keys

README

Download the GCB keys

This is a temporary solution. We should try to automate key verification on pre-submits. We should pin the CA certificate when downloading them, maybe using curl and the googlecloudapi REST endpoint. See discussion in #181.

For now, you can verify the keys we downloaded by downloading them yourself.

cd verifiers/internal/gcb/keys
gcloud compute regions list | grep -v NAME | xargs -0 | cut -d ' ' -f1 | xargs -i gcloud kms keys versions get-public-key 1 --location {} --keyring attestor --key builtByGCB --project verified-builder --output-file {}.key

Documentation

Index

• Constants
• type GlobalPAEKey
  • func NewGlobalPAEKey() (*GlobalPAEKey, error)
  • func (v *GlobalPAEKey) KeyID() (string, error)
  • func (v *GlobalPAEKey) Public() crypto.PublicKey
  • func (v *GlobalPAEKey) Verify(data, sig []byte) error
  • func (v *GlobalPAEKey) VerifyPAESignature(envelope *dsselib.Envelope) error
• type PublicKey
  • func NewPublicKey(region string) (*PublicKey, error)
  • func (p *PublicKey) VerifySignature(digest [32]byte, sig []byte) error

Constants

const GlobalPAEKeyID = "projects/verified-builder/locations/global/keyRings/attestor/cryptoKeys/provenanceSigner/cryptoKeyVersions/1"

const GlobalPAEPublicKeyName = "global-pae"

Types

type GlobalPAEKey

type GlobalPAEKey struct {
	Verifier *dsselib.EnvelopeVerifier
	// contains filtered or unexported fields
}

func NewGlobalPAEKey

func NewGlobalPAEKey() (*GlobalPAEKey, error)

func (*GlobalPAEKey) KeyID

func (v *GlobalPAEKey) KeyID() (string, error)

KeyID implements dsse.Verifier.KeyID.

func (*GlobalPAEKey) Public

func (v *GlobalPAEKey) Public() crypto.PublicKey

Public implements dsse.Verifier.Public.

func (*GlobalPAEKey) Verify

func (v *GlobalPAEKey) Verify(data, sig []byte) error

Verify implements dsse.Verifier.Verify. It verifies a signature formatted in DSSE-conformant PAE.

func (*GlobalPAEKey) VerifyPAESignature

func (v *GlobalPAEKey) VerifyPAESignature(envelope *dsselib.Envelope) error

type PublicKey

type PublicKey struct {
	// contains filtered or unexported fields
}

func NewPublicKey

func NewPublicKey(region string) (*PublicKey, error)

func (*PublicKey) VerifySignature

func (p *PublicKey) VerifySignature(digest [32]byte, sig []byte) error