From 0d83dc3ec16ac8df1c10e5942d5741cbee01593e Mon Sep 17 00:00:00 2001 From: mrwulf Date: Fri, 7 Aug 2026 17:55:46 +0200 Subject: [PATCH] web: publish the SLH-DSA verification key the same way as the Ed25519 one /v1/log-slhdsa-public-key, mirroring /v1/log-public-key exactly: same route shape, same two-independent-locations TOFU rule (site copy + git mirror copy). The operator decision of 2026-08-06 required the SLH-DSA public key published like the Ed25519 key; the mirror half shipped with the tree-19 publication, this is the site half. Suite 152/0/0. Co-Authored-By: Claude Opus 4.8 --- provider/src/pacta_provider/web.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/provider/src/pacta_provider/web.py b/provider/src/pacta_provider/web.py index 301f241..63728a6 100644 --- a/provider/src/pacta_provider/web.py +++ b/provider/src/pacta_provider/web.py @@ -65,11 +65,16 @@ def make_handler(log: TransparencyLog, base_path: str, docs_html: str, paper_pdf self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) - elif route == "/log-public-key": + elif route in ("/log-public-key", "/log-slhdsa-public-key"): # TOFU mitigation depends on the key being published in two # independent locations; this is the site's copy (the mirror # carries the other). Serving only a fingerprint would not do. - key_path = Path(log.log_dir) / "provider.ed25519.pub" + # The SLH-DSA key (additive post-quantum signature, 2026-08) + # is published THE SAME WAY as the Ed25519 one — same route + # shape, same two-location rule. + fname = ("provider.ed25519.pub" if route == "/log-public-key" + else "provider.slhdsa.pub") + key_path = Path(log.log_dir) / fname if not key_path.is_file(): self._send(404, {"error": "log public key not present in this log directory"}) return @@ -152,6 +157,7 @@ def make_handler(log: TransparencyLog, base_path: str, docs_html: str, paper_pdf f"{base}/docs", f"{base}/paper", f"{base}/log-public-key", + f"{base}/log-slhdsa-public-key", f"{base}/healthz", f"{base}/{API_VERSION}/metadata", f"{base}/{API_VERSION}/sth",