Skip to content

cliplugin: convert module to package only#1956

Merged
Hayden-IO merged 14 commits intosigstore:mainfrom
ramonpetgrave64:no-module
Feb 12, 2025
Merged

cliplugin: convert module to package only#1956
Hayden-IO merged 14 commits intosigstore:mainfrom
ramonpetgrave64:no-module

Conversation

@ramonpetgrave64
Copy link
Copy Markdown
Contributor

@ramonpetgrave64 ramonpetgrave64 commented Feb 5, 2025

Summary

Pending #1948, #1958

branch diff:

Moves the details of kms.signerVerifier to a new bridge package signerverifier.SignerVerifier to avoid import cycles.

Marks ProviderNotFoundError for deprecation.

Converts cliplugin to be a package only, not a module. This lets consumers, such as cosign, avoid having to load the module like below, and its okay because there are no new dependencies.

import _ "github.com/sigstore/sigstore/pkg/signature/kms/cliplugin"

To start using cliplugin, consumers need only bump the version of sigstore.

  • lint fixes, becuase golanci-lint does not run against sub-modules.

Testing

Example error

error during command execution: signing ../blob.txt: reading key: kms get: exec: "sigstore-kms-myawskmsX": executable file not found in $PATH

Release Note

cliplugin is now a package only, not a module that needs to be loaded for initialization. There is no need to explicitly import cliplugin.

Documentation

No doc changes.

@ramonpetgrave64
Copy link
Copy Markdown
Contributor Author

Lint errors should be fixed after merging #1958. Afterwards, we can remove that PR's explicit commands to run golangci-lint the the cliplugin directory.

@ramonpetgrave64 ramonpetgrave64 marked this pull request as ready for review February 7, 2025 18:07
@ramonpetgrave64 ramonpetgrave64 requested review from a team as code owners February 7, 2025 18:07
@ramonpetgrave64
Copy link
Copy Markdown
Contributor Author

@haydentherapper @bobcallaway

@Hayden-IO
Copy link
Copy Markdown
Contributor

note: the stuck CI is expected, we'll remove that as a requirement

@ramonpetgrave64
Copy link
Copy Markdown
Contributor Author

ramonpetgrave64 commented Feb 7, 2025

@haydentherapper It may be because the job's changed names, because of the matrix?

https://github.com/orgs/community/discussions/26698#discussioncomment-3252954

@ramonpetgrave64
Copy link
Copy Markdown
Contributor Author

I re-did the commits to follow a better flow.

github.com/davecgh/go-spew v1.1.1
github.com/sigstore/sigstore v1.8.10
github.com/sigstore/sigstore/pkg/signature/kms/cliplugin v0.0.0-00010101000000-000000000000
github.com/sigstore/sigstore v0.0.0-00010101000000-000000000000
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this looks strange, perhaps it doesn't matter with the replace on line 5?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right. Pinning an actual version won't be useful, I think.

ramonpetgrave64 and others added 10 commits February 10, 2025 12:12
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
return sv, nil
}
return nil, &ProviderNotFoundError{ref: keyResourceID}
// We don't return a ProviderNotFoundError because cosign currently interprets those in a confusing way:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library is used outside of Cosign so we shouldn't be making changes just because of how Cosign outputs this error.

Isn't it more accurate to log that it is an unrecognized scheme rather than a missing executable? Whether the KMS provider is an executable or module is a detail the user doesn't need to be aware of.

I think we can get the best of both worlds - wrap the original error from cliplugin.LoadSignerVerifier in a ProviderNotFoundError.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changed, and added tests


// SignerVerifier creates and verifies digital signatures over a message using a KMS service
// It is a wrapper for signerverifier.SignerVerifier.
type SignerVerifier interface {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather than modify this interface, can we leave this as-is and just redefine the interface in an internal package under pkg/signature/kms/cliplugin, like pkg/signature/kms/cliplugin/internal/signerverifier?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That works! though we have to copy the contents of the interface. It's okay, because if the two interfaces are ever out of sync, I see we would get a compiler error since cliplugin.LoadsignerVerifier()'s return value would not satisfy the return value of Get().

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@Hayden-IO Hayden-IO enabled auto-merge (squash) February 12, 2025 16:48
@Hayden-IO Hayden-IO merged commit a883eaf into sigstore:main Feb 12, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants