Add tink package#2024
Conversation
Copy in the tink package from Rekor v1 so that it can be used by other services. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Hayden-IO
left a comment
There was a problem hiding this comment.
Should we copy in the code for GetPrimaryKey which initializes a Tink decrypter given a KMS key, and NewTinkSigner to decrypt a keyset given a key? https://github.com/sigstore/timestamp-authority/blob/1abfce06d86c2e78094ec537ddebc92c4f9a051b/pkg/signer/tink.go#L53-L100 (and tests)
There's a bit of deviation between NewTinkSigner across Fulcio, Rekor and the TSA. The TSA implementation looks to be the most up to date.
This isn't ideal for what we're trying to use it for in rekor, |
Hayden-IO
left a comment
There was a problem hiding this comment.
Sounds good. I guess GetPrimaryKey is also overkill since we only support GCP currently.
Copy in the tink package from Rekor v1 so that it can be used by other services.
Relates to sigstore/rekor-tiles#9
Summary
Release Note
Documentation