core: explicit root keys for identity

Replace threshold on identities with a roles dictionary, where the only
currently supported role is "root". Keys in the root role are eligible
for identity document updates.

This allows users to restrict identity edits to keys on secure storage,
while still permitting signatures from weaker protected keys for other
purposes.

Signed-off-by: Kim Altintop <kim@eagain.io>

2 files changed, 12 insertions, 7 deletions

diff --git a/src/cmd/id.rs b/src/cmd/id.rs
index 57e79b0..9f1de7e 100644
--- a/src/cmd/id.rs
+++ b/src/cmd/id.rs
@@ -3,7 +3,6 @@
 
 use std::{
     collections::BTreeSet,
-    num::NonZeroUsize,
     path::PathBuf,
 };
 
@@ -134,7 +133,8 @@ pub fn identity_ref(id: Either<&IdentityId, &git2::Config>) -> cmd::Result<Refna
 #[derive(serde::Serialize, serde::Deserialize)]
 struct Editable {
     keys: metadata::KeySet<'static>,
-    threshold: NonZeroUsize,
+    #[serde(flatten)]
+    roles: metadata::identity::Roles,
     mirrors: BTreeSet<Url>,
     expires: Option<metadata::DateTime>,
     custom: metadata::Custom,
@@ -144,7 +144,7 @@ impl From<metadata::Identity> for Editable {
     fn from(
         metadata::Identity {
             keys,
-            threshold,
+            roles,
             mirrors,
             expires,
             custom,
@@ -153,7 +153,7 @@ impl From<metadata::Identity> for Editable {
     ) -> Self {
         Self {
             keys,
-            threshold,
+            roles,
             mirrors,
             expires,
             custom,
@@ -167,19 +167,23 @@ impl TryFrom<Editable> for metadata::Identity {
     fn try_from(
         Editable {
             keys,
-            threshold,
+            roles,
             mirrors,
             expires,
             custom,
         }: Editable,
     ) -> Result<Self, Self::Error> {
         ensure!(!keys.is_empty(), "keys cannot be empty");
+        ensure!(
+            !roles.is_threshold(),
+            "flat threshold is deprecated, please specify the root keys explicity"
+        );
 
         Ok(Self {
             fmt_version: Default::default(),
             prev: None,
             keys,
-            threshold,
+            roles,
             mirrors,
             expires,
             custom,
diff --git a/src/cmd/id/init.rs b/src/cmd/id/init.rs
index 35d3bb8..f481f48 100644
--- a/src/cmd/id/init.rs
+++ b/src/cmd/id/init.rs
@@ -145,13 +145,14 @@ pub fn init(args: Init) -> cmd::Result<Output> {
         .map(metadata::Key::from)
         .chain(args.public)
         .collect::<KeySet>();
+    let roles = metadata::identity::Roles::root(keys.keys().cloned().collect(), threshold);
 
     let meta = {
         let id = metadata::Identity {
             fmt_version: Default::default(),
             prev: None,
             keys,
-            threshold,
+            roles,
             mirrors: args.mirrors.into_iter().collect(),
             expires: args.expires,
             custom,