search

grafeas / kritis

Deploy-time Policy Enforcer for Kubernetes applications
https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
Apache License 2.0
696 stars 134 forks source link

Support PKIX PublicKey in AttestationAuthority #453

Open ooq opened 4 years ago

ooq commented 4 years ago

Is your feature request related to a problem? Please describe. Support attestation authority public keys in PKIX format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details).

Describe the solution you'd like Some kind of key wrapper that will allow either a PGP or a PKI key to be supported.

Describe alternatives you've considered Not support PKIX.

Additional context Add any other context or screenshots about the feature request here.

liufangwai commented 3 years ago

why not merged yet ? this feature is necessary

ooq commented 3 years ago

I think this is implemented by https://github.com/grafeas/kritis/pull/575. So closing this issue now.

ooq commented 3 years ago

@liufangwai FYI

liufangwai commented 3 years ago

@ooq Thanks for you reply , great job ! I find In file: https://github.com/grafeas/kritis/blob/master/pkg/kritis/review/validating_transport.go the method 'parsePublicKeys' will skip non PGP key , so this feature need a little more.

ooq commented 3 years ago

@liufangwai You are correct. It looks that the pkix sign/verify logic is done, but the flags in kritis is not turned on. Reopening this.

ooq commented 3 years ago

@liufangwai Would you be interested in contributing a patch? It will probably just involve turning it on in kritis and adding some tests (or not). We are short on capacity and won't get to this until next year.