KMS Support

cmd/keyloader.go

@@ -19,18 +19,19 @@
 	"fmt"
 	"strings"
 
 	"github.com/in-toto/go-witness/cryptoutil"
 	"github.com/in-toto/go-witness/log"
 	"github.com/in-toto/go-witness/signer"
+	"github.com/in-toto/go-witness/signer/kms"
 	"github.com/in-toto/witness/options"
 	"github.com/spf13/pflag"
 )
 
-// signerProvidersFromFlags looks at all flags that were set by the user to determine which signer providers we should use
-func signerProvidersFromFlags(flags *pflag.FlagSet) map[string]struct{} {
-	signerProviders := make(map[string]struct{})
+// providersFromFlags looks at all flags that were set by the user to determine which providers we should use
+func providersFromFlags(prefix string, flags *pflag.FlagSet) map[string]struct{} {
+	providers := make(map[string]struct{})
 	flags.Visit(func(flag *pflag.Flag) {
-		if !strings.HasPrefix(flag.Name, "signer-") {
+		if !strings.HasPrefix(flag.Name, fmt.Sprintf("%s-", prefix)) {
 			return
 		}
 
@@ -39,14 +40,14 @@
 			return
 		}
 
-		signerProviders[parts[1]] = struct{}{}
+		providers[parts[1]] = struct{}{}
 	})
 
-	return signerProviders
+	return providers
 }
 
 // loadSigners loads all signers that appear in the signerProviders set and creates their respective signers, using any options provided in so
-func loadSigners(ctx context.Context, so options.SignerOptions, signerProviders map[string]struct{}) ([]cryptoutil.Signer, error) {
+func loadSigners(ctx context.Context, so options.SignerOptions, ko options.KMSSignerProviderOptions, signerProviders map[string]struct{}) ([]cryptoutil.Signer, error) {
 	signers := make([]cryptoutil.Signer, 0)
 	for signerProvider := range signerProviders {
 		setters := so[signerProvider]
@@ -56,6 +57,18 @@
 			continue
 		}
 
+		// NOTE: We want to initialze the KMS provider specific options if a KMS signer has been invoked
+		if ksp, ok := sp.(*kms.KMSSignerProvider); ok {
+			for _, opt := range ksp.Options {
+				for _, setter := range ko[opt.ProviderName()] {
+					sp, err = setter(ksp)
+					if err != nil {
+						continue
+					}
+				}
+			}
+		}
+
 		s, err := sp.Signer(ctx)
 		if err != nil {
 			log.Errorf("failed to create %v signer: %w", signerProvider, err)
@@ -71,3 +84,55 @@
 
 	return signers, nil
 }
+
+// NOTE: This is a temporary implementation until we have a SignerVerifier interface
+// loadVerifiers loads all verifiers that appear in the verifierProviders set and creates their respective verifiers, using any options provided in so
+func loadVerifiers(ctx context.Context, so options.VerifierOptions, ko options.KMSVerifierProviderOptions, verifierProviders map[string]struct{}) ([]cryptoutil.Verifier, error) {
+	verifiers := make([]cryptoutil.Verifier, 0)
+	for verifierProvider := range verifierProviders {
+		setters := so[verifierProvider]
+		sp, err := signer.NewVerifierProvider(verifierProvider, setters...)
+		if err != nil {
+			log.Errorf("failed to create %v verifier provider: %w", verifierProvider, err)
+			continue
+		}
+
+		// NOTE: We want to initialze the KMS provider specific options if a KMS signer has been invoked
+		if ksp, ok := sp.(*kms.KMSSignerProvider); ok {
+			for _, opt := range ksp.Options {
+				pn := opt.ProviderName()
+				for _, setter := range ko[pn] {
+					vp, err := setter(ksp)
+					if err != nil {
+						continue
+					}
+
+					// NOTE: KMS SignerProvider can also be a VerifierProvider. This is a nasty hack to cast things back in a way that we can add to the loaded verifiers.
+					// This must be refactored.
+					kspv, ok := vp.(*kms.KMSSignerProvider)
+					if !ok {
+						return nil, fmt.Errorf("provided verifier provider is not a KMS verifier provider")
+					}
+
+					s, err := kspv.Verifier(ctx)
+					if err != nil {
+						log.Errorf("failed to create %v verifier: %w", verifierProvider, err)
+						continue
+					}
+					verifiers = append(verifiers, s)
+					return verifiers, nil
+				}
+			}
+		}
+
+		s, err := sp.Verifier(ctx)
+		if err != nil {
+			log.Errorf("failed to create %v verifier: %w", verifierProvider, err)
+			continue
+		}
+
+		verifiers = append(verifiers, s)
+	}
+
+	return verifiers, nil
+}

cmd/root.go

@@ -19,6 +19,8 @@ import (
 	"os"
 
 	"github.com/in-toto/go-witness/log"
+	_ "github.com/in-toto/go-witness/signer/kms/aws"
+	_ "github.com/in-toto/go-witness/signer/kms/gcp"
 	"github.com/in-toto/witness/options"
 	"github.com/spf13/cobra"
 )

cmd/root_test.go

@@ -63,7 +63,7 @@ func Test_loadSignersKeyPair(t *testing.T) {
 			},
 		}
 
-		signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+		signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 		require.NoError(t, err)
 		require.Len(t, signers, 1)
 		assert.IsType(t, &cryptoutil.RSASigner{}, signers[0])
@@ -79,7 +79,7 @@ func Test_loadSignersKeyPair(t *testing.T) {
 			},
 		}
 
-		signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+		signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 		require.Error(t, err)
 		require.Len(t, signers, 0)
 	})
@@ -99,7 +99,7 @@ func Test_loadSignersCertificate(t *testing.T) {
 		},
 	}
 
-	signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+	signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 	require.NoError(t, err)
 	require.Len(t, signers, 1)
 	require.IsType(t, &cryptoutil.X509Signer{}, signers[0])

cmd/run.go

@@ -19,15 +19,15 @@
 	"encoding/json"
 	"fmt"
 
 	witness "github.com/in-toto/go-witness"
 	"github.com/in-toto/go-witness/archivista"
 	"github.com/in-toto/go-witness/attestation"
 	"github.com/in-toto/go-witness/attestation/commandrun"
 	"github.com/in-toto/go-witness/attestation/material"
 	"github.com/in-toto/go-witness/attestation/product"
 	"github.com/in-toto/go-witness/cryptoutil"
 	"github.com/in-toto/go-witness/log"
 	"github.com/in-toto/go-witness/registry"
 	"github.com/in-toto/go-witness/timestamp"
 	"github.com/in-toto/witness/options"
 	"github.com/spf13/cobra"
@@ -35,8 +35,9 @@
 
 func RunCmd() *cobra.Command {
 	o := options.RunOptions{
-		AttestorOptSetters: make(map[string][]func(attestation.Attestor) (attestation.Attestor, error)),
-		SignerOptions:      options.SignerOptions{},
+		AttestorOptSetters:       make(map[string][]func(attestation.Attestor) (attestation.Attestor, error)),
+		SignerOptions:            options.SignerOptions{},
+		KMSSignerProviderOptions: options.KMSSignerProviderOptions{},
 	}
 
 	cmd := &cobra.Command{
@@ -45,9 +46,9 @@
 		SilenceErrors: true,
 		SilenceUsage:  true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			signers, err := loadSigners(cmd.Context(), o.SignerOptions, signerProvidersFromFlags(cmd.Flags()))
+			signers, err := loadSigners(cmd.Context(), o.SignerOptions, o.KMSSignerProviderOptions, providersFromFlags("signer", cmd.Flags()))
 			if err != nil {
-				return fmt.Errorf("failed to load signers")
+				return fmt.Errorf("failed to load signers: %w", err)
 			}
 
 			return runRun(cmd.Context(), o, args, signers...)

cmd/run_test.go

@@ -83,7 +83,7 @@ func Test_runRunRSACA(t *testing.T) {
 		},
 	}
 
-	signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+	signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 	require.NoError(t, err)
 
 	workingDir := t.TempDir()

cmd/sign.go

@@ -21,7 +21,7 @@
 
 	witness "github.com/in-toto/go-witness"
 	"github.com/in-toto/go-witness/cryptoutil"
 	"github.com/in-toto/go-witness/dsse"
 	"github.com/in-toto/go-witness/timestamp"
 	"github.com/in-toto/witness/options"
 	"github.com/spf13/cobra"
@@ -29,7 +29,8 @@
 
 func SignCmd() *cobra.Command {
 	so := options.SignOptions{
-		SignerOptions: options.SignerOptions{},
+		SignerOptions:            options.SignerOptions{},
+		KMSSignerProviderOptions: options.KMSSignerProviderOptions{},
 	}
 
 	cmd := &cobra.Command{
@@ -40,7 +41,7 @@
 		SilenceUsage:      true,
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			signers, err := loadSigners(cmd.Context(), so.SignerOptions, signerProvidersFromFlags(cmd.Flags()))
+			signers, err := loadSigners(cmd.Context(), so.SignerOptions, so.KMSSignerProviderOptions, providersFromFlags("signer", cmd.Flags()))
 			if err != nil {
 				return fmt.Errorf("failed to load signer: %w", err)
 			}

cmd/verify.go

@@ -33,7 +33,11 @@ import (
 )
 
 func VerifyCmd() *cobra.Command {
-	vo := options.VerifyOptions{}
+	vo := options.VerifyOptions{
+		ArchivistaOptions:          options.ArchivistaOptions{},
+		KMSVerifierProviderOptions: options.KMSVerifierProviderOptions{},
+		VerifierOptions:            options.VerifierOptions{},
+	}
 	cmd := &cobra.Command{
 		Use:               "verify",
 		Short:             "Verifies a witness policy",
@@ -42,7 +46,11 @@ func VerifyCmd() *cobra.Command {
 		SilenceUsage:      true,
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runVerify(cmd.Context(), vo)
+			verifiers, err := loadVerifiers(cmd.Context(), vo.VerifierOptions, vo.KMSVerifierProviderOptions, providersFromFlags("verifier", cmd.Flags()))
+			if err != nil {
+				return fmt.Errorf("failed to load signer: %w", err)
+			}
+			return runVerify(cmd.Context(), vo, verifiers...)
 		},
 	}
 	vo.AddFlags(cmd)
@@ -55,24 +63,24 @@ const (
 
 // todo: this logic should be broken out and moved to pkg/
 // we need to abstract where keys are coming from, etc
-func runVerify(ctx context.Context, vo options.VerifyOptions) error {
-	if vo.KeyPath == "" && len(vo.CAPaths) == 0 {
-		return fmt.Errorf("must suply public key or ca paths")
+func runVerify(ctx context.Context, vo options.VerifyOptions, verifiers ...cryptoutil.Verifier) error {
+	if vo.KeyPath == "" && len(vo.CAPaths) == 0 && len(verifiers) == 0 {
+		return fmt.Errorf("must supply either a public key, CA certificates or a verifier")
 	}
 
-	var verifier cryptoutil.Verifier
 	if vo.KeyPath != "" {
 		keyFile, err := os.Open(vo.KeyPath)
 		if err != nil {
 			return fmt.Errorf("failed to open key file: %w", err)
 		}
 		defer keyFile.Close()
 
-		verifier, err = cryptoutil.NewVerifierFromReader(keyFile)
+		v, err := cryptoutil.NewVerifierFromReader(keyFile)
 		if err != nil {
 			return fmt.Errorf("failed to create verifier: %w", err)
 		}
 
+		verifiers = append(verifiers, v)
 	}
 
 	inFile, err := os.Open(vo.PolicyFilePath)
@@ -121,7 +129,7 @@ func runVerify(ctx context.Context, vo options.VerifyOptions) error {
 	verifiedEvidence, err := witness.Verify(
 		ctx,
 		policyEnvelope,
-		[]cryptoutil.Verifier{verifier},
+		verifiers,
 		witness.VerifyWithSubjectDigests(subjects),
 		witness.VerifyWithCollectionSource(collectionSource),
 	)

cmd/verify_test.go

@@ -54,7 +54,7 @@ func TestRunVerifyCA(t *testing.T) {
 		},
 	}
 
-	signers, err := loadSigners(context.Background(), so, map[string]struct{}{"file": {}})
+	signers, err := loadSigners(context.Background(), so, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 	require.NoError(t, err)
 
 	caBytes, err := os.ReadFile(ca.Name())
@@ -167,7 +167,7 @@ func TestRunVerifyKeyPair(t *testing.T) {
 		},
 	}
 
-	signers, err := loadSigners(context.Background(), so, map[string]struct{}{"file": {}})
+	signers, err := loadSigners(context.Background(), so, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 	require.NoError(t, err)
 
 	artifactPath := filepath.Join(workingDir, "test.txt")