azure

README

Azure KMS

In order to use Azure KMS with sigstore project you should setup the azure first, the key creation will be handled in sigstore, however the vault and any needed permission will not and those things need to be configured.

What I need?

• Create a Resource Group
• In this Resource Group create the Azure KMS
• Configure any custom permission

After that you can use the created vault to generate the key, sign and verify.

For more information check the official Azure Docs: https://azure.microsoft.com/en-us/services/key-vault/

Documentation

Index

• Constants
• func ValidReference(ref string) error
• type SignerVerifier
  • func LoadSignerVerifier(defaultCtx context.Context, referenceStr string, hashFunc crypto.Hash) (*SignerVerifier, error)
  • func (a *SignerVerifier) CreateKey(ctx context.Context, algorithm string) (crypto.PublicKey, error)
  • func (a *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error)
  • func (*SignerVerifier) DefaultAlgorithm() string
  • func (a *SignerVerifier) PublicKey(_ ...signature.PublicKeyOption) (crypto.PublicKey, error)
  • func (a *SignerVerifier) Sign(ctx context.Context, payload []byte) ([]byte, []byte, error)
  • func (a *SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error)
  • func (*SignerVerifier) SupportedAlgorithms() []string
  • func (a *SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signature.VerifyOption) error

Constants

const (
	ReferenceScheme = "azurekms://"
	CacheKey        = "azure_vault_signer"
)

const (
	Algorithm_ES256 = "ES256"
)

Functions

func ValidReference

func ValidReference(ref string) error

Types

type SignerVerifier

type SignerVerifier struct {
	// contains filtered or unexported fields
}

func LoadSignerVerifier

func LoadSignerVerifier(defaultCtx context.Context, referenceStr string, hashFunc crypto.Hash) (*SignerVerifier, error)

LoadSignerVerifier generates signatures using the specified key object in GCP KMS and hash algorithm.

It also can verify signatures locally using the public key. hashFunc must not be crypto.Hash(0).

func (*SignerVerifier) CreateKey

func (a *SignerVerifier) CreateKey(ctx context.Context, algorithm string) (crypto.PublicKey, error)

CreateKey attempts to create a new key in Vault with the specified algorithm.

func (*SignerVerifier) CryptoSigner

func (a *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error)

func (*SignerVerifier) DefaultAlgorithm

func (*SignerVerifier) DefaultAlgorithm() string

func (*SignerVerifier) PublicKey

func (a *SignerVerifier) PublicKey(_ ...signature.PublicKeyOption) (crypto.PublicKey, error)

PublicKey returns the public key that can be used to verify signatures created by this signer. All options provided in arguments to this method are ignored.

func (*SignerVerifier) Sign

func (a *SignerVerifier) Sign(ctx context.Context, payload []byte) ([]byte, []byte, error)

THIS WILL BE REMOVED ONCE ALL SIGSTORE PROJECTS NO LONGER USE IT

func (*SignerVerifier) SignMessage

func (a *SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error)

SignMessage signs the provided message using GCP KMS. If the message is provided, this method will compute the digest according to the hash function specified when the Signer was created.

SignMessage recognizes the following Options listed in order of preference:

- WithContext()

- WithDigest()

- WithCryptoSignerOpts()

All other options are ignored if specified.

func (*SignerVerifier) SupportedAlgorithms

func (*SignerVerifier) SupportedAlgorithms() []string

func (*SignerVerifier) VerifySignature

func (a *SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signature.VerifyOption) error

VerifySignature verifies the signature for the given message. Unless provided in an option, the digest of the message will be computed using the hash function specified when the SignerVerifier was created.

This function returns nil if the verification succeeded, and an error message otherwise.

This function recognizes the following Options listed in order of preference:

- WithDigest()

All other options are ignored if specified.