feat(plugin): introduce signing handler plugin support#885
Merged
jakobmoellerdev merged 8 commits intoSep 19, 2025
Merged
Conversation
#### What this does - Added a new `SigningRegistry` to manage signing handler plugins. - Integrated signing handler support into the plugin manager and registries. - Updated dependencies in `go.mod` and `go.sum` to include the signing library. - Adjusted test cases to align with the new signing plugin functionality. #### Why this change is needed - Expands the plugin framework capabilities to include signing handlers for enhanced security and verification processes. - Improves extensibility by enabling seamless integration and management of signing plugins. - Ensures alignment with the evolving requirements for cryptographic operations on component descriptors. Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
### What this does - Upgraded `ocm.software/open-component-model/bindings/go/descriptor/runtime` from `v0.0.0-20250909064434-e1a06fe74668` to `v0.0.0-20250915165427-710b0c881b3c`. - Updated `go.mod` and `go.sum` to reflect the newer version. Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
4690307 to
a0f3b06
Compare
### What this does - Introduced a new Go-based test signing handler plugin under `plugin/internal/testplugin-signinghandler`. - Implements basic signing and verifying capabilities with dummy data for testing purposes: - `Sign` and `Verify` operations. - Retrieval of signer and verifier identities. - Added plugin initialization logic with logging, configuration parsing, and capability registration. ### Why this change is needed - Provides a foundation for testing signing plugin functionality within the Open Component Model ecosystem. - Supports the development and verification of plugin-based cryptographic operations with minimal overhead. Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
Skarlso
reviewed
Sep 17, 2025
Skarlso
left a comment
Contributor
There was a problem hiding this comment.
Just a quick question first.
Skarlso
reviewed
Sep 17, 2025
Skarlso
reviewed
Sep 17, 2025
Skarlso
reviewed
Sep 17, 2025
Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
fabianburth
requested changes
Sep 18, 2025
Signed-off-by: Jakob Möller <jakob.moeller@sap.com>
fabianburth
approved these changes
Sep 18, 2025
Skarlso
approved these changes
Sep 19, 2025
jakobmoellerdev
added a commit
that referenced
this pull request
Oct 1, 2025
### What this does adds `ocm sign cv` / `ocm verify cv` support to OCM CLI. ### Why this change is needed This actually uses the handlers prepared before for OCM signing support in open-component-model/ocm-project#648 Needs #885 fix open-component-model/ocm-project#649 --------- Signed-off-by: Jakob Möller <jakob.moeller@sap.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
SigningRegistryto manage signing handler plugins.go.modandgo.sumto include the signing library.Note: I have made it so that Signing and Verification expect the same Config Type right now. Technically this is a bit of a conflict with the SigStore ADR Proposal because it would have two different configs for signing and verifications but I think having one type that can be used with different fields would also work, and its significantly easier to implement here
Why this change is needed
part of adopting the RSA handler implemented for open-component-model/ocm-project#648 in #859. It would be registered as an internal handler via
RegisterInternalComponentSignatureHandlerin the CLI