add key id for autograph

normandy/recipes/signing.py

@@ -69,7 +69,10 @@ class Autographer(object):
             # base64 works in bytes. requests work in UTF-8.
             # Convert to bytes, and then back.
             encoded_implementation = base64.b64encode(item).decode("utf8")
-            signing_request.append({"input": encoded_implementation})
+            request = {"input": encoded_implementation}
+            if settings.AUTOGRAPH_KEYID:
+                request["keyid"] = settings.AUTOGRAPH_KEYID
+            signing_request.append(request)
 
         res = self.session.post(url, json=signing_request)
         res.raise_for_status()

normandy/recipes/tests/test_signing.py

@@ -63,6 +63,7 @@ class TestAutographer(object):
         settings.AUTOGRAPH_URL = "https://autograph.example.com"
         settings.AUTOGRAPH_HAWK_ID = "hawk id"
         settings.AUTOGRAPH_HAWK_SECRET_KEY = "hawk secret key"
+        settings.AUTOGRAPH_KEYID = "hello autograph"
 
         autographer = signing.Autographer()
         autographer.session = MagicMock()
@@ -120,8 +121,16 @@ class TestAutographer(object):
             [
                 url,
                 [
-                    {"template": "content-signature", "input": foo_base64},
-                    {"template": "content-signature", "input": bar_base64},
+                    {
+                        "template": "content-signature",
+                        "input": foo_base64,
+                        "keyid": "hello autograph",
+                    },
+                    {
+                        "template": "content-signature",
+                        "input": bar_base64,
+                        "keyid": "hello autograph",
+                    },
                 ],
             ]
         )

normandy/settings.py

@@ -371,6 +371,7 @@ class Base(Core, CORS, OIDC, Metrics):
     AUTOGRAPH_HAWK_SECRET_KEY = values.Value()
     AUTOGRAPH_SIGNATURE_MAX_AGE = values.IntegerValue(60 * 60 * 24 * 7)
     AUTOGRAPH_X5U_CACHE_BUST = values.Value(None)
+    AUTOGRAPH_KEYID = values.Value(None)
 
     # Remote Settings connection configuration
     REMOTE_SETTINGS_URL = values.Value()
@@ -547,6 +548,7 @@ class Test(InsecureAuthentication, Base):
     AUTOGRAPH_URL = None
     AUTOGRAPH_HAWK_ID = None
     AUTOGRAPH_HAWK_SECRET_KEY = None
+    AUTOGRAPH_KEYID = None
     OIDC_USER_ENDPOINT = "https://auth.example.com/userinfo"