Skip to content

Support Cosign Image signature verification with KMS #360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Xynnn007 wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

Support Cosign Image signature verification with KMS #360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4bc8c2a
cdh/kms: add PubkeyProvider API for KMS
Xynnn007 Sep 17, 2023
8bc0922
cdh/hub: add get_public_key api for hub
Xynnn007 Sep 17, 2023
d4f44a0
cdh/bin: add GetPublicKey ttrpc service api
Xynnn007 Sep 17, 2023
c39c29d
image-rs: get public key from CDH when verifying cosign image signatures
Xynnn007 Dec 15, 2023
d041954
cdh/kms: add aliyun KMS support for GetPublicKey
Xynnn007 Sep 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions confidential-data-hub/hub/protos/api.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,14 @@ message SecureMountResponse {
string mount_path = 1;
}

message GetPublicKeyRequest {
string KeyId = 1;
}

message GetPublicKeyResponse {
bytes PublicKeyPem = 1;
}

service SealedSecretService {
rpc UnsealSecret(UnsealSecretInput) returns (UnsealSecretOutput) {};
}
Expand All @@ -54,3 +62,7 @@ service KeyProviderService {
service SecureMountService {
rpc SecureMount(SecureMountRequest) returns (SecureMountResponse) {};
}

service GetPublicKeyService {
rpc GetPublicKey(GetPublicKeyRequest) returns (GetPublicKeyResponse) {};
}
3 changes: 3 additions & 0 deletions confidential-data-hub/hub/src/api.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,7 @@ pub trait DataHub {
async fn get_resource(&self, uri: String) -> Result<Vec<u8>>;

async fn secure_mount(&self, storage: Storage) -> Result<String>;

/// Get the public key due to the `key_id`.
async fn get_public_key(&self, key_id: &str) -> Result<Vec<u8>>;
}
Loading