Autograph

Autograph is a cryptographic signature service that implements Content-Signature, XPI Signing for Firefox web extensions, MAR Signing for Firefox updates, APK Signing for Android, GPG2 and RSA.

Why is it called "autograph"? Because it's a service to sign stuff.

Installation

Use Docker whenever possible. The golang version on your machine is likely not the corect version for autograph.

Using Docker

docker pull mozilla/autograph && docker run mozilla/autograph

This will download the latest build of autograph from DockerHub and run it with its dev configuration.

Local Development with Docker

(This process will start a number of gpg-agent processes on your host machine, then does a killall gpg-agent to clean up.)

After making any changes, please test locally by:

make build             # updates local docker images
make integration-test  # must pass
docker compose up      # runs unit tests in container, must pass

Note: you must monitor the output of docker to detect when the unit tests have completed. Otherwise, it will run forever with heartbeat messages. The following pipeline is useful (and available in the Makefile as target test-in-docker):

docker compose up 2>&1 | tee compose.log \
    | (grep --silent "autograph-unit-test exited with code" && docker compose down; \
       grep "autograph-unit-test" compose.log)

As of 2023-06-26, only the integration tests will pass on Circle CI. See Issue 853 for details.

Using go get

Do Not Use unless you are an experienced golang developer.

If you don't yet have a GOPATH, export one:

$ export GOPATH=$HOME/go
$ mkdir $GOPATH

Install ltdl:

• on Ubuntu: ltdl-dev
• on RHEL/Fedora/Arch: libtool-ltdl-devel
• on MacOS: libtool (NB: this might require brew unlink libtool && brew link libtool)

Then download and build autograph:

$ go get github.com/mozilla-services/autograph

The resulting binary will be placed in $GOPATH/bin/autograph. To run autograph with the example conf, do:

$ cd $GOPATH/src/github.com/mozilla-services/autograph
$ $GOPATH/bin/autograph -c autograph.yaml

Example clients are in the tools directory. You can install the Go one like this:

$ go get github.com/mozilla-services/autograph/tools/autograph-client
$ $GOPATH/bin/autograph-client -u alice -p fs5wgcer9qj819kfptdlp8gm227ewxnzvsuj9ztycsx08hfhzu -t http://localhost:8000/sign/data -r '[{"input": "Y2FyaWJvdW1hdXJpY2UK"}]'
2016/08/23 17:25:55 signature 0 pass

Documentation

• Architecture
• Configuration
• Endpoints
• HSM Support

Signers

• APK
• Content-Signature PKI
• Content-Signature protocol
• GPG
• MAR
• RSA
• XPI Signing protocol

Signing

Autograph exposes a REST API that services can query to request signature of their data. Autograph knows which key should be used to sign the data of a service based on the service's authentication token. Access control and rate limiting are performed at that layer as well.