gcpkms

Documentation

Overview

Package gcpkms provides the small Cloud KMS trust-boundary primitives used by agentosd. It speaks the bounded REST API directly so the kernel does not pull in the full Google Cloud SDK.

Index

• type Config
• type Ed25519Signer
  • func NewEd25519Signer(cfg Config) (*Ed25519Signer, error)
  • func (s *Ed25519Signer) KeyID() string
  • func (s *Ed25519Signer) Sign(ctx context.Context, canonicalPayload []byte) ([]byte, error)
• type TokenSource
  • func ApplicationDefaultTokenSource() TokenSource

Types

type Config

type Config struct {
	KeyVersion string
	Endpoint   string       // empty => https://cloudkms.googleapis.com; tests may inject loopback HTTP
	Client     *http.Client // nil => a bounded default client
	Token      TokenSource  // required; unauthenticated signing is forbidden
}

Config defines one immutable EC_SIGN_ED25519 Cloud KMS signer.

type Ed25519Signer

type Ed25519Signer struct {
	// contains filtered or unexported fields
}

Ed25519Signer signs raw canonical payload bytes using a full pinned CryptoKeyVersion resource name.

func NewEd25519Signer

func NewEd25519Signer(cfg Config) (*Ed25519Signer, error)

NewEd25519Signer validates configuration without performing network I/O.

func (*Ed25519Signer) KeyID

func (s *Ed25519Signer) KeyID() string

KeyID is the exact full Cloud KMS key-version identifier verifiers pin.

func (*Ed25519Signer) Sign

func (s *Ed25519Signer) Sign(ctx context.Context, canonicalPayload []byte) ([]byte, error)

Sign implements the AgentOS receipt-signer seam. EC_SIGN_ED25519 is PureEdDSA, so Cloud KMS must receive the raw canonical bytes in data, never a precomputed digest. Integrity is checked in both directions with CRC32C.

type TokenSource

type TokenSource func(ctx context.Context) (string, error)

TokenSource returns one OAuth bearer token. Production agentosd injects the cached GCE/Cloud Run metadata source, so IAM remains workload-identity based.

func ApplicationDefaultTokenSource

func ApplicationDefaultTokenSource() TokenSource

ApplicationDefaultTokenSource resolves Google Application Default Credentials at refresh time. On managed GCP this remains workload identity through the metadata server. When GOOGLE_IMPERSONATE_SERVICE_ACCOUNT is explicitly set, the base ADC may call IAMCredentials only to mint a short-lived Cloud KMS token for that normalized signer account. Signing key material never leaves Cloud KMS in either case.