NewSigner creates a new signer that can resolve keys from both files and Kubernetes secrets
(ctx context.Context, keyRef string, fs afero.Fs)
| 61 | |
| 62 | // NewSigner creates a new signer that can resolve keys from both files and Kubernetes secrets |
| 63 | func NewSigner(ctx context.Context, keyRef string, fs afero.Fs) (*Signer, error) { |
| 64 | keyBytes, err := utils.PrivateKeyFromKeyRef(ctx, keyRef, fs) |
| 65 | if err != nil { |
| 66 | return nil, fmt.Errorf("resolve private key %q: %w", keyRef, err) |
| 67 | } |
| 68 | |
| 69 | password, err := utils.PasswordFromKeyRef(ctx, keyRef) |
| 70 | if err != nil { |
| 71 | return nil, fmt.Errorf("resolve private key password: %w", err) |
| 72 | } |
| 73 | |
| 74 | signerVerifier, err := LoadPrivateKey(keyBytes, password, nil) |
| 75 | if err != nil { |
| 76 | return nil, fmt.Errorf("load private key %q: %w", keyRef, err) |
| 77 | } |
| 78 | |
| 79 | return &Signer{ |
| 80 | KeyPath: keyRef, |
| 81 | FS: fs, |
| 82 | WrapSigner: dsse.WrapSigner(signerVerifier, cosigntypes.IntotoPayloadType), |
| 83 | SignerVerifier: signerVerifier, |
| 84 | }, nil |
| 85 | } |
| 86 | |
| 87 | // NewAttestor creates an Attestor with sensible defaults |
| 88 | func NewAttestor(predicatePath, repo, digest string, signer *Signer) (*Attestor, error) { |