Skip to content

Commit 4f566c5

Browse files
DahuKDahuK
authored
Merge pull request #10 from whywishfree/update-kms-sdk
refactor with kms3.0 sdk
2 parents a34cb55 + 61a2257 commit 4f566c5

File tree

12 files changed

+343
-181
lines changed

12 files changed

+343
-181
lines changed

‎README-zh_CN.md‎

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@
1313

1414
#### 插件规范兼容性
1515

16-
| Capability | Compatibility |
17-
| ---------------- | ------------------------------------------------------------ |
18-
| keySpec | `RSA-2048`, `RSA-3072`, `EC-256` |
19-
| hashAlgorithm | `SHA-256` |
20-
| signingAlgorithm | `RSASSA-PSS-SHA-256` |
16+
| Capability | Compatibility |
17+
| ---------------- | --------------------------------------------------- |
18+
| keySpec | `RSA-2048`, `EC-256` |
19+
| hashAlgorithm | `SHA-256` |
20+
| signingAlgorithm | `RSASSA-PSS-SHA-256` |
2121
| pluginCapability | `SIGNATURE_GENERATOR.RAW`, `SIGNATURE_VERIFIER.TRUSTED_IDENTITY`, `SIGNATURE_VERIFIER.REVOCATION_CHECK` |
22-
| signingScheme | `notary.x509` |
22+
| signingScheme | `notary.x509` |
2323

2424

2525

@@ -29,20 +29,17 @@
2929

3030
下面总结了配置 notation-alibabacloud-secret-manager 插件以及容器镜像签名和验签的步骤。
3131

32-
- 安装Notation [CLI](https://github.com/notaryproject/notation/releases/tag/v1.1.1)。版本 v1.1.1 已通过测试。请注意，“make install ”会根据 MacOS 环境创建插件目录结构。请根据您的操作系统更新 Makefile。然后，它会根据符号插件目录结构规范将插件复制到适当的位置。
32+
- 安装Notation [CLI](https://github.com/notaryproject/notation/releases/tag/v1.3.2)。版本 v1.3.2 已通过测试。请注意，“make install ”会根据 MacOS 环境创建插件目录结构。请根据您的操作系统更新 Makefile。然后，它会根据符号插件目录结构规范将插件复制到适当的位置。
3333

34-
- 本插件使用 [KMS Instance SDK](https://www.alibabacloud.com/help/en/kms/developer-reference/kms-instance-sdk-for-go/)，您需要满足以下先决条件并自定义环境变量：
34+
- 使用本插件您需要自定义以下环境变量：
3535

3636

3737

38-
| 环境变量 | 描述 |
39-
| ------------------------------------ | ------------------------------------------------------------ |
40-
| ALIBABA_CLOUD_ACCESS_KEY_ID | 阿里云账户Access Key ID |
41-
| ALIBABA_CLOUD_ACCESS_KEY_SECRET | 阿里云账号Access Secret Key |
42-
| ALIBABA_CLOUD_KMS_INSTANCE_ENDPOINT | 指定KMS专属实例的VPC Endpoint，比如：kst-hzxxxxxxxxxx.cryptoservice.kms.aliyuncs.com |
43-
| ALIBABA_CLOUD_KMS_CLIENTKEY_FILEPATH | 访问指定KMS专属实例应用接入点（AAP）的ClientKey凭据文件对应的本地文件路径 |
44-
| ALIBABA_CLOUD_KMS_PASSWORD | 指定KMS专属实例应用接入点（AAP）的密钥 |
45-
| ALIBABA_CLOUD_KMS_CA_FILEPATH | 指定KMS专属实例CA证书对应的本地文件路径 |
38+
| 环境变量 | 描述 |
39+
| ----------------------------------- | ------------------------------------------------------------ |
40+
| ALIBABA_CLOUD_ACCESS_KEY_ID | 阿里云账户Access Key ID |
41+
| ALIBABA_CLOUD_ACCESS_KEY_SECRET | 阿里云账号Access Secret Key |
42+
| ALIBABA_CLOUD_KMS_INSTANCE_ENDPOINT | 支持KMS专属实例Endpoint和共享网关Endpoint<br />专属实例Endpoint实例：kst-hzxxxxxxxxxx.cryptoservice.kms.aliyuncs.com<br />共享网关Endpoint实例：kms.cn-hangzhou.aliyuncs.com<br />关于专属网关访问和共享网关访问的更多差异，请参见[共享网关和专属网关的差异](https://www.alibabacloud.com/help/zh/kms/key-management-service/developer-reference/classic-kms-sdkclassic-kms-sdk/#d61514b089my8) |
4643

4744
*注意：notation-alibabacloud-secret-manager插件支持多种Credential配置方式。更多的配置方式请参考[credentials](https://aliyuncontainerservice.github.io/ack-ram-tool/#credentials)*
4845

@@ -86,7 +83,7 @@ notation plugin add --file ./notation-alibabacloud.secretmanager.plugin
8683

8784
2. 在密钥管理页面，单击用户主密钥页签，实例ID选择软件密钥管理实例，单击创建密钥。
8885

89-
3. 在创建密钥面板，完成配置项设置，注意这里的密钥规格需要选择**非对称密钥**，密钥用途选择**SIGN/VERIFY**，密钥规则选择上文插件规范兼容性里支持的密钥规格（`RSA-2048`, `RSA-3072`, `EC-256`），然后单击确定。
86+
3. 在创建密钥面板，完成配置项设置，注意这里的密钥规格需要选择**非对称密钥**，密钥用途选择**SIGN/VERIFY**，密钥规则选择上文插件规范兼容性里支持的密钥规格（`RSA-2048`,`EC-256`），然后单击确定。
9087

9188

9289

‎README.md‎

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ This document demonstrates how to sign and verify an OCI artifact with Alibaba C
1515

1616
#### Plugin Spec Compatibility
1717

18-
| Capability | Compatibility |
19-
| ---------------- | ------------------------------------------------------------ |
20-
| keySpec | `RSA-2048`, `RSA-3072`, `EC-256` |
21-
| hashAlgorithm | `SHA-256` |
22-
| signingAlgorithm | `RSASSA-PSS-SHA-256` |
18+
| Capability | Compatibility |
19+
| ---------------- | ---------------------------------------------------------- |
20+
| keySpec | `RSA-2048`, `EC-256` |
21+
| hashAlgorithm | `SHA-256` |
22+
| signingAlgorithm | `RSASSA-PSS-SHA-256` |
2323
| pluginCapability | `SIGNATURE_GENERATOR.RAW`, `SIGNATURE_VERIFIER.TRUSTED_IDENTITY`, `SIGNATURE_VERIFIER.REVOCATION_CHECK` |
24-
| signingScheme | `notary.x509` |
24+
| signingScheme | `notary.x509` |
2525

2626

2727

@@ -31,16 +31,13 @@ The following summarizes the steps to configure the notation-alibabacloud-secret
3131

3232
- Install notation [CLI](https://github.com/notaryproject/notation/releases/tag/v1.1.1). Version v1.1.1 has been tested. Note that `make install` creates the plugin directory structure based on a MacOS environment. Update the Makefile based on your OS. It then copies the plugin to the appropriate location based on the notation plugin directory structure spec.
3333

34-
- This plugin leverages the [KMS Instance SDK](https://www.alibabacloud.com/help/en/kms/developer-reference/kms-instance-sdk-for-go/), which means you'll need to meet the pre-requisites and customize the environment as follows：
34+
- To use this plugin, you need to define the following environment variables:
3535

36-
| Env | Description |
37-
| ------------------------------------ | ------------------------------------------------------------ |
38-
| ALIBABA_CLOUD_ACCESS_KEY_ID | Alibaba Cloud Account Access Key ID |
39-
| ALIBABA_CLOUD_ACCESS_KEY_SECRET | Alibaba Cloud Account Secret Access Key |
40-
| ALIBABA_CLOUD_KMS_INSTANCE_ENDPOINT | VPC Endpoint of the Dedicated KMS Instance, for example, kst-hzxxxxxxxxxx.cryptoservice.kms.aliyuncs.com |
41-
| ALIBABA_CLOUD_KMS_CLIENTKEY_FILEPATH | Local File Path of the ClientKey Credential for the Dedicated KMS Instance Application Access Point (AAP) |
42-
| ALIBABA_CLOUD_KMS_PASSWORD | Password for the Dedicated KMS Instance Application Access Point (AAP) |
43-
| ALIBABA_CLOUD_KMS_CA_FILEPATH | Local Path of the CA Certificate for the Dedicated KMS Instance |
36+
| Env | Description |
37+
| ----------------------------------- | ------------------------------------------------------------ |
38+
| ALIBABA_CLOUD_ACCESS_KEY_ID | Alibaba Cloud Account Access Key ID |
39+
| ALIBABA_CLOUD_ACCESS_KEY_SECRET | Alibaba Cloud Account Secret Access Key |
40+
| ALIBABA_CLOUD_KMS_INSTANCE_ENDPOINT | Supports both KMS dedicated instance Endpoint and shared gateway Endpoint. <br />**Dedicated instance Endpoint example**: kst-hzxxxxxxxxxx.cryptoservice.kms.aliyuncs.com<br /> **Shared gateway Endpoint example**: kms.cn-hangzhou.aliyuncs.com <br />For more information about the differences between accessing via a dedicated gateway and a shared gateway, please refer to [**Differences between shared and dedicated gateways for accessing KMS**](https://www.alibabacloud.com/help/en/kms/key-management-service/developer-reference/classic-kms-sdkclassic-kms-sdk/#26484656d84ey) |
4441

4542
*Note: the notation-alibabacloud-secret-manager plugin supports various Credential configuration methods. For more details, please refer to [credentials](https://aliyuncontainerservice.github.io/ack-ram-tool/#credentials)*
4643

@@ -79,7 +76,7 @@ Users can [create a key](https://help.aliyun.com/en/kms/key-management-service/u
7976

8077
2. On the **Keys** page, click the **Default Key** tab.
8178

82-
3. In the Create Keys panel, complete the configuration settings, noting that you need to select **Asymmetric Keys** for Key Type, **SIGN/VERIFY** for Key Usage, and select the key specifications supported by Plugin Spec Compatibility above (`RSA-2048`, `RSA-3072`, `EC-256`), and then click OK.
79+
3. In the Create Keys panel, complete the configuration settings, noting that you need to select **Asymmetric Keys** for Key Type, **SIGN/VERIFY** for Key Usage, and select the key specifications supported by Plugin Spec Compatibility above (`RSA-2048`, `EC-256`), and then click OK.
8380

8481

8582

‎ci/ossutil/go.mod‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
module github.com/AliyunContainerService/ack-ram-tool/ci/ossutil
22

3-
go 1.19
3+
go 1.23.0
4+
5+
toolchain go1.24.0
46

57
require (
68
github.com/alibabacloud-go/tea v1.2.0
@@ -13,7 +15,7 @@ require (
1315
github.com/json-iterator/go v1.1.12 // indirect
1416
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 // indirect
1517
github.com/modern-go/reflect2 v1.0.2 // indirect
16-
golang.org/x/net v0.9.0 // indirect
18+
golang.org/x/net v0.38.0 // indirect
1719
golang.org/x/time v0.3.0 // indirect
1820
gopkg.in/ini.v1 v1.56.0 // indirect
1921
)

‎ci/ossutil/go.sum‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,9 @@ golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/
5050
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
5151
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
5252
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
53-
golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
5453
golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
54+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
55+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
5556
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5657
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5758
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎cmd/notation-alibabacloud-secret-manager/main.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,14 @@ import (
1919
"os"
2020

2121
"github.com/notaryproject/notation-plugin-framework-go/cli"
22+
23+
notationplugin "github.com/AliyunContainerService/notation-alibabacloud-secret-manager/plugin"
2224
)
2325

2426
func main() {
2527
ctx := context.Background()
2628
// Initialize plugin
27-
plugin, err := NewAlibabaCloudSecretManagerPlugin()
29+
plugin, err := notationplugin.NewAlibabaCloudSecretManagerPlugin()
2830
if err != nil {
2931
_, _ = fmt.Fprintf(os.Stderr, "failed to initialize plugin: %v\n", err)
3032
os.Exit(2)

‎go.mod‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
module github.com/AliyunContainerService/notation-alibabacloud-secret-manager
22

3-
go 1.21
3+
go 1.23.0
4+
5+
toolchain go1.24.0
46

57
require (
68
github.com/AliyunContainerService/ack-ram-tool v0.18.1
@@ -65,14 +67,13 @@ require (
6567
github.com/spf13/pflag v1.0.5 // indirect
6668
github.com/tjfoc/gmsm v1.4.1 // indirect
6769
go.uber.org/multierr v1.10.0 // indirect
68-
golang.org/x/crypto v0.23.0 // indirect
69-
golang.org/x/net v0.25.0 // indirect
70-
golang.org/x/oauth2 v0.10.0 // indirect
71-
golang.org/x/sys v0.20.0 // indirect
72-
golang.org/x/term v0.20.0 // indirect
73-
golang.org/x/text v0.15.0 // indirect
70+
golang.org/x/crypto v0.36.0 // indirect
71+
golang.org/x/net v0.38.0 // indirect
72+
golang.org/x/oauth2 v0.27.0 // indirect
73+
golang.org/x/sys v0.31.0 // indirect
74+
golang.org/x/term v0.30.0 // indirect
75+
golang.org/x/text v0.23.0 // indirect
7476
golang.org/x/time v0.3.0 // indirect
75-
google.golang.org/appengine v1.6.7 // indirect
7677
google.golang.org/protobuf v1.33.0 // indirect
7778
gopkg.in/inf.v0 v0.9.1 // indirect
7879
gopkg.in/ini.v1 v1.67.0 // indirect

0 commit comments

Comments
 (0)