Function decodeRSAPrivateKey

backend/plugin/db/snowflake/snowflake.go:415–443

(key, passphrase string)

}

func decodeRSAPrivateKey(key, passphrase string) (*rsa.PrivateKey, error) {
	block, _ := pem.Decode([]byte(key))
	if block == nil {
		return nil, errors.Errorf("failed to get private key PEM block from key")
	}
	switch block.Type {
	case "PRIVATE KEY":
		privateKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
		if err != nil {
			return nil, errors.Wrapf(err, "failed to parse pkcs8 private key")
		}
		rsaKey, ok := privateKey.(*rsa.PrivateKey)
		if !ok {
			return nil, errors.Errorf("expected RSA private key, got %T", privateKey)
		}
		return rsaKey, nil
	case "ENCRYPTED PRIVATE KEY":
		// NOTE: As of Jun 2024, Golang's official library does not support passcode-encrypted PKCS8 private key. And
		// Snowflake do not introduce an external library to achieve this due to the security purposes.
		// We introduce https://pkg.go.dev/github.com/youmark/pkcs8 to help us to achieve this goal.
		pk, err := pkcs8.ParsePKCS8PrivateKeyRSA(block.Bytes, []byte(passphrase))
		if err != nil {
			return nil, errors.Wrapf(err, "failed to parse pkcs8 private key to rsa private key with passphrase")
		}
		return pk, nil
	default:
		return nil, errors.Errorf("unsupported pem block type: %s", block.Type)
	}
}