends cryptogen functionality and allows testing ABAC chaincodes with cryptogen credentials. All defined non-admin users earn all attributes. Signed-off-by: Johann Westphall <johannwestphall@gmail.com>
There was a problem hiding this comment.
Pull request overview
This PR extends cryptogen so it can embed user-defined attributes into generated X.509 enrollment certificates (as a custom extension), enabling ABAC chaincode testing without needing Fabric CA.
Changes:
- Adds
Attrs map[string]stringto cryptogen YAML structures (NodeSpec,UsersSpec) and propagates them through MSP generation. - Updates CA certificate signing to optionally serialize attributes into a custom X.509 extension (OID
1.2.3.4.5.6.7.8.1). - Updates sample config and unit tests to reflect the new signing API and validate extension serialization.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
cmd/cryptogen/main.go |
Adds YAML support for attributes and forwards them into MSP generation for users. |
internal/cryptogen/msp/msp.go |
Extends GenerateLocalMSP to accept and pass attributes into signing cert generation (TLS remains unaffected). |
internal/cryptogen/msp/msp_test.go |
Updates test calls for the new GenerateLocalMSP signature. |
internal/cryptogen/ca/ca.go |
Adds attribute extension serialization and updates SignCertificate to embed it. |
internal/cryptogen/ca/ca_test.go |
Adds assertions verifying the attribute extension presence and JSON payload. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+128
to
+131
| buf, err := json.Marshal(attrExtension{Attrs: attrs}) | ||
| if err != nil { | ||
| return errors.Wrap(err, "Failed to marshal attributes") | ||
| } |
Comment on lines
67
to
69
| // generate local MSP for nodeType=PEER | ||
| err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA, msp.PEER, nodeOUs, ECDSA) | ||
| err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA, msp.PEER, nodeOUs, ECDSA, nil) | ||
| require.NoError(t, err, "Failed to generate local MSP") |
Comment on lines
141
to
+143
| // SignCertificate creates a signed certificate based on a built-in template | ||
| // and saves it in baseDir/name | ||
| // and saves it in baseDir/name. attrs, if non-nil, are embedded as a custom | ||
| // X.509 extension (OID 1.2.3.4.5.6.7.8.1) using the same format as fabric-ca. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This extends cryptogen functionality and allows testing ABAC chaincodes with cryptogen credentials. All defined non-admin users earn all attributes.
Type of change
Description
Extends cryptogen to embed user-defined attributes into X.509 certificates as a custom extension (OID 1.2.3.4.5.6.7.8.1), using the same JSON format as fabric-ca. This enables ABAC chaincode testing with cryptogen-generated credentials without requiring a Fabric CA.
This is useful for fast testing environments, without the requirement to boot a CA up and make requests user by user.
Changes:
Additional details
Unit tests were added and some generations were run and tested in a kubernetes deploy.
Release Note
Users' cryptogen-generated certs will have the attribute
abac.creatorset to true by default.