Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove extras unused by OpenBao #12

Merged
merged 1 commit into from
Nov 13, 2024

Conversation

cipherboy
Copy link
Member

These subpackages are unused by OpenBao. KMS is a package built on top
of go-kms-wrapping which uses a database to store encryption keys: this
is unnecessary in our case as we explicitly want all keys to be backed
by the underlying wrapper (which, admittedly in the case of cloud KMSes,
incurs some cost that extras/kms/ could avoid). Crypto adds, along other
things, a HMAC-SHA-256 implementation: if we find this useful, we could
add this directly to wrappers/ as an optional type (just like signing.go
is). Lastly, StructWrapping adds a way to encrypt arbitrary interfaces,
through a custom marshaling format built on protobuf.

extras/multi remains: it is unclear if it might potentially be useful
for multi-unseal in OpenBao in the future and aead/ had tests using it.

@cipherboy cipherboy requested review from JanMa and DanGhita August 15, 2024 11:40
@cipherboy
Copy link
Member Author

@JanMa It looks like I had to manually approve actions to run, since we were on a fork and GitHub wanted to make sure we understood them. :-D

We also seem to be building with different versions of protobuf than what the main repo uses; we should probably standardize on a single version of tooling across all repos. But that's probably for a future PR.

@cipherboy
Copy link
Member Author

With the following diff:

diff to OpenBao
diff --git a/go.mod b/go.mod
index 6e12989247..2f4d1f4381 100644
--- a/go.mod
+++ b/go.mod
@@ -24,6 +24,24 @@ replace github.com/openbao/openbao/api/auth/userpass/v2 => ./api/auth/userpass
 
 replace github.com/openbao/openbao/sdk/v2 => ./sdk
 
+replace github.com/openbao/go-kms-wrapping/v2 => ../go-kms-wrapping
+
+replace github.com/openbao/go-kms-wrapping/entropy/v2 => ../go-kms-wrapping/entropy
+
+replace github.com/openbao/go-kms-wrapping/wrappers/aead/v2 => ../go-kms-wrapping/wrappers/aead
+
+replace github.com/openbao/go-kms-wrapping/wrappers/alicloudkms/v2 => ../go-kms-wrapping/wrappers/alicloudkms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/awskms/v2 => ../go-kms-wrapping/wrappers/awskms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/azurekeyvault/v2 => ../go-kms-wrapping/wrappers/azurekeyvault
+
+replace github.com/openbao/go-kms-wrapping/wrappers/gcpckms/v2 => ../go-kms-wrapping/wrappers/gcpckms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/ocikms/v2 => ../go-kms-wrapping/wrappers/ocikms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/transit/v2 => ../go-kms-wrapping/wrappers/transit
+
 require (
        cloud.google.com/go/monitoring v1.17.0
        github.com/ProtonMail/go-crypto v0.0.0-20230626094100-7e9e0395ebec
@@ -124,7 +142,7 @@ require (
        github.com/openbao/openbao/api/auth/approle/v2 v2.0.0
        github.com/openbao/openbao/api/auth/userpass/v2 v2.0.0
        github.com/openbao/openbao/api/v2 v2.0.1
-       github.com/openbao/openbao/sdk/v2 v2.0.0
+       github.com/openbao/openbao/sdk/v2 v2.0.1
        github.com/ory/dockertest/v3 v3.10.0
        github.com/patrickmn/go-cache v2.1.0+incompatible
        github.com/pires/go-proxyproto v0.6.1
diff --git a/go.sum b/go.sum
index 7a2ff9146e..5e18980228 100644
--- a/go.sum
+++ b/go.sum
@@ -874,24 +874,6 @@ github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1y
 github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
 github.com/onsi/gomega v1.27.4 h1:Z2AnStgsdSayCMDiCU42qIz+HLqEPcgiOCXjAU/w+8E=
 github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ=
-github.com/openbao/go-kms-wrapping/entropy/v2 v2.1.0 h1:f+OX5kI8KLPYhzRhqhQTQPashOx5SxPaWtd24hoT5vo=
-github.com/openbao/go-kms-wrapping/entropy/v2 v2.1.0/go.mod h1:2ZTItykGc/yQcdNfyK2TPBYKlOibfwSPr7ugFyqGXlI=
-github.com/openbao/go-kms-wrapping/v2 v2.1.0 h1:jSyQwjGWlEoNZZUUbXdKpTrV+Y9l7B3N8qTym1AJ9Ww=
-github.com/openbao/go-kms-wrapping/v2 v2.1.0/go.mod h1:c0lWzFdDOXYr+uJ6WmnJdsWuApdt1aZzYWHknbxjMc0=
-github.com/openbao/go-kms-wrapping/wrappers/aead/v2 v2.1.0 h1:9c2L5aPUquXYUE/levY8NQ2TipzmHPd+kNu6VfFWh4c=
-github.com/openbao/go-kms-wrapping/wrappers/aead/v2 v2.1.0/go.mod h1:xvVoDGLeQBAQV86OG/FHERg1khsJvTHrbDzfAjQ/8xM=
-github.com/openbao/go-kms-wrapping/wrappers/alicloudkms/v2 v2.1.0 h1:3YLaGZuP9LgjwToGvFOLlcypSTWOGKWoifOUd4mvuqw=
-github.com/openbao/go-kms-wrapping/wrappers/alicloudkms/v2 v2.1.0/go.mod h1:kPeSMEDMVkR6fF5LV+QjP63QECi4pIka2j5n/4UCVPs=
-github.com/openbao/go-kms-wrapping/wrappers/awskms/v2 v2.1.0 h1:dWA1SKkvtHKkvJflRrwTWVv2HoCs5DmERZBPM+AM7tc=
-github.com/openbao/go-kms-wrapping/wrappers/awskms/v2 v2.1.0/go.mod h1:CYzuJWMEW5feEsnaMlXNzpQ01GfTvpgND2xcL1gUdWo=
-github.com/openbao/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.1.0 h1:Ze1jZn6Pn5/OnGPe11YWHvebV33gNJv1QP52BdxYEJg=
-github.com/openbao/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.1.0/go.mod h1:ZayjRuXf/BmoTfspTIvMc1MfGQkWyCb4WeBfqvZa5Oc=
-github.com/openbao/go-kms-wrapping/wrappers/gcpckms/v2 v2.1.0 h1:ETDD0FbpAMDsUoaBcWOatcJ3Ol7Yzh0AOtj8mchRJk8=
-github.com/openbao/go-kms-wrapping/wrappers/gcpckms/v2 v2.1.0/go.mod h1:4sJLy2LJyXz2vNQ37Re7ox2kTBY4A3Umt4gGIKDO7d4=
-github.com/openbao/go-kms-wrapping/wrappers/ocikms/v2 v2.1.0 h1:SUb6MNKKp3deEgwj5dfoelUMjKneSat0H+i8S+IgfFs=
-github.com/openbao/go-kms-wrapping/wrappers/ocikms/v2 v2.1.0/go.mod h1:PkhBgU1gKDF0Bt7Qly4xS27iIJQhANJFtYZJY16OuDs=
-github.com/openbao/go-kms-wrapping/wrappers/transit/v2 v2.1.0 h1:uHyr3Cq+GMX+nvbmlBjs4Wm9NAfaAl8lY/wFqqaYnW8=
-github.com/openbao/go-kms-wrapping/wrappers/transit/v2 v2.1.0/go.mod h1:US4/vJBX1yLsRDQxTpIZ9VJ6CcglCCjEbaearho8e7E=
 github.com/openbao/openbao-template v1.0.0 h1:nOgv26mtmb6vqxIDaSf1m+IXIHqU9jizg1bW8MIxl38=
 github.com/openbao/openbao-template v1.0.0/go.mod h1:MuFjR+FOsWAEtpIU+oHrghG+FDp/MhS1ChACI7FM9U0=
 github.com/openbao/openbao/api v1.100.0-development20240408 h1:FpRSTqGdzf+j7hx7O+t5WzP1WWgoxlHbc2XVwkXBxvE=
diff --git a/sdk/go.mod b/sdk/go.mod
index 12ee31889a..769ba3e1c1 100644
--- a/sdk/go.mod
+++ b/sdk/go.mod
@@ -11,6 +11,24 @@ toolchain go1.22.5
 
 replace github.com/openbao/openbao/api/v2 => ../api
 
+replace github.com/openbao/go-kms-wrapping/v2 => ../../go-kms-wrapping
+
+replace github.com/openbao/go-kms-wrapping/entropy/v2 => ../../go-kms-wrapping/entropy
+
+replace github.com/openbao/go-kms-wrapping/wrappers/aead/v2 => ../../go-kms-wrapping/wrappers/aead
+
+replace github.com/openbao/go-kms-wrapping/wrappers/alicloudkms/v2 => ../../go-kms-wrapping/wrappers/alicloudkms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/awskms/v2 => ../../go-kms-wrapping/wrappers/awskms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/azurekeyvault/v2 => ../../go-kms-wrapping/wrappers/azurekeyvault
+
+replace github.com/openbao/go-kms-wrapping/wrappers/gcpckms/v2 => ../../go-kms-wrapping/wrappers/gcpckms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/ocikms/v2 => ../../go-kms-wrapping/wrappers/ocikms
+
+replace github.com/openbao/go-kms-wrapping/wrappers/transit/v2 => ../../go-kms-wrapping/wrappers/transit
+
 require (
        github.com/armon/go-metrics v0.4.1
        github.com/armon/go-radix v1.0.0
diff --git a/sdk/go.sum b/sdk/go.sum
index 9836fb9e66..4d8f97333a 100644
--- a/sdk/go.sum
+++ b/sdk/go.sum
@@ -197,10 +197,6 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWb
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
-github.com/openbao/go-kms-wrapping/entropy/v2 v2.1.0 h1:f+OX5kI8KLPYhzRhqhQTQPashOx5SxPaWtd24hoT5vo=
-github.com/openbao/go-kms-wrapping/entropy/v2 v2.1.0/go.mod h1:2ZTItykGc/yQcdNfyK2TPBYKlOibfwSPr7ugFyqGXlI=
-github.com/openbao/go-kms-wrapping/v2 v2.1.0 h1:jSyQwjGWlEoNZZUUbXdKpTrV+Y9l7B3N8qTym1AJ9Ww=
-github.com/openbao/go-kms-wrapping/v2 v2.1.0/go.mod h1:c0lWzFdDOXYr+uJ6WmnJdsWuApdt1aZzYWHknbxjMc0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=

I was able to run:

$ make tidy-all dev check
... output elided ...

and have it past tests still.

@cipherboy cipherboy force-pushed the remove-unused-extras branch from 394aa79 to 12560ff Compare August 15, 2024 12:13
These subpackages are unused by OpenBao. KMS is a package built on top
of go-kms-wrapping which uses a database to store encryption keys: this
is unnecessary in our case as we explicitly want all keys to be backed
by the underlying wrapper (which, admittedly in the case of cloud KMSes,
incurs some cost that extras/kms/ could avoid). Crypto adds, along other
things, a HMAC-SHA-256 implementation: if we find this useful, we could
add this directly to wrappers/ as an optional type (just like signing.go
is). Lastly, StructWrapping adds a way to encrypt arbitrary interfaces,
through a custom marshaling format built on protobuf.

extras/multi remains: it is unclear if it might potentially be useful
for multi-unseal in OpenBao in the future and aead/ had tests using it.

Signed-off-by: Alexander Scheel <[email protected]>
@cipherboy cipherboy force-pushed the remove-unused-extras branch from 12560ff to 557007c Compare November 12, 2024 22:25
@cipherboy
Copy link
Member Author

@JanMa @DanGhita Any chance I could bother one of you for a review? The buf failure is unrelated and caused by using different versions of protobuf across our various projects.

Copy link
Member

@JanMa JanMa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delay, LGTM ✔️

@cipherboy cipherboy merged commit 63cabe3 into openbao:main Nov 13, 2024
13 of 14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants