search

containerd / imgcrypt

OCI Image Encryption Package
Apache License 2.0
355 stars 46 forks source link

Refactor to take the keys as arguments instead of their filesystem path then reading them #147

Closed revoltez closed 5 months ago

revoltez commented 5 months ago

I was at some point needing to use nerdctl as a library in which they use imgcrypt and i needed a way to pass the keys created in memory directly instead of reading them from the filesystem, so i had to copy your functions processRecipientKeys which takes a string of recipients, and in the case of decryption its processPrivateKeyFiles and added an extra argument which are the keys and removed the parts of reading from the FS, so i was wondering if it would be possible to create public functions that also support passing a array of byte arrays (the keys) instead? it would make the library more accessible.

stefanberger commented 5 months ago

I think what you would want is a function that does the 2nd part of CreateDecryptCryptoConfig() that processes the various key types after reading files.

https://github.com/containerd/imgcrypt/blob/9eba5fc3f67e266e30ec04df1eaa614e0b7d9dfe/images/encryption/parsehelpers/parsehelpers.go#L269-L301

Did you not just reuse the public function encconfig.DecryptWithPrivKeys(privKeys, privKeysPasswords) to add private keys for decryption and then call encconfig.CombineCryptoConfigs(ccs) in the end?

revoltez commented 5 months ago

Oh i didn't those functions, my bad, i highly appreciate it, thanks!