Add GitHub App token signer for GCP KMS.

Author: wlynch

go.mod

@@ -6,9 +6,12 @@ require (
 	chainguard.dev/sdk v0.1.19
 	cloud.google.com/go/bigquery v1.60.0
 	cloud.google.com/go/compute/metadata v0.2.3
+	cloud.google.com/go/kms v1.15.7
 	cloud.google.com/go/pubsub v1.37.0
+	github.com/bradleyfalzon/ghinstallation/v2 v2.10.0
 	github.com/chainguard-dev/clog v1.3.1
 	github.com/cloudevents/sdk-go/v2 v2.15.2
+	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-github/v60 v60.0.0
 	github.com/google/go-github/v61 v61.0.0

go.sum

@@ -72,6 +72,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blendle/zapdriver v1.3.1 h1:C3dydBOWYRiOk+B8X9IVZ5IOe+7cl+tGOexN4QqHfpE=
 github.com/blendle/zapdriver v1.3.1/go.mod h1:mdXfREi6u5MArG4j9fewC+FGnXaBR+T4Ox4J2u4eHCc=
+github.com/bradleyfalzon/ghinstallation/v2 v2.10.0 h1:XWuWBRFEpqVrHepQob9yPS3Xg4K3Wr9QCx4fu8HbUNg=
+github.com/bradleyfalzon/ghinstallation/v2 v2.10.0/go.mod h1:qoGA4DxWPaYTgVCrmEspVSjlTu4WYAiSxMIhorMRXXc=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -106,6 +108,8 @@ github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=

pkg/github/kms/gcp.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2023 Chainguard, Inc.
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package kms
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+
+	kms "cloud.google.com/go/kms/apiv1"
+	"cloud.google.com/go/kms/apiv1/kmspb"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+type SigningMethodGCP struct {
+	ctx    context.Context
+	client *kms.KeyManagementClient
+}
+
+func (s *SigningMethodGCP) Verify(string, string, interface{}) error {
+	return errors.New("not implemented")
+}
+
+func (s *SigningMethodGCP) Sign(signingString string, ikey interface{}) (string, error) {
+	ctx := s.ctx
+
+	key, ok := ikey.(string)
+	if !ok {
+		return "", fmt.Errorf("invalid key reference type: %T", ikey)
+	}
+	req := &kmspb.AsymmetricSignRequest{
+		Name: key,
+		Data: []byte(signingString),
+	}
+	resp, err := s.client.AsymmetricSign(ctx, req)
+	if err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(resp.Signature), nil
+}
+
+func (s *SigningMethodGCP) Alg() string {
+	return "RS256"
+}
+
+type GCPSigner struct {
+	ctx    context.Context
+	client *kms.KeyManagementClient
+	key    string
+}
+
+func NewGCP(ctx context.Context, client *kms.KeyManagementClient, key string) (*GCPSigner, error) {
+	return &GCPSigner{
+		ctx:    ctx,
+		client: client,
+		key:    key,
+	}, nil
+}
+
+// Sign signs the JWT claims with the RSA key.
+func (s *GCPSigner) Sign(claims jwt.Claims) (string, error) {
+	method := &SigningMethodGCP{
+		ctx:    s.ctx,
+		client: s.client,
+	}
+	return jwt.NewWithClaims(method, claims).SignedString(s.key)
+}

pkg/github/kms/gcp_test.go

@@ -0,0 +1,70 @@
+/*
+Copyright 2023 Chainguard, Inc.
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package kms
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	kms "cloud.google.com/go/kms/apiv1"
+	"cloud.google.com/go/kms/apiv1/kmspb"
+	"github.com/golang-jwt/jwt/v4"
+	"google.golang.org/api/option"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+type fakeGCPKMS struct {
+	kmspb.UnimplementedKeyManagementServiceServer
+}
+
+func (fakeGCPKMS) AsymmetricSign(context.Context, *kmspb.AsymmetricSignRequest) (*kmspb.AsymmetricSignResponse, error) {
+	return &kmspb.AsymmetricSignResponse{
+		Signature: []byte("fake"),
+	}, nil
+}
+
+func TestGCP(t *testing.T) {
+	ctx := context.Background()
+
+	// Setup the fake server.
+	impl := &fakeGCPKMS{}
+	l, err := net.Listen("tcp", "localhost:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gsrv := grpc.NewServer()
+	kmspb.RegisterKeyManagementServiceServer(gsrv, impl)
+	fakeServerAddr := l.Addr().String()
+	go func() {
+		if err := gsrv.Serve(l); err != nil {
+			panic(err)
+		}
+	}()
+
+	// Create a client.
+	client, err := kms.NewKeyManagementClient(ctx,
+		option.WithEndpoint(fakeServerAddr),
+		option.WithoutAuthentication(),
+		option.WithGRPCDialOption(grpc.WithTransportCredentials(insecure.NewCredentials())),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	signer, err := NewGCP(ctx, client, "foo")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := signer.Sign(jwt.RegisteredClaims{
+		Subject: "foo",
+		Issuer:  "bar",
+	}); err != nil {
+		t.Fatal(err)
+	}
+}

pkg/github/kms/kms.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2023 Chainguard, Inc.
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package kms
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	kms "cloud.google.com/go/kms/apiv1"
+	"github.com/bradleyfalzon/ghinstallation/v2"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+// NewSigner creates a new signer based on a key url.
+// Supported URL schemes:
+// - file://<path>: creates a signer from a PEM encoded RSA private key from a file.
+// - gcpkms://<key>: creates a remote signer for a GCP KMS key.
+func NewSigner(ctx context.Context, url string) (ghinstallation.Signer, error) {
+	t := strings.SplitN(url, "://", 2)
+	if len(t) < 2 {
+		return nil, fmt.Errorf("invalid key format: %s", url)
+	}
+
+	switch t[0] {
+	case "file":
+		pk, err := os.ReadFile(t[1])
+		if err != nil {
+			return nil, fmt.Errorf("could not open file: %w", err)
+		}
+		rsa, err := jwt.ParseRSAPrivateKeyFromPEM(pk)
+		if err != nil {
+			return nil, fmt.Errorf("could not parse private key: %w", err)
+		}
+		return ghinstallation.NewRSASigner(jwt.SigningMethodRS256, rsa), nil
+
+	case "gcpkms":
+		client, err := kms.NewKeyManagementClient(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("could not create kms client: %w", err)
+		}
+		return NewGCP(ctx, client, t[1])
+	}
+	return nil, fmt.Errorf("unknown key type: %s", t[0])
+}