search

sigstore / sigstore-java

java clients for sigstore
Apache License 2.0
37 stars 20 forks source link

HTTP Support in FulcioClient #682

Open sabre1041 opened 4 months ago

sabre1041 commented 4 months ago

Currently, the FulcioClient communicates via gRPC. While this is acceptable when communicating with the Public Good Instance (prod/staging), gRPC may not be exposed/running in self hosted deployments, rendering the client to being unusable.

Add support for standard HTTP communication to Fulcio which could be implemented as an entirely separate function/method or as a fallback when gRPC is not available

loosebazooka commented 4 months ago

That's interesting, I thought fulcio always enables the grpc endpoint with an http proxy. @bobcallaway? Can you share your config. If it truly makes sense to use http, then we can figure out how to enable this.

bobcallaway commented 4 months ago

fulcio can be deployed only exposing HTTP, only exposing gRPC, or exposing both:

https://github.com/sigstore/fulcio/blob/d0631526bb70cdf0fbe4dd6aaa33b57d0cd84ec6/cmd/app/serve.go#L101

loosebazooka commented 4 months ago

Yeah, there was an http client but we removed it since there was no perceived use for it, but that appears to be untrue. Happy to review a PR, but that's kinda low priority for me. Maybe a few steps via separate PRs

  1. Create a FuclioClient interface that both the grpc client and http client would implement.
  2. Revive the HttpClient (and use it the v2 rest api for fulcio -- not v1)
  3. Figure out how to enable this in the KeylessSigner (I don't know if automatic is ideal, maybe just a system property?)