(&self, app_id: &[u8])
| 271 | } |
| 272 | |
| 273 | fn derive_app_ca(&self, app_id: &[u8]) -> Result<CaCert> { |
| 274 | let context_data = vec![app_id, b"app-ca"]; |
| 275 | let app_key = kdf::derive_p256_key_pair(&self.state.root_ca.key, &context_data) |
| 276 | .context("Failed to derive app disk key")?; |
| 277 | let req = CertRequest::builder() |
| 278 | .key(&app_key) |
| 279 | .org_name("Dstack") |
| 280 | .subject("Dstack App CA") |
| 281 | .ca_level(0) |
| 282 | .app_id(app_id) |
| 283 | .special_usage("app:ca") |
| 284 | .build(); |
| 285 | let app_ca = self |
| 286 | .state |
| 287 | .root_ca |
| 288 | .sign(req) |
| 289 | .context("Failed to sign App CA")?; |
| 290 | Ok(CaCert::from_parts(app_key, app_ca)) |
| 291 | } |
| 292 | } |
| 293 | |
| 294 | impl KmsRpc for RpcHandler { |
no test coverage detected