Remove github.com/google/trillian/crypto/keys/pem dependency

go.mod

@@ -11,7 +11,6 @@ require (
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/certificate-transparency-go v1.3.1
 	github.com/google/go-cmp v0.7.0
-	github.com/google/trillian v1.7.1
 	github.com/kylelemons/godebug v1.1.0
 	github.com/prometheus/client_golang v1.21.1
 	github.com/rivo/tview v0.0.0-20240625185742-b0a7293b8130
@@ -37,15 +36,11 @@ require (
 	cloud.google.com/go/iam v1.4.0 // indirect
 	cloud.google.com/go/longrunning v0.6.4 // indirect
 	cloud.google.com/go/monitoring v1.24.0 // indirect
-	cloud.google.com/go/trace v1.11.3 // indirect
-	contrib.go.opencensus.io/exporter/stackdriver v0.13.14 // indirect
 	github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.2 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.49.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.49.0 // indirect
-	github.com/aws/aws-sdk-go v1.51.8 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cncf/xds/go v0.0.0-20241223141626-cff3c89139a3 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
@@ -56,13 +51,11 @@ require (
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.5 // indirect
 	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
 	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
@@ -71,7 +64,6 @@ require (
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/prometheus/prometheus v0.51.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect

go.sum

@@ -618,8 +618,6 @@ cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoIS
 cloud.google.com/go/workflows v1.8.0/go.mod h1:ysGhmEajwZxGn1OhGOGKsTXc5PyxOc0vfKf5Af+to4M=
 cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT3ujaO/WwSA=
 cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
-contrib.go.opencensus.io/exporter/stackdriver v0.13.14 h1:zBakwHardp9Jcb8sQHcHpXy/0+JIb1M8KjigCJzx7+4=
-contrib.go.opencensus.io/exporter/stackdriver v0.13.14/go.mod h1:5pSSGY0Bhuk7waTHuDf4aQ8D2DrhgETRo9fy6k3Xlzc=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
@@ -648,15 +646,12 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
 github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4xei5aX110hRiI=
 github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
-github.com/aws/aws-sdk-go v1.51.8 h1:tD7gQq5XKuKdhA6UMEH26ZNQH0s+HbL95rzv/ACz5TQ=
-github.com/aws/aws-sdk-go v1.51.8/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -836,8 +831,6 @@ github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLe
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
-github.com/google/trillian v1.7.1 h1:+zX8jLM3524bAMPS+VxaDIDgsMv3/ty6DuLWerHXcek=
-github.com/google/trillian v1.7.1/go.mod h1:E1UMAHqpZCA8AQdrKdWmHmtUfSeiD0sDWD1cv00Xa+c=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -875,10 +868,6 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
-github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
@@ -949,8 +938,6 @@ github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/prometheus/prometheus v0.51.0 h1:aRdjTnmHLved29ILtdzZN2GNvOjWATtA/z+3fYuexOc=
-github.com/prometheus/prometheus v0.51.0/go.mod h1:yv4MwOn3yHMQ6MZGHPg/U7Fcyqf+rxqiZfSur6myVtc=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/tview v0.0.0-20240625185742-b0a7293b8130 h1:o1CYtoFOm6xJK3DvDAEG5wDJPLj+SoxUtUDFaQgt1iY=
 github.com/rivo/tview v0.0.0-20240625185742-b0a7293b8130/go.mod h1:02iFIz7K/A9jGCvrizLPvoqr4cEIx7q54RH5Qudkrss=
@@ -1720,10 +1707,7 @@ gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWD
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/scti/ctlog_test.go

@@ -14,19 +14,18 @@ import (
 	"strings"
 	"testing"
 
-	trillianpem "github.com/google/trillian/crypto/keys/pem"
 	"github.com/transparency-dev/static-ct/internal/x509util"
 	"github.com/transparency-dev/static-ct/storage"
 	"golang.org/x/mod/sumdb/note"
 )
 
 func TestNewLog(t *testing.T) {
 	ctx := context.Background()
-	ecdsaSigner, err := trillianpem.ReadPrivateKeyFile("../testdata/ct-http-server.privkey.pem", "dirk")
+	ecdsaSigner, err := loadPEMPrivateKey("../testdata/test_ct_server_ecdsa_private_key.pem")
 	if err != nil {
 		t.Fatalf("Can't open key: %v", err)
 	}
-	rsaSigner, err := loadPEMPrivateKey("../testdata/test_rsa_private_key.pem")
+	rsaSigner, err := loadPEMPrivateKey("../testdata/test_ct_server_rsa_private_key.pem")
 	if err != nil {
 		t.Fatalf("Failed to generate RSA key: %v", err)
 	}
@@ -102,7 +101,7 @@ func loadPEMPrivateKey(path string) (crypto.Signer, error) {
 	}
 
 	// Fix block type for testing keys.
-	block.Type = strings.ReplaceAll(block.Type, "TEST PRIVATE KEY", "PRIVATE KEY")
+	block.Type = strings.ReplaceAll(block.Type, "TESTING KEY", "PRIVATE KEY")
 
 	var privateKey any
 	switch block.Type {

internal/testdata/gen/gen.go

@@ -19,6 +19,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
@@ -83,9 +84,25 @@ func main() {
 		klog.Fatalf("Failed to save root CA certificate: %v", err)
 	}
 
+	// Generate CT server private keys (ECDSA, RSA).
+	ctServerECDSAPrivKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	if err != nil {
+		klog.Fatalf("Failed to generate CT server ECDSA private key: %v", err)
+	}
+	if err := saveECDSAPrivateKeyPEM(ctServerECDSAPrivKey, path.Join(*outputPath, "test_ct_server_ecdsa_private_key.pem")); err != nil {
+		klog.Fatalf("Failed to save CT server ECDSA private key: %v", err)
+	}
+
+	ctServerRSAPrivKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		klog.Fatalf("Failed to generate CT server RSA private key: %v", err)
+	}
+	if err := saveRSAPrivateKeyPEM(ctServerRSAPrivKey, path.Join(*outputPath, "test_ct_server_rsa_private_key.pem")); err != nil {
+		klog.Fatalf("Failed to save CT server RSA private key: %v", err)
+	}
+
 	genLeaves(rootCert, rootPrivKey, *notBefore)
 	genPreIssuerAndLeaves(rootCert, rootPrivKey, *notBefore)
-
 }
 
 // genLeaves generates a cert and a pre-cert.
@@ -320,6 +337,27 @@ func saveECDSAPrivateKeyPEM(key *ecdsa.PrivateKey, filename string) error {
 	return nil
 }
 
+func saveRSAPrivateKeyPEM(key *rsa.PrivateKey, filename string) error {
+	// Marshal the private key to PKCS1 ASN.1 DER.
+	derBytes := x509.MarshalPKCS1PrivateKey(key)
+
+	// No encryption.
+	block := &pem.Block{
+		Type:  "RSA TESTING KEY",
+		Bytes: derBytes,
+	}
+
+	// Encode the PEM block to memory.
+	pemData := pem.EncodeToMemory(block)
+
+	// Write the PEM data to the file with restrictive permissions.
+	if err := os.WriteFile(filename, pemData, 0600); err != nil {
+		return fmt.Errorf("failed to write PEM file: %w", err)
+	}
+
+	return nil
+}
+
 func saveCertificatePEM(cert *x509.Certificate, filename string) error {
 	pemData := pem.EncodeToMemory(&pem.Block{
 		Type:  "CERTIFICATE",

internal/testdata/test_ct_server_ecdsa_private_key.pem

@@ -0,0 +1,6 @@
+-----BEGIN EC TESTING KEY-----
+MIGkAgEBBDD11J61th77xuEvhMKiu+vJp9Tx9d+jPO4j/EKydlcDcfxtLfJAGrCU
+unydmuSw3kWgBwYFK4EEACKhZANiAAR4Iq5WWGH9mAsUMiAE04MXhNZNFutIXQVR
+YhVUHujOKxJT+Ggt6C4bPl40VVpYqxkU7SRT8JUGsan1bAqLJglBlc8mmMN1wJcx
+fgPV5kYIivdy+RC/sbUUFww+5IPVXaE=
+-----END EC TESTING KEY-----

internal/testdata/test_ct_server_rsa_private_key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA TESTING KEY-----
+MIIEowIBAAKCAQEAqml5zm+9BCdal068y5pCLDSekHIkc9lCsQRhhDC6H52FMPTi
+jyL2Nr71BaXDIHxSj27LcyE4YCxE6Lg5jGc3wAq3ZHe4HIP29Ed2pGUs2KXAm9qj
+EzgJzmu7/g5dVd4aEdSS4xtOTfLA3v8GW8qYKjSvFmZgLyIa8ptJMagycAbDJ9rC
+g1LYQp6GFrOUvQ42BGy7aD0KcVFAbNqzKZMMEdqx7dBew4G3azWhYLzRrV5dNXMm
+GsTYZkJc7QmqOdtfo5BTAujOiDKG6QVxeXcdMCqNupBjuTBUTYAIaCNHXOsb44ej
+oNlbJgIUZ4YS5u2wL6tZ3zQ3kz49kUwomM+7oQIDAQABAoIBAAyU3CdI5NEQm8Bg
+keahVWHgolVX9rIul/KBouEo3NEBPFMXPWk5I6mlPb9Z6UG11BL0EzrFON2RidE5
+wBafjJmV4PY0CD3jY1aj4RH1nf2XzT7kgeuPv1pEENLgGiArv/Z8NeUPwB9X/R6U
+Vb1DWaqCDcGPCOpp753k/PQuLsfKT9jsyQvIOegER/reylHzSSXGG0ZsGf0WU2iZ
+qZji8o2SxuqpC17hUS1wDd1X/cli3HAW+2ySfZTPls8mma54rIrE0IAYaeRhi/Dv
++l4o7eEuNODytl2fDb4MLKW3oWSkh8NYlfJAHcD6yx8q6NZc2njC1AM//EzsCxx/
+a2hGlh0CgYEA0D3m6ZM8Cu8SkzljssfqRYOhGacORoaatsnanp27Q/UkP4RCSqlR
+Dhl14kVA2Cop3YlicVyy5ZlC797ei641R5HdOdZVDdUPHWvjWFDCQhctA/GSBkA7
+fdh2whRyVmE5nDGHUDXiuSMtOQ436a9EIYr0tpfC52/mdGwh8APxZS0CgYEA0X6L
+7J/4zVKDjLnwAfIFo9hSoOk1sTDN0UGOvIJTblW9KZDPd4Hd3/kcglou+22X18ek
+tg2wIYdyDcJ5m8QoZ+SM2EUA0IRTps0fB/YEoDkI7Y6fVaD8UFR1RZMFSL5A5vlV
+b13JNymfsS3E528VDZX3koZvJULPNe0lmvwMYMUCgYEAl4SC8G794CLFzDOUtC+7
+6Op2nJitzWkBR4ClvoWcDT1gK4sLRRHfdTfXS1UCcoZzQctFwqAlVuPmDWyHVvDh
+uXqLkhq+djsRLWIj4E2amsYMLfNmQYAZCV8oQdzouKszZM+w2g7rMbRDomETE8g/
+9XwKxJS17vm/n/RR2Ta1PN0CgYBQ4UB4TJKsAo1TSX4F4kCXLy9HfIIENMlhXqQS
+12YKlQOBBq1ygCr/C5gcI2E8JOWYozVOLB6x8y7vbQOyRZsr8SsHXCyiVFRPc6Xl
+VvAWQ67UuFl/n7WJ9fGIuOgzW3CHO//mDRlgOKu0pez9RP+lzR5V7Zz/j7mcIkCA
+g4rr2QKBgDOVTBcirRVN582mYVKgvNucRgnVhROfBlCV1Ue9hNscShDCy+nfpibr
+0SvVQs4RUD9nEDVM/GjRaQbzwppnUF1lPTcklnVo4RsGxQ74xKuY7/wpBO0JaXLN
+Zx+SjKjMsP217x11dPFo9h70Mluep9EJYYkmNd61Xc0LIfcR1jZH
+-----END RSA TESTING KEY-----