Support Cosign Image signature verification with KMS #360
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
10 tasks
Xynnn007
force-pushed
the
feat-cdh-kms-pubkey
branch
4 times, most recently
from
2106530 to
2a62292
Compare
Xynnn007
force-pushed
the
feat-cdh-kms-pubkey
branch
2 times, most recently
from
27a7db1 to
153e96a
Compare
Xynnn007
requested review from
sameo,
jiangliu,
arronwy,
lumjjb and
jialez0
as code owners
Xynnn007
commented
Nov 16, 2023
| @@ -93,6 +93,9 @@ encryption = ["ocicrypt-rs/block-cipher"] | |||
| encryption-ring = ["ocicrypt-rs/block-cipher-ring", "encryption"] | |||
| encryption-openssl = ["ocicrypt-rs/block-cipher-openssl", "encryption"] | |||
|
|
|||
| # Get needed image verification keys from Confidential Data Hub | |||
| confidential-data-hub = ["dep:ttrpc", "dep:protobuf"] | |||
There was a problem hiding this comment.
Let me add tests for this feature in later PRs.
Xynnn007
force-pushed
the
feat-cdh-kms-pubkey
branch
from
153e96a to
4415e7a
Compare
1570005763
approved these changes
Dec 11, 2023
Xynnn007
force-pushed
the
feat-cdh-kms-pubkey
branch
2 times, most recently
from
6bf1766 to
2faab59
Compare
Also impl PubkeyProvider for KBS Signed-off-by: Xynnn007 <[email protected]>
Signed-off-by: Xynnn007 <[email protected]>
Signed-off-by: Xynnn007 <[email protected]>
Confidential Data Hub now supports to get public key from the different KMS services. The public keys are for signature verification. As currently not all non-attestation functionalities of AA are moved to CDH. So `confidential-data-hub` is a workaround feature to make the code compilable without breaking current logic. After confidential-containers#412 is resolved, we should abandon the `confidential-data-hub` feature. Signed-off-by: Xynnn007 <[email protected]>
Signed-off-by: Xynnn007 <[email protected]>
Xynnn007
force-pushed
the
feat-cdh-kms-pubkey
branch
from
2faab59 to
d041954
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR mainly add the support to verify image signature with public keys provided by KMS.
image-rscan get cosign verification public key from CDH when bothcosignandconfidential-data-hubfeature are enabled