sigstore
Add plugin interface for out-of-tree KMS providers
Description
Investigate using go-plugin as an approach for out-of-tree KMS providers to integrate with Sigstore tooling without merging code into this repo.
I believe this is the correct interface to base the plugin design off of: https://github.com/sigstore/sigstore/blob/8a49902a31ccd8f4d297d8109a17e9bb78f8a1ba/pkg/signature/kms/kms.go#L72
Two other possible approaches:
- Go's plugin support. This notes that it only works on certain Linux distros and macOS so it's probably not the best approach
- kubectl has support for plugins. I haven't dug in yet, but given kubectl is written in go, I assume this either uses either the above or go-plugin, or something that's been written from scratch that we could maybe reuse.
Two other possible approaches:
- Go's plugin support. This notes that it only works on certain Linux distros and macOS so it's probably not the best approach
Given lack of portability this is probably a non-starter
- kubectl has support for plugins. I haven't dug in yet, but given kubectl is written in go, I assume this either uses either the above or go-plugin, or something that's been written from scratch that we could maybe reuse.
this seems to be based on a convention of a separate binary being named kubectl-foo-bar and just launching that child process.
Hey Team - how close or far away are we from some sort decision on this and can we be of any help here?
The go-plugin library seems like the most promising solution. We haven't started working on this yet. Are you interested in implementing it?
No promises, but I am talking to my dev team to potentially build it. I will get back to you when I have more info.
Update: Not sure we will be able to get to this as our team is quite busy.
@haydentherapper @bobcallaway any chance you and the team of contributors are going to get to this at some point? Unfortunately, we don't have the time.
Just another follow up on this one. Hope it's coming soon, and thanks so much for all your hard work 🙏