signer: Remove keyid arg from HSMSigner.import_

Intent is to make GCP and HSM imports as similar as possible.

Author: jku

securesystemslib/signer/_hsm_signer.py

@@ -11,6 +11,7 @@
 
 from securesystemslib import KEY_TYPE_ECDSA
 from securesystemslib.exceptions import UnsupportedLibraryError
+from securesystemslib.keys import _get_keyid
 from securesystemslib.signer._key import Key, SSlibKey
 from securesystemslib.signer._signature import Signature
 from securesystemslib.signer._signer import SecretsHandler, Signer
@@ -191,17 +192,14 @@ def _find_key_values(
         return ECDomainParameters.load(bytes(params)), bytes(point)
 
     @classmethod
-    def import_(
-        cls, sslib_keyid: str, hsm_keyid: Optional[int] = None
-    ) -> Tuple[str, SSlibKey]:
+    def import_(cls, hsm_keyid: Optional[int] = None) -> Tuple[str, SSlibKey]:
         """Import public key and signer details from HSM.
 
         Returns a private key URI (for Signer.from_priv_key_uri()) and a public
         key. import_() should be called once and the returned URI and public
         key should be stored for later use.
 
         Arguments:
-            sslib_keyid: Key identifier that is unique within the metadata it is used in.
             hsm_keyid: Key identifier on the token. Default is 2 (meaning PIV key slot 9c).
 
         Raises:
@@ -244,12 +242,11 @@ def import_(
             .decode()
         )
 
-        key = SSlibKey(
-            sslib_keyid,
-            KEY_TYPE_ECDSA,
-            _SCHEME_FOR_CURVE[curve],
-            {"public": public_pem},
-        )
+        keyval = {"public": public_pem}
+        scheme = _SCHEME_FOR_CURVE[curve]
+        keyid = _get_keyid(KEY_TYPE_ECDSA, scheme, keyval)
+        key = SSlibKey(keyid, KEY_TYPE_ECDSA, scheme, keyval)
+
         return "hsm:", key
 
     @classmethod

tests/test_hsm_signer.py

@@ -51,7 +51,6 @@ class TestHSM(unittest.TestCase):
     See .github/workflows/hsm.yml for how this can be done on Linux, macOS and Windows.
     """
 
-    sslib_keyid = "a" * 64  # Mock SSlibKey conform sha256 hex digest keyid
     hsm_keyid = 1
     hsm_keyid_default = 2
     hsm_user_pin = "123456"
@@ -139,7 +138,7 @@ def test_hsm(self):
         """Test HSM key export and signing."""
 
         for hsm_keyid in [self.hsm_keyid, self.hsm_keyid_default]:
-            _, key = HSMSigner.import_(self.sslib_keyid, hsm_keyid)
+            _, key = HSMSigner.import_(hsm_keyid)
             signer = HSMSigner(hsm_keyid, key, lambda sec: self.hsm_user_pin)
             sig = signer.sign(b"DATA")
             key.verify_signature(sig, b"DATA")
@@ -150,7 +149,7 @@ def test_hsm(self):
     def test_hsm_uri(self):
         """Test HSM default key export and signing from URI."""
 
-        uri, key = HSMSigner.import_(self.sslib_keyid, self.hsm_keyid_default)
+        uri, key = HSMSigner.import_(self.hsm_keyid_default)
         signer = Signer.from_priv_key_uri(
             uri, key, lambda sec: self.hsm_user_pin
         )