Support Nydus boostrap layer encryption and decryption

[taoohong]

Use ocicrypt to support encryption and decryption of nydus boostrap layer.

[codecov]

Codecov Report

Merging #479 (5a18147) into main (70599d9) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #479   +/-   ##
=======================================
  Coverage   37.31%   37.31%           
=======================================
  Files          59       59           
  Lines        6960     6960           
=======================================
  Hits         2597     2597           
  Misses       4052     4052           
  Partials      311      311           

[adamqqqplay]

@taoohong Hi, could you please add some unit tests to your code? Especially the newly added file pkg/converter/encryption.go, thanks in advance.

[changweige]

Could you please share some background information on this feature and its potential users or use cases to help us understand its necessity? How could we consume the package?

[taoohong]

Could you please share some background information on this feature and its potential users or use cases to help us understand its necessity? How could we consume the package?

Data security has become an important topic in the field of cloud computing. When users no longer trust CSPs, the confidentiality and integrity of user image must be guaranteed. A typical application scenario is confidential containers, where Nydus supports image encryption to address the need for users to accelerate encrypted images. This patch is only one aspect of Nydus' support for image encryption, as it only encrypts metadata. There are other subsequent patches that support chunk-level encryption of data blobs, ultimately achieving Nydus' support for encrypted images.
How to use this? For example:
nydusify convert --source busybox --target localhost:5000/busybox:nydus-enc --encrypt-recipients jwe:/etc/pubkey.pem
nydusify check --target localhost:5000/busybox:nydus-enc --decrypt-keys /etc/key.pem
It's amost the same in acceld/nerdctl, users can add encrypt & decrypt options to configuration file to do this.

[taoohong]

@taoohong Hi, could you please add some unit tests to your code? Especially the newly added file pkg/converter/encryption.go, thanks in advance.

done

[adamqqqplay]

Could you please share some background information on this feature and its potential users or use cases to help us understand its necessity? How could we consume the package?

Data security has become an important topic in the field of cloud computing. When users no longer trust CSPs, the confidentiality and integrity of user image must be guaranteed. A typical application scenario is confidential containers, where Nydus supports image encryption to address the need for users to accelerate encrypted images. This patch is only one aspect of Nydus' support for image encryption, as it only encrypts metadata. There are other subsequent patches that support chunk-level encryption of data blobs, ultimately achieving Nydus' support for encrypted images. How to use this? For example: nydusify convert --source busybox --target localhost:5000/busybox:nydus-enc --encrypt-recipients jwe:/etc/pubkey.pem nydusify check --target localhost:5000/busybox:nydus-enc --decrypt-keys /etc/key.pem It's amost the same in acceld/nerdctl, users can add encrypt & decrypt options to configuration file to do this.

Maybe we could add some docs later to introduce this new feature.

[imeoer]

How do we support the blob layer encryption and decryption later?

[taoohong]

How do we support the blob layer encryption and decryption later?

JiaNan Huang is working on this. XD

[imeoer]

LGTM