Support providing explicit options to VaultTransitSecretEngine sign & verifySignature #17032
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
LGTM, waiting for Vincent's review |
vsevel
requested changes
May 6, 2021
extensions/vault/runtime/src/main/java/io/quarkus/vault/transit/SignVerifyOptions.java
Outdated
Show resolved
Hide resolved
extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/VaultTransitManager.java
Outdated
Show resolved
Hide resolved
|
@vsevel Should be good to go! |
|
@kdubb Can you squash please |
… verifySignature The `VaultTransitSecretEngine.sign` and `VaultTransitSecretEngine.verifySignature` now have variants that take a `SignVerifyOptions` value. `SignVerifyOptions` allows specifying the following options from the Vault API: * `hashAlgorithm` (aka `hash_algorithm`) * `signatureAlgorithm` - (aka `signature_algorithm`) * `prehashed` * `marshalingAlgorithm` - (aka `marshaling_algorithm`) Some of these options (e.g. `hashAlgorithm`, `signatureAlgorithm` and `prehashed`) can be configured for specific transit keys via Quarkus config. The explicit options provided via `SignVerifyOptions` take precedence over any conifgured values.
kdubb
force-pushed
the
fix/vault_explicit_sign_verify_options
branch
from
2f3498a to
5b92f0b
Compare
|
@sberyozkin squashed & updated |
vsevel
approved these changes
May 7, 2021
|
@kdubb did you rebase on master? |
|
@vsevel Yes, rebased on master and squashed |
|
@kdubb thanks for this improvement |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #17033
The
VaultTransitSecretEngine.signandVaultTransitSecretEngine.verifySignaturenow have variants that take aSignVerifyOptionsvalue.SignVerifyOptionsallows specifying the following options from the Vault API:hashAlgorithm(akahash_algorithm)signatureAlgorithm- (akasignature_algorithm)prehashedmarshalingAlgorithm- (akamarshaling_algorithm)Some of these options (e.g.
hashAlgorithm,signatureAlgorithmandprehashed) can be configured for specific transit keys via Quarkus config. The explicit options provided viaSignVerifyOptionstake precedence over any conifgured values.