GenerateKey task

This is a signing task that generates a new key on a signing worker and stores it for later use.

The task_data for this task may contain the following keys:

purpose (required): the purpose of the key to generate: uefi, openpgp, or openpgp-repository.
storage (optional, defaults to nacl): the kind of storage where the new key should be stored. Options are:
- nacl: stored directly in the signing database, encrypted using the DEBUSINE_SIGNING_PRIVATE_KEYS Django setting on the signing worker; always available
- aws-kms: stored in the AWS Key Management Service, if available; only supported for openpgp-repository keys
description (required): a text string with a human-readable description of the new key’s intended purpose.
scope (optional): the name of the scope for which this key is being generated. Some backends may record this alongside the key.
workspace (optional): the name of the workspace for which this key is being generated. Some backends may record this alongside the key.

The output will be provided as a debusine:signing-key asset. You can find the output asset with the debusine client:

$ debusine list-assets --work-request $work_request_id

Todo

This will need additional parameters once we start supporting HSMs.