sign

Documentation

Index

• func CertManagerManifests(ctx context.Context, key GCPKMSKey, path string, releaseVersion string) error
• func HelmChart(ctx context.Context, key GCPKMSKey, chartPath string) ([]byte, error)
• type GCPKMSKey
  • func NewGCPKMSKey(raw string) (GCPKMSKey, error)
  • func (g GCPKMSKey) CosignFormat() string
  • func (g GCPKMSKey) GCPFormat() string
  • func (g GCPKMSKey) String() string
• type PGPArmoredBlock
  • func BootstrapPGPFromGCP(ctx context.Context, key GCPKMSKey) (PGPArmoredBlock, error)

Functions

func CertManagerManifests

func CertManagerManifests(ctx context.Context, key GCPKMSKey, path string, releaseVersion string) error

CertManagerManifests takes a path to a cert-manager-manifests.tar.gz file, loads it into memory and signs anything inside the archive which is signable; currently, the helm chart located at "deploy/chart/cert-manager.tgz" is signed, and a signature "deploy/chart/cert-manager.tgz.prov" will be added. The cert-manifests.tar.gz file is changed in-place.

func HelmChart

func HelmChart(ctx context.Context, key GCPKMSKey, chartPath string) ([]byte, error)

HelmChart signs a given packaged helm chart (usually a .tgz file) using the given KMS key, returning the human-readable signature bytes.

Types

type GCPKMSKey

type GCPKMSKey struct {
	// contains filtered or unexported fields
}

GCPKMSKey holds a GCP KMS key, easily serializable to either GCP format ('cryptoKeyVersions') or cosign format ('versions')

func NewGCPKMSKey

func NewGCPKMSKey(raw string) (GCPKMSKey, error)

NewGCPKMSKey parses and validates an input KMS key. The accepted format is that provided when copying the resource name in the GCP console. The format provided by GCP is distinct from the format required by cosign; notably GCP uses "cryptoKeyVersions" and cosign requires "versions".

func (GCPKMSKey) CosignFormat

func (g GCPKMSKey) CosignFormat() string

CosignFormat returns the key in the correct format for cosign, which uses "versions" instead of "cryptoKeyVersions". Also prepends the gcpkms scheme

func (GCPKMSKey) GCPFormat

func (g GCPKMSKey) GCPFormat() string

GCPFormat returns the key verbatim, which will be the format required for GCP actions

func (GCPKMSKey) String

func (g GCPKMSKey) String() string

String returns the key in GCP format

type PGPArmoredBlock

type PGPArmoredBlock string

PGPArmoredBlock is an ASCII-armored PGP key block

func BootstrapPGPFromGCP

func BootstrapPGPFromGCP(ctx context.Context, key GCPKMSKey) (PGPArmoredBlock, error)

BootstrapPGPFromGCP creates a new PGP public key with a hardcoded cert-manager identity, signed using a named GCP KMS key. The KMS key can then be used for code signing, and the public key distributed for verification purposes.