Is there a way to passphrase protect my koji cert?

[Bruno Wolff III]

While replacing my koji cert yesterday I was interested in adding a
passphrase to slow down exploitation if my home desktop got compromised.
I've look through some of the documentation for maintainers and I haven't
seen any instructions on how to protect it with a passphrase. Is this
possible? (In a way compatible with fedpkg and koji command line.)

[Nalin Dahyabhai]

On Tue, Feb 14, 2012 at 09:33:31AM -0600, Bruno Wolff III wrote:
>  While replacing my koji cert yesterday I was interested in adding a
>  passphrase to slow down exploitation if my home desktop got compromised.
>  I've look through some of the documentation for maintainers and I haven't
>  seen any instructions on how to protect it with a passphrase. Is this
>  possible? (In a way compatible with fedpkg and koji command line.) 
At least partially.

Assuming you have your certificate and private key in ~/.fedora.cert:

    awk '/BEGIN PRIVATE/,/END PRIVATE/' ~/.fedora.cert | \
	openssl pkcs8 -topk8 >> ~/.fedora.cert

This selects the portion that is just the private key, pipes it through
OpenSSL to encrypt it and format it according to PKCS#8, and then
appends the result to the existing file.  Then, you'd remove the
unencrypted copy of your private key:

    sed -i '/BEGIN PRIVATE/,/END PRIVATE/d' ~/.fedora.cert

When I subsequently ran a koji administrative command, I got to enter my
passphrase a few times (and for some reason, while 'pkcs8' will accept
something fewer than four characters long for a new passphrase, that
requirement is also enforced -- somewhere -- when you run koji), and got
the expected denial.

I doubt it's going to be officially supported, but within limits it
seems to more or less work.  If it breaks, though, you'll need to undo
it:
    awk '/BEGIN ENCRYPTED/,/END ENCRYPTED/' ~/.fedora.cert | \
	openssl pkcs8 >> ~/.fedora.cert
    sed -i '/BEGIN ENCRYPTED/,/END ENCRYPTED/d' ~/.fedora.cert

HTH,

Nalin

[Bruno Wolff III]

On Tue, Feb 14, 2012 at 12:38:29 -0500,
  Nalin Dahyabhai <nalin(a)redhat.com&gt; wrote:
>  
>  When I subsequently ran a koji administrative command, I got to enter my
>  passphrase a few times (and for some reason, while 'pkcs8' will accept
>  something fewer than four characters long for a new passphrase, that
>  requirement is also enforced -- somewhere -- when you run koji), and got
>  the expected denial. 
Thanks. I'll give it a try and see how well it works.