connaisseur icon indicating copy to clipboard operation
connaisseur copied to clipboard

feat: support cosign rsa keys

Open xopham opened this issue 2 years ago • 1 comments

Fixes #201

Description

  • support of rsa public keys for cosign validator is added

:warning: WIP notes:

  • check if can be extended to notary v1 as well
  • consider adding an integration test
  • renaming functions (load_key/load_rsa_key) may be necessary

Checklist

  • [ ] PR is rebased to/aimed at branch develop
  • [x] PR follows Contributing Guide
  • [ ] Added tests (if necessary)
  • [ ] Extended README/Documentation (if necessary)
  • [x] Adjusted versions of image and Helm chart in values.yaml and Chart.yaml (if necessary)

xopham avatar Nov 12 '21 19:11 xopham

Codecov Report

Merging #416 (7a6c16e) into develop (b7b2f05) will increase coverage by 0.06%. The diff coverage is 100.00%.

Impacted file tree graph

@@             Coverage Diff             @@
##           develop     #416      +/-   ##
===========================================
+ Coverage    94.45%   94.52%   +0.06%     
===========================================
  Files           22       22              
  Lines         1101     1114      +13     
===========================================
+ Hits          1040     1053      +13     
  Misses          61       61              
Impacted Files Coverage Δ
connaisseur/crypto.py 100.00% <100.00%> (ø)
connaisseur/validators/cosign/cosign_validator.py 98.91% <100.00%> (+0.07%) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update b7b2f05...7a6c16e. Read the comment docs.

codecov-commenter avatar Nov 12 '21 19:11 codecov-commenter

Any motion on this? I'm trying to use the pubkey half of an AWS kms asymmetric key, and it keeps saying The trust_root type <class 'connaisseur.trust_root.RSAKey'> is unsupported for a validator of typecosign. I can verify using cosign and this pubkey by hand, but connaisseur is saying NOPE. Seems like this would fix that.

timothy-spencer avatar Jun 23 '23 15:06 timothy-spencer

@timothy-spencer i will have a look next week 🥸

phbelitz avatar Jun 23 '23 16:06 phbelitz