Tongsuo-Project / RustyVault

A rusted vault that can do many awesome secrets management stuff...
Apache License 2.0
264 stars 21 forks source link

Support cryptography module #65

Closed InfoHunter closed 3 months ago

InfoHunter commented 6 months ago

This pull request implements the rusty_vault::modules::crypto module and relevant cryptography adaptor mechanism. In every build of RustyVault, users can select one of the supported adaptors as the real cryptography operations provider in RustyVault.

A set of new feature names are added in Cargo and they can be specified during cargo build by:

cargo build --features crypto_adaptor_tongsuo

or 

cargo build --features crypto_adaptor_openssl

If no adaptor is explicitly configured, then the OpenSSL adaptor is selected by default - for the compatibility considerations.

InfoHunter commented 5 months ago

It seems Cargo doesn't support dynamic patching for dependencies. So if Tongsuo is selected as the underlying adaptor, one must run the following command to patch openssl and openssl-sys to the rust-tongsuo version:

cargo build --features crypto_adaptor_tongsuo \
    --no-default-features \
    --config 'patch.crates-io.openssl.git="https://github.com/Tongsuo-Project/rust-tongsuo.git"'\
    --config 'patch.crates-io.openssl-sys.git="https://github.com/Tongsuo-Project/rust-tongsuo.git"'

Or, just uncomment the following lines in Cargo.toml:

#[patch.crates-io]
#openssl = { git = "https://github.com/Tongsuo-Project/rust-tongsuo.git" }
#openssl-sys = { git = "https://github.com/Tongsuo-Project/rust-tongsuo.git" }

and then:

cargo build --features crypto_adaptor_tongsuo --no-default-features
InfoHunter commented 5 months ago

To use Tongsuo as the underlying cryptography library, the user needs to set a OPENSSL_DIR=/path/to/tongsuo/install/directory, to indicate where Tongsuo is installed. Currently only Tonsguo 8.4 and later are supported.

InfoHunter commented 5 months ago

some in-code document snips:

Screen Shot 2024-06-15 at 00 23 00
InfoHunter commented 4 months ago

Support of public key and digest algorithms will be in a separate pull request.

InfoHunter commented 3 months ago

All have been resolved.

InfoHunter commented 3 months ago

Able to merge subject to CIs are green