Generate signing key if not set

vburckhardt commented 6 months ago

Description

Currently a signing key must be provided by end user. We made this input optional in Think timeframe as a way to make it easier to consume the stack. However, if the user does not specify a signing key, then CI pipeline signing step will fail. It would be desirable to come up with some automation to generate a signing key if the input is not set by end user.

3 options to investigate:

See whether we could leverage key protect for this generation and storage (instead of sm - see https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-image-signing)
Use a gpg directly through a null block (need to verify this works in schematics)
Use gpg provider (but this is a 3rd part one)

rajatagarwal-ibm commented 6 months ago

PR WIP https://github.com/terraform-ibm-modules/terraform-ibm-rag-sample-da/pull/91

rajatagarwal-ibm commented 5 months ago

@brendankellyibm closing above PR in favour of https://github.com/terraform-ibm-modules/terraform-ibm-rag-sample-da/pull/109.

Once in the devsecops repo uncomments the gpg resource (https://github.com/terraform-ibm-modules/terraform-ibm-devsecops-infrastructure/blob/main/gpg-key/gpg.tf), we should update the version and consume gpg in this PR.

vburckhardt commented 2 months ago

What is the next step on this one? It seems to have been parked?

terraform-ibm-modules / terraform-ibm-rag-sample-da

Generate signing key if not set #82

Description