mirror of
https://github.com/google/nomulus.git
synced 2025-08-01 23:42:12 +02:00
Allow choice of Keyring to be configured in YAML
This uses a Dagger-provided map of Keyring implementations, with two currently available, "KMS" and "Dummy". The active keyring is configured in the YAML file, so we no longer require MOE directives to choose which one to use for internal/external builds. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=216898058
This commit is contained in:
parent
3bb525349f
commit
bec7a91cfc
18 changed files with 124 additions and 30 deletions
21
java/google/registry/keyring/BUILD
Normal file
21
java/google/registry/keyring/BUILD
Normal file
|
@ -0,0 +1,21 @@
|
|||
package(
|
||||
default_visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
licenses(["notice"]) # Apache 2.0
|
||||
|
||||
java_library(
|
||||
name = "keyring",
|
||||
srcs = glob(["*.java"]),
|
||||
deps = [
|
||||
"//java/google/registry/config",
|
||||
"//java/google/registry/keyring/api",
|
||||
"@com_google_code_findbugs_jsr305",
|
||||
"@com_google_dagger",
|
||||
"@com_google_flogger",
|
||||
"@com_google_flogger_system_backend",
|
||||
"@com_google_guava",
|
||||
"@javax_inject",
|
||||
"@org_bouncycastle_bcpg_jdk15on",
|
||||
],
|
||||
)
|
|
@ -1,4 +1,4 @@
|
|||
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
|
||||
// Copyright 2018 The Nomulus Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
|
@ -12,11 +12,15 @@
|
|||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package google.registry.keyring.kms;
|
||||
package google.registry.keyring;
|
||||
|
||||
|
||||
import static com.google.common.base.Preconditions.checkState;
|
||||
import dagger.Module;
|
||||
import dagger.Provides;
|
||||
import google.registry.config.RegistryConfig.Config;
|
||||
import google.registry.keyring.api.Keyring;
|
||||
import java.util.Map;
|
||||
import javax.inject.Singleton;
|
||||
|
||||
/** Dagger module for {@link Keyring} */
|
||||
|
@ -25,7 +29,13 @@ public final class KeyringModule {
|
|||
|
||||
@Provides
|
||||
@Singleton
|
||||
public static Keyring provideKeyring(KmsKeyring kmsKeyring) {
|
||||
return kmsKeyring;
|
||||
public static Keyring provideKeyring(
|
||||
Map<String, Keyring> keyrings, @Config("activeKeyring") String activeKeyring) {
|
||||
checkState(
|
||||
keyrings.containsKey(activeKeyring),
|
||||
"Invalid Keyring %s is configured; valid choices are %s",
|
||||
activeKeyring,
|
||||
keyrings.keySet());
|
||||
return keyrings.get(activeKeyring);
|
||||
}
|
||||
}
|
|
@ -21,11 +21,15 @@ import static google.registry.keyring.api.PgpHelper.lookupKeyPair;
|
|||
import com.google.common.base.VerifyException;
|
||||
import com.google.common.io.ByteSource;
|
||||
import com.google.common.io.Resources;
|
||||
import dagger.Binds;
|
||||
import dagger.Module;
|
||||
import dagger.Provides;
|
||||
import dagger.multibindings.IntoMap;
|
||||
import dagger.multibindings.StringKey;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import javax.annotation.concurrent.Immutable;
|
||||
import javax.inject.Named;
|
||||
import org.bouncycastle.openpgp.PGPException;
|
||||
import org.bouncycastle.openpgp.PGPKeyPair;
|
||||
import org.bouncycastle.openpgp.PGPPublicKeyRingCollection;
|
||||
|
@ -68,7 +72,9 @@ import org.bouncycastle.openpgp.bc.BcPGPSecretKeyRingCollection;
|
|||
*/
|
||||
@Module
|
||||
@Immutable
|
||||
public final class DummyKeyringModule {
|
||||
public abstract class DummyKeyringModule {
|
||||
|
||||
public static final String NAME = "Dummy";
|
||||
|
||||
/** The contents of a dummy PGP public key stored in a file. */
|
||||
private static final ByteSource PGP_PUBLIC_KEYRING =
|
||||
|
@ -81,9 +87,15 @@ public final class DummyKeyringModule {
|
|||
/** The email address of the aforementioned PGP key. */
|
||||
private static final String EMAIL_ADDRESS = "test-registry@example.com";
|
||||
|
||||
@Binds
|
||||
@IntoMap
|
||||
@StringKey(NAME)
|
||||
abstract Keyring provideKeyring(@Named("DummyKeyring") InMemoryKeyring keyring);
|
||||
|
||||
/** Always returns a {@link InMemoryKeyring} instance. */
|
||||
@Provides
|
||||
static Keyring provideKeyring() {
|
||||
@Named("DummyKeyring")
|
||||
static InMemoryKeyring provideDummyKeyring() {
|
||||
PGPKeyPair dummyKey;
|
||||
try (InputStream publicInput = PGP_PUBLIC_KEYRING.openStream();
|
||||
InputStream privateInput = PGP_PRIVATE_KEYRING.openStream()) {
|
||||
|
@ -112,4 +124,6 @@ public final class DummyKeyringModule {
|
|||
"not a real login",
|
||||
"not a real credential");
|
||||
}
|
||||
|
||||
private DummyKeyringModule() {}
|
||||
}
|
||||
|
|
|
@ -19,13 +19,23 @@ import com.google.api.services.cloudkms.v1.CloudKMS;
|
|||
import dagger.Binds;
|
||||
import dagger.Module;
|
||||
import dagger.Provides;
|
||||
import dagger.multibindings.IntoMap;
|
||||
import dagger.multibindings.StringKey;
|
||||
import google.registry.config.CredentialModule.DefaultCredential;
|
||||
import google.registry.config.RegistryConfig.Config;
|
||||
import google.registry.keyring.api.Keyring;
|
||||
|
||||
/** Dagger module for Cloud KMS connection objects. */
|
||||
/** Dagger module for Cloud KMS. */
|
||||
@Module
|
||||
public abstract class KmsModule {
|
||||
|
||||
public static final String NAME = "KMS";
|
||||
|
||||
@Binds
|
||||
@IntoMap
|
||||
@StringKey(NAME)
|
||||
abstract Keyring provideKeyring(KmsKeyring keyring);
|
||||
|
||||
@Provides
|
||||
static CloudKMS provideKms(
|
||||
@DefaultCredential GoogleCredential credential,
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue