diff --git a/api/blob.go b/api/blob.go
index cf62ecc3..3da125ac 100644
--- a/api/blob.go
+++ b/api/blob.go
@@ -12,15 +12,15 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/config"
 	"github.com/theparanoids/crypki/proto"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 // GetBlobAvailableSigningKeys returns all available keys that can sign
-func (s *SigningService) GetBlobAvailableSigningKeys(ctx context.Context, e *empty.Empty) (*proto.KeyMetas, error) {
+func (s *SigningService) GetBlobAvailableSigningKeys(ctx context.Context, e *emptypb.Empty) (*proto.KeyMetas, error) {
 	const methodName = "GetBlobAvailableSigningKeys"
 	statusCode := http.StatusOK
 	start := time.Now()
diff --git a/api/blob_test.go b/api/blob_test.go
index 1b5473f5..a2b45576 100644
--- a/api/blob_test.go
+++ b/api/blob_test.go
@@ -11,8 +11,8 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/proto"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 func init() {
@@ -62,7 +62,7 @@ func TestGetBlobAvailableSigningKeys(t *testing.T) {
 			mssp := mockSigningServiceParam{KeyUsages: tt.KeyUsages, sendError: false}
 			ss := initMockSigningService(mssp)
 			var ctx context.Context
-			var e *empty.Empty
+			var e *emptypb.Empty
 			keyMetas, err := ss.GetBlobAvailableSigningKeys(ctx, e)
 			if err != nil {
 				t.Fatal(err)
diff --git a/api/sshhost.go b/api/sshhost.go
index d01a4095..daafef6d 100644
--- a/api/sshhost.go
+++ b/api/sshhost.go
@@ -10,17 +10,17 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/config"
 	"github.com/theparanoids/crypki/proto"
 	"github.com/theparanoids/crypki/sshcert"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 // GetHostSSHCertificateAvailableSigningKeys returns all available keys that can sign host SSH certificates.
-func (s *SigningService) GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, e *empty.Empty) (*proto.KeyMetas, error) {
+func (s *SigningService) GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, e *emptypb.Empty) (*proto.KeyMetas, error) {
 	const methodName = "GetHostSSHCertificateAvailableSigningKeys"
 	statusCode := http.StatusOK
 	start := time.Now()
diff --git a/api/sshuser.go b/api/sshuser.go
index 799c6436..8c437d82 100644
--- a/api/sshuser.go
+++ b/api/sshuser.go
@@ -10,17 +10,17 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/config"
 	"github.com/theparanoids/crypki/proto"
 	"github.com/theparanoids/crypki/sshcert"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 // GetUserSSHCertificateAvailableSigningKeys returns all available keys that can sign user SSH certificates.
-func (s *SigningService) GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, e *empty.Empty) (*proto.KeyMetas, error) {
+func (s *SigningService) GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, e *emptypb.Empty) (*proto.KeyMetas, error) {
 	const methodName = "GetUserSSHCertificateAvailableSigningKeys"
 	statusCode := http.StatusOK
 	start := time.Now()
diff --git a/api/sshuser_test.go b/api/sshuser_test.go
index 75ca5e39..7248bb28 100644
--- a/api/sshuser_test.go
+++ b/api/sshuser_test.go
@@ -8,9 +8,9 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/config"
 	"github.com/theparanoids/crypki/proto"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 func TestGetUserSSHCertificateAvailableSigningKeys(t *testing.T) {
@@ -52,7 +52,7 @@ func TestGetUserSSHCertificateAvailableSigningKeys(t *testing.T) {
 			mssp := mockSigningServiceParam{KeyUsages: tt.KeyUsages, sendError: false}
 			ss := initMockSigningService(mssp)
 			var ctx context.Context
-			var e *empty.Empty
+			var e *emptypb.Empty
 			keyMetas, err := ss.GetUserSSHCertificateAvailableSigningKeys(ctx, e)
 			if err != nil {
 				t.Fatal(err)
diff --git a/api/x509cert.go b/api/x509cert.go
index ae9b57a7..5a7fc249 100644
--- a/api/x509cert.go
+++ b/api/x509cert.go
@@ -11,16 +11,16 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/config"
 	"github.com/theparanoids/crypki/proto"
 	"github.com/theparanoids/crypki/x509cert"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 // GetX509CertificateAvailableSigningKeys returns all available keys that can sign X509 certificates.
-func (s *SigningService) GetX509CertificateAvailableSigningKeys(ctx context.Context, e *empty.Empty) (*proto.KeyMetas, error) {
+func (s *SigningService) GetX509CertificateAvailableSigningKeys(ctx context.Context, e *emptypb.Empty) (*proto.KeyMetas, error) {
 	const methodName = "GetX509CertificateAvailableSigningKeys"
 	statusCode := http.StatusOK
 	start := time.Now()
diff --git a/api/x509cert_test.go b/api/x509cert_test.go
index 21b7f12c..d8e4deb9 100644
--- a/api/x509cert_test.go
+++ b/api/x509cert_test.go
@@ -8,9 +8,9 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/theparanoids/crypki/config"
 	"github.com/theparanoids/crypki/proto"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 func TestGetX509CertificateAvailableSigningKeys(t *testing.T) {
@@ -52,7 +52,7 @@ func TestGetX509CertificateAvailableSigningKeys(t *testing.T) {
 			mssp := mockSigningServiceParam{KeyUsages: tt.KeyUsages, sendError: false}
 			ss := initMockSigningService(mssp)
 			var ctx context.Context
-			var e *empty.Empty
+			var e *emptypb.Empty
 			keyMetas, err := ss.GetX509CertificateAvailableSigningKeys(ctx, e)
 			if err != nil {
 				t.Fatal(err)
diff --git a/go.mod b/go.mod
index 8e943047..c7f084dc 100644
--- a/go.mod
+++ b/go.mod
@@ -13,6 +13,7 @@ require (
 	golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a // indirect
 	google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154
 	google.golang.org/grpc v1.33.1
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.0.1
 	google.golang.org/protobuf v1.25.0
 	gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 // indirect
 )
diff --git a/go.sum b/go.sum
index 46613d14..08b1d8d1 100644
--- a/go.sum
+++ b/go.sum
@@ -428,6 +428,8 @@ google.golang.org/grpc v1.33.1 h1:DGeFlSan2f+WEtCERJ4J9GJWk15TxUi8QGagfI87Xyc=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.0.0 h1:lQ+dE99pFsb8osbJB3oRfE5eW4Hx6a/lZQr8Jh+eoT4=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.0.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.0.1 h1:M8spwkmx0pHrPq+uMdl22w5CvJ/Y+oAJTIs9oGoCpOE=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.0.1/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/pkcs11/pkcs11.go b/pkcs11/pkcs11.go
index 24b40154..58a1beec 100644
--- a/pkcs11/pkcs11.go
+++ b/pkcs11/pkcs11.go
@@ -14,7 +14,7 @@ import (
 
 // PKCS11Ctx interface is added to mock pkcs11.Ctx
 // run the following command to generate mock
-//go:generate $GOPATH/bin/mockgen -source=pkcs11.go -destination ./mock_pkcs11/mock_pkcs11.go
+//go:generate mockgen -source=pkcs11.go -destination ./mock_pkcs11/mock_pkcs11.go
 type PKCS11Ctx interface {
 	GetAttributeValue(p11.SessionHandle, p11.ObjectHandle, []*p11.Attribute) ([]*p11.Attribute, error)
 	SignInit(p11.SessionHandle, []*p11.Mechanism, p11.ObjectHandle) error
diff --git a/proto/mock/mock.go b/proto/mock/mock.go
index 5560daae..c3b89203 100644
--- a/proto/mock/mock.go
+++ b/proto/mock/mock.go
@@ -7,9 +7,9 @@ package mock
 import (
 	context "context"
 	gomock "github.com/golang/mock/gomock"
-	empty "github.com/golang/protobuf/ptypes/empty"
 	proto "github.com/theparanoids/crypki/proto"
 	grpc "google.golang.org/grpc"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
 	reflect "reflect"
 )
 
@@ -37,7 +37,7 @@ func (m *MockSigningClient) EXPECT() *MockSigningClientMockRecorder {
 }
 
 // GetX509CertificateAvailableSigningKeys mocks base method
-func (m *MockSigningClient) GetX509CertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
+func (m *MockSigningClient) GetX509CertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{ctx, in}
 	for _, a := range opts {
@@ -97,7 +97,7 @@ func (mr *MockSigningClientMockRecorder) PostX509Certificate(ctx, in interface{}
 }
 
 // GetUserSSHCertificateAvailableSigningKeys mocks base method
-func (m *MockSigningClient) GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
+func (m *MockSigningClient) GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{ctx, in}
 	for _, a := range opts {
@@ -157,7 +157,7 @@ func (mr *MockSigningClientMockRecorder) PostUserSSHCertificate(ctx, in interfac
 }
 
 // GetHostSSHCertificateAvailableSigningKeys mocks base method
-func (m *MockSigningClient) GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
+func (m *MockSigningClient) GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{ctx, in}
 	for _, a := range opts {
@@ -217,7 +217,7 @@ func (mr *MockSigningClientMockRecorder) PostHostSSHCertificate(ctx, in interfac
 }
 
 // GetBlobAvailableSigningKeys mocks base method
-func (m *MockSigningClient) GetBlobAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
+func (m *MockSigningClient) GetBlobAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{ctx, in}
 	for _, a := range opts {
@@ -300,7 +300,7 @@ func (m *MockSigningServer) EXPECT() *MockSigningServerMockRecorder {
 }
 
 // GetX509CertificateAvailableSigningKeys mocks base method
-func (m *MockSigningServer) GetX509CertificateAvailableSigningKeys(arg0 context.Context, arg1 *empty.Empty) (*proto.KeyMetas, error) {
+func (m *MockSigningServer) GetX509CertificateAvailableSigningKeys(arg0 context.Context, arg1 *emptypb.Empty) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetX509CertificateAvailableSigningKeys", arg0, arg1)
 	ret0, _ := ret[0].(*proto.KeyMetas)
@@ -345,7 +345,7 @@ func (mr *MockSigningServerMockRecorder) PostX509Certificate(arg0, arg1 interfac
 }
 
 // GetUserSSHCertificateAvailableSigningKeys mocks base method
-func (m *MockSigningServer) GetUserSSHCertificateAvailableSigningKeys(arg0 context.Context, arg1 *empty.Empty) (*proto.KeyMetas, error) {
+func (m *MockSigningServer) GetUserSSHCertificateAvailableSigningKeys(arg0 context.Context, arg1 *emptypb.Empty) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserSSHCertificateAvailableSigningKeys", arg0, arg1)
 	ret0, _ := ret[0].(*proto.KeyMetas)
@@ -390,7 +390,7 @@ func (mr *MockSigningServerMockRecorder) PostUserSSHCertificate(arg0, arg1 inter
 }
 
 // GetHostSSHCertificateAvailableSigningKeys mocks base method
-func (m *MockSigningServer) GetHostSSHCertificateAvailableSigningKeys(arg0 context.Context, arg1 *empty.Empty) (*proto.KeyMetas, error) {
+func (m *MockSigningServer) GetHostSSHCertificateAvailableSigningKeys(arg0 context.Context, arg1 *emptypb.Empty) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetHostSSHCertificateAvailableSigningKeys", arg0, arg1)
 	ret0, _ := ret[0].(*proto.KeyMetas)
@@ -435,7 +435,7 @@ func (mr *MockSigningServerMockRecorder) PostHostSSHCertificate(arg0, arg1 inter
 }
 
 // GetBlobAvailableSigningKeys mocks base method
-func (m *MockSigningServer) GetBlobAvailableSigningKeys(arg0 context.Context, arg1 *empty.Empty) (*proto.KeyMetas, error) {
+func (m *MockSigningServer) GetBlobAvailableSigningKeys(arg0 context.Context, arg1 *emptypb.Empty) (*proto.KeyMetas, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetBlobAvailableSigningKeys", arg0, arg1)
 	ret0, _ := ret[0].(*proto.KeyMetas)
diff --git a/proto/protogen.go b/proto/protogen.go
index d93a22b4..9d416fa1 100644
--- a/proto/protogen.go
+++ b/proto/protogen.go
@@ -4,13 +4,7 @@
 // Package proto contains proto generated code.
 package proto
 
-//go:generate protoc -I. -I$GOPATH/pkg/mod -I$GOPATH/pkg/mod/github.com/grpc-ecosystem/grpc-gateway/v2@v2.0.1/third_party/googleapis --go_out=. --go-grpc_out=. sign.proto
-//go:generate protoc -I. -I$GOPATH/pkg/mod -I$GOPATH/pkg/mod/github.com/grpc-ecosystem/grpc-gateway/v2@v2.0.1/third_party/googleapis --grpc-gateway_out=. --grpc-gateway_opt logtostderr=true --grpc-gateway_opt paths=source_relative --grpc-gateway_opt generate_unbound_methods=true sign.proto
-// use protoc 3.13.0
-
-// run the following command after generating proto files to generate mock
-//go:generate $GOPATH/bin/mockgen -source=./sign_grpc.pb.go -destination=./mock/mock.go -package=mock
-
-// run the following commands to install the gomock
-// go get github.com/golang/mock/gomock
-// go install github.com/golang/mock/mockgen
+// use protoc 3.14.0
+//go:generate protoc -I. -I../third_party/googleapis --go_out=. --go-grpc_out=. sign.proto
+//go:generate protoc -I. -I../third_party/googleapis --grpc-gateway_out=. --grpc-gateway_opt logtostderr=true --grpc-gateway_opt paths=source_relative --grpc-gateway_opt generate_unbound_methods=true sign.proto
+//go:generate mockgen -source=./sign_grpc.pb.go -destination=./mock/mock.go -package=mock
diff --git a/proto/sign.pb.go b/proto/sign.pb.go
index 30d9bdec..4752e20b 100644
--- a/proto/sign.pb.go
+++ b/proto/sign.pb.go
@@ -4,17 +4,17 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.25.0
-// 	protoc        v3.13.0
+// 	protoc        v3.14.0
 // source: sign.proto
 
 package proto
 
 import (
 	proto "github.com/golang/protobuf/proto"
-	empty "github.com/golang/protobuf/ptypes/empty"
 	_ "google.golang.org/genproto/googleapis/api/annotations"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -820,7 +820,7 @@ var file_sign_proto_goTypes = []interface{}{
 	(*Signature)(nil),                     // 9: v3.Signature
 	nil,                                   // 10: v3.SSHCertificateSigningRequest.CriticalOptionsEntry
 	nil,                                   // 11: v3.SSHCertificateSigningRequest.ExtensionsEntry
-	(*empty.Empty)(nil),                   // 12: google.protobuf.Empty
+	(*emptypb.Empty)(nil),                 // 12: google.protobuf.Empty
 }
 var file_sign_proto_depIdxs = []int32{
 	1,  // 0: v3.KeyMetas.keys:type_name -> v3.KeyMeta
diff --git a/proto/sign.pb.gw.go b/proto/sign.pb.gw.go
index dbf09e8a..d17c6c87 100644
--- a/proto/sign.pb.gw.go
+++ b/proto/sign.pb.gw.go
@@ -13,7 +13,6 @@ import (
 	"io"
 	"net/http"
 
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
 	"google.golang.org/grpc"
@@ -22,6 +21,7 @@ import (
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 // Suppress "imported and not used" errors
@@ -33,7 +33,7 @@ var _ = utilities.NewDoubleArray
 var _ = metadata.Join
 
 func request_Signing_GetX509CertificateAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, client SigningClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := client.GetX509CertificateAvailableSigningKeys(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -42,7 +42,7 @@ func request_Signing_GetX509CertificateAvailableSigningKeys_0(ctx context.Contex
 }
 
 func local_request_Signing_GetX509CertificateAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, server SigningServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := server.GetX509CertificateAvailableSigningKeys(ctx, &protoReq)
@@ -171,7 +171,7 @@ func local_request_Signing_PostX509Certificate_0(ctx context.Context, marshaler
 }
 
 func request_Signing_GetUserSSHCertificateAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, client SigningClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := client.GetUserSSHCertificateAvailableSigningKeys(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -180,7 +180,7 @@ func request_Signing_GetUserSSHCertificateAvailableSigningKeys_0(ctx context.Con
 }
 
 func local_request_Signing_GetUserSSHCertificateAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, server SigningServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := server.GetUserSSHCertificateAvailableSigningKeys(ctx, &protoReq)
@@ -309,7 +309,7 @@ func local_request_Signing_PostUserSSHCertificate_0(ctx context.Context, marshal
 }
 
 func request_Signing_GetHostSSHCertificateAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, client SigningClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := client.GetHostSSHCertificateAvailableSigningKeys(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -318,7 +318,7 @@ func request_Signing_GetHostSSHCertificateAvailableSigningKeys_0(ctx context.Con
 }
 
 func local_request_Signing_GetHostSSHCertificateAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, server SigningServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := server.GetHostSSHCertificateAvailableSigningKeys(ctx, &protoReq)
@@ -447,7 +447,7 @@ func local_request_Signing_PostHostSSHCertificate_0(ctx context.Context, marshal
 }
 
 func request_Signing_GetBlobAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, client SigningClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := client.GetBlobAvailableSigningKeys(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -456,7 +456,7 @@ func request_Signing_GetBlobAvailableSigningKeys_0(ctx context.Context, marshale
 }
 
 func local_request_Signing_GetBlobAvailableSigningKeys_0(ctx context.Context, marshaler runtime.Marshaler, server SigningServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq empty.Empty
+	var protoReq emptypb.Empty
 	var metadata runtime.ServerMetadata
 
 	msg, err := server.GetBlobAvailableSigningKeys(ctx, &protoReq)
diff --git a/proto/sign_grpc.pb.go b/proto/sign_grpc.pb.go
index 47ba1f0f..0706d07a 100644
--- a/proto/sign_grpc.pb.go
+++ b/proto/sign_grpc.pb.go
@@ -4,10 +4,10 @@ package proto
 
 import (
 	context "context"
-	empty "github.com/golang/protobuf/ptypes/empty"
 	grpc "google.golang.org/grpc"
 	codes "google.golang.org/grpc/codes"
 	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
 )
 
 // This is a compile-time assertion to ensure that this generated file
@@ -19,27 +19,27 @@ const _ = grpc.SupportPackageIsVersion7
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type SigningClient interface {
 	// GetX509CertificateAvailableSigningKeys returns all available keys that can sign X509 certificates.
-	GetX509CertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
+	GetX509CertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
 	// GetX509CACertificate returns the CA X509 certificate self-signed by the specified key.
 	GetX509CACertificate(ctx context.Context, in *KeyMeta, opts ...grpc.CallOption) (*X509Certificate, error)
 	// PostX509Certificate signs the given CSR using the specified key and returns a PEM encoded X509 certificate.
 	PostX509Certificate(ctx context.Context, in *X509CertificateSigningRequest, opts ...grpc.CallOption) (*X509Certificate, error)
 	// GetUserSSHCertificateAvailableSigningKeys returns all available keys that can sign user SSH certificates.
-	GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
+	GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
 	// GetUserSSHCertificateSigningKey returns the public signing key of the
 	// specified key that signs the user ssh certificate.
 	GetUserSSHCertificateSigningKey(ctx context.Context, in *KeyMeta, opts ...grpc.CallOption) (*SSHKey, error)
 	// PostUserSSHCertificate signs the SSH user certificate given request fields using the specified key.
 	PostUserSSHCertificate(ctx context.Context, in *SSHCertificateSigningRequest, opts ...grpc.CallOption) (*SSHKey, error)
 	// GetHostSSHCertificateAvailableSigningKeys returns all available keys that can sign host SSH certificates.
-	GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
+	GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
 	// GetHostSSHCertificateSigningKey returns the public signing key of the
 	// specified key that signs the host ssh certificate.
 	GetHostSSHCertificateSigningKey(ctx context.Context, in *KeyMeta, opts ...grpc.CallOption) (*SSHKey, error)
 	// PostHostSSHCertificate signs the SSH host certificate given request fields using the specified key.
 	PostHostSSHCertificate(ctx context.Context, in *SSHCertificateSigningRequest, opts ...grpc.CallOption) (*SSHKey, error)
 	// GetBlobAvailableSigningKeys returns all available keys that can sign
-	GetBlobAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
+	GetBlobAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error)
 	// GetBlobSigningKey returns the public signing key of the
 	// specified key that signs the user's data.
 	GetBlobSigningKey(ctx context.Context, in *KeyMeta, opts ...grpc.CallOption) (*PublicKey, error)
@@ -55,7 +55,7 @@ func NewSigningClient(cc grpc.ClientConnInterface) SigningClient {
 	return &signingClient{cc}
 }
 
-func (c *signingClient) GetX509CertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
+func (c *signingClient) GetX509CertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
 	out := new(KeyMetas)
 	err := c.cc.Invoke(ctx, "/v3.Signing/GetX509CertificateAvailableSigningKeys", in, out, opts...)
 	if err != nil {
@@ -82,7 +82,7 @@ func (c *signingClient) PostX509Certificate(ctx context.Context, in *X509Certifi
 	return out, nil
 }
 
-func (c *signingClient) GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
+func (c *signingClient) GetUserSSHCertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
 	out := new(KeyMetas)
 	err := c.cc.Invoke(ctx, "/v3.Signing/GetUserSSHCertificateAvailableSigningKeys", in, out, opts...)
 	if err != nil {
@@ -109,7 +109,7 @@ func (c *signingClient) PostUserSSHCertificate(ctx context.Context, in *SSHCerti
 	return out, nil
 }
 
-func (c *signingClient) GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
+func (c *signingClient) GetHostSSHCertificateAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
 	out := new(KeyMetas)
 	err := c.cc.Invoke(ctx, "/v3.Signing/GetHostSSHCertificateAvailableSigningKeys", in, out, opts...)
 	if err != nil {
@@ -136,7 +136,7 @@ func (c *signingClient) PostHostSSHCertificate(ctx context.Context, in *SSHCerti
 	return out, nil
 }
 
-func (c *signingClient) GetBlobAvailableSigningKeys(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
+func (c *signingClient) GetBlobAvailableSigningKeys(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*KeyMetas, error) {
 	out := new(KeyMetas)
 	err := c.cc.Invoke(ctx, "/v3.Signing/GetBlobAvailableSigningKeys", in, out, opts...)
 	if err != nil {
@@ -168,27 +168,27 @@ func (c *signingClient) PostSignBlob(ctx context.Context, in *BlobSigningRequest
 // for forward compatibility
 type SigningServer interface {
 	// GetX509CertificateAvailableSigningKeys returns all available keys that can sign X509 certificates.
-	GetX509CertificateAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error)
+	GetX509CertificateAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error)
 	// GetX509CACertificate returns the CA X509 certificate self-signed by the specified key.
 	GetX509CACertificate(context.Context, *KeyMeta) (*X509Certificate, error)
 	// PostX509Certificate signs the given CSR using the specified key and returns a PEM encoded X509 certificate.
 	PostX509Certificate(context.Context, *X509CertificateSigningRequest) (*X509Certificate, error)
 	// GetUserSSHCertificateAvailableSigningKeys returns all available keys that can sign user SSH certificates.
-	GetUserSSHCertificateAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error)
+	GetUserSSHCertificateAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error)
 	// GetUserSSHCertificateSigningKey returns the public signing key of the
 	// specified key that signs the user ssh certificate.
 	GetUserSSHCertificateSigningKey(context.Context, *KeyMeta) (*SSHKey, error)
 	// PostUserSSHCertificate signs the SSH user certificate given request fields using the specified key.
 	PostUserSSHCertificate(context.Context, *SSHCertificateSigningRequest) (*SSHKey, error)
 	// GetHostSSHCertificateAvailableSigningKeys returns all available keys that can sign host SSH certificates.
-	GetHostSSHCertificateAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error)
+	GetHostSSHCertificateAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error)
 	// GetHostSSHCertificateSigningKey returns the public signing key of the
 	// specified key that signs the host ssh certificate.
 	GetHostSSHCertificateSigningKey(context.Context, *KeyMeta) (*SSHKey, error)
 	// PostHostSSHCertificate signs the SSH host certificate given request fields using the specified key.
 	PostHostSSHCertificate(context.Context, *SSHCertificateSigningRequest) (*SSHKey, error)
 	// GetBlobAvailableSigningKeys returns all available keys that can sign
-	GetBlobAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error)
+	GetBlobAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error)
 	// GetBlobSigningKey returns the public signing key of the
 	// specified key that signs the user's data.
 	GetBlobSigningKey(context.Context, *KeyMeta) (*PublicKey, error)
@@ -201,7 +201,7 @@ type SigningServer interface {
 type UnimplementedSigningServer struct {
 }
 
-func (UnimplementedSigningServer) GetX509CertificateAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error) {
+func (UnimplementedSigningServer) GetX509CertificateAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetX509CertificateAvailableSigningKeys not implemented")
 }
 func (UnimplementedSigningServer) GetX509CACertificate(context.Context, *KeyMeta) (*X509Certificate, error) {
@@ -210,7 +210,7 @@ func (UnimplementedSigningServer) GetX509CACertificate(context.Context, *KeyMeta
 func (UnimplementedSigningServer) PostX509Certificate(context.Context, *X509CertificateSigningRequest) (*X509Certificate, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method PostX509Certificate not implemented")
 }
-func (UnimplementedSigningServer) GetUserSSHCertificateAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error) {
+func (UnimplementedSigningServer) GetUserSSHCertificateAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetUserSSHCertificateAvailableSigningKeys not implemented")
 }
 func (UnimplementedSigningServer) GetUserSSHCertificateSigningKey(context.Context, *KeyMeta) (*SSHKey, error) {
@@ -219,7 +219,7 @@ func (UnimplementedSigningServer) GetUserSSHCertificateSigningKey(context.Contex
 func (UnimplementedSigningServer) PostUserSSHCertificate(context.Context, *SSHCertificateSigningRequest) (*SSHKey, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method PostUserSSHCertificate not implemented")
 }
-func (UnimplementedSigningServer) GetHostSSHCertificateAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error) {
+func (UnimplementedSigningServer) GetHostSSHCertificateAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetHostSSHCertificateAvailableSigningKeys not implemented")
 }
 func (UnimplementedSigningServer) GetHostSSHCertificateSigningKey(context.Context, *KeyMeta) (*SSHKey, error) {
@@ -228,7 +228,7 @@ func (UnimplementedSigningServer) GetHostSSHCertificateSigningKey(context.Contex
 func (UnimplementedSigningServer) PostHostSSHCertificate(context.Context, *SSHCertificateSigningRequest) (*SSHKey, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method PostHostSSHCertificate not implemented")
 }
-func (UnimplementedSigningServer) GetBlobAvailableSigningKeys(context.Context, *empty.Empty) (*KeyMetas, error) {
+func (UnimplementedSigningServer) GetBlobAvailableSigningKeys(context.Context, *emptypb.Empty) (*KeyMetas, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetBlobAvailableSigningKeys not implemented")
 }
 func (UnimplementedSigningServer) GetBlobSigningKey(context.Context, *KeyMeta) (*PublicKey, error) {
@@ -246,12 +246,12 @@ type UnsafeSigningServer interface {
 	mustEmbedUnimplementedSigningServer()
 }
 
-func RegisterSigningServer(s *grpc.Server, srv SigningServer) {
+func RegisterSigningServer(s grpc.ServiceRegistrar, srv SigningServer) {
 	s.RegisterService(&_Signing_serviceDesc, srv)
 }
 
 func _Signing_GetX509CertificateAvailableSigningKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(empty.Empty)
+	in := new(emptypb.Empty)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -263,7 +263,7 @@ func _Signing_GetX509CertificateAvailableSigningKeys_Handler(srv interface{}, ct
 		FullMethod: "/v3.Signing/GetX509CertificateAvailableSigningKeys",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SigningServer).GetX509CertificateAvailableSigningKeys(ctx, req.(*empty.Empty))
+		return srv.(SigningServer).GetX509CertificateAvailableSigningKeys(ctx, req.(*emptypb.Empty))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -305,7 +305,7 @@ func _Signing_PostX509Certificate_Handler(srv interface{}, ctx context.Context,
 }
 
 func _Signing_GetUserSSHCertificateAvailableSigningKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(empty.Empty)
+	in := new(emptypb.Empty)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -317,7 +317,7 @@ func _Signing_GetUserSSHCertificateAvailableSigningKeys_Handler(srv interface{},
 		FullMethod: "/v3.Signing/GetUserSSHCertificateAvailableSigningKeys",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SigningServer).GetUserSSHCertificateAvailableSigningKeys(ctx, req.(*empty.Empty))
+		return srv.(SigningServer).GetUserSSHCertificateAvailableSigningKeys(ctx, req.(*emptypb.Empty))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -359,7 +359,7 @@ func _Signing_PostUserSSHCertificate_Handler(srv interface{}, ctx context.Contex
 }
 
 func _Signing_GetHostSSHCertificateAvailableSigningKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(empty.Empty)
+	in := new(emptypb.Empty)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -371,7 +371,7 @@ func _Signing_GetHostSSHCertificateAvailableSigningKeys_Handler(srv interface{},
 		FullMethod: "/v3.Signing/GetHostSSHCertificateAvailableSigningKeys",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SigningServer).GetHostSSHCertificateAvailableSigningKeys(ctx, req.(*empty.Empty))
+		return srv.(SigningServer).GetHostSSHCertificateAvailableSigningKeys(ctx, req.(*emptypb.Empty))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -413,7 +413,7 @@ func _Signing_PostHostSSHCertificate_Handler(srv interface{}, ctx context.Contex
 }
 
 func _Signing_GetBlobAvailableSigningKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(empty.Empty)
+	in := new(emptypb.Empty)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -425,7 +425,7 @@ func _Signing_GetBlobAvailableSigningKeys_Handler(srv interface{}, ctx context.C
 		FullMethod: "/v3.Signing/GetBlobAvailableSigningKeys",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SigningServer).GetBlobAvailableSigningKeys(ctx, req.(*empty.Empty))
+		return srv.(SigningServer).GetBlobAvailableSigningKeys(ctx, req.(*emptypb.Empty))
 	}
 	return interceptor(ctx, in, info, handler)
 }
diff --git a/third_party/README.md b/third_party/README.md
new file mode 100644
index 00000000..d1e637b5
--- /dev/null
+++ b/third_party/README.md
@@ -0,0 +1,14 @@
+# third_party
+This directory copies("vendors") files from the following repositories, as required for compiling proto files.
+We periodically sync the local copy with upstream.
+
+1.Repo
+https://github.com/googleapis/googleapis/
+
+files: [google/api/annotations.proto](https://github.com/googleapis/googleapis/blob/c979fbeb80d1b940790a69183629d799e4c05b4c/google/api/annotations.proto) and [google/api/http.proto](https://github.com/googleapis/googleapis/blob/c979fbeb80d1b940790a69183629d799e4c05b4c/google/api/http.proto)
+
+
+## Steps to sync the local copy with upstream
+
+1. Copy the desired files from upstream
+2. Update the hyperlinks above to reflect the new commit hash(es)
diff --git a/third_party/googleapis/google/api/annotations.proto b/third_party/googleapis/google/api/annotations.proto
new file mode 100644
index 00000000..85c361b4
--- /dev/null
+++ b/third_party/googleapis/google/api/annotations.proto
@@ -0,0 +1,31 @@
+// Copyright (c) 2015, Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/api/http.proto";
+import "google/protobuf/descriptor.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "AnnotationsProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+extend google.protobuf.MethodOptions {
+  // See `HttpRule`.
+  HttpRule http = 72295728;
+}
diff --git a/third_party/googleapis/google/api/http.proto b/third_party/googleapis/google/api/http.proto
new file mode 100644
index 00000000..69460cf7
--- /dev/null
+++ b/third_party/googleapis/google/api/http.proto
@@ -0,0 +1,375 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "HttpProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Defines the HTTP configuration for an API service. It contains a list of
+// [HttpRule][google.api.HttpRule], each specifying the mapping of an RPC method
+// to one or more HTTP REST API methods.
+message Http {
+  // A list of HTTP configuration rules that apply to individual API methods.
+  //
+  // **NOTE:** All service configuration rules follow "last one wins" order.
+  repeated HttpRule rules = 1;
+
+  // When set to true, URL path parameters will be fully URI-decoded except in
+  // cases of single segment matches in reserved expansion, where "%2F" will be
+  // left encoded.
+  //
+  // The default behavior is to not decode RFC 6570 reserved characters in multi
+  // segment matches.
+  bool fully_decode_reserved_expansion = 2;
+}
+
+// # gRPC Transcoding
+//
+// gRPC Transcoding is a feature for mapping between a gRPC method and one or
+// more HTTP REST endpoints. It allows developers to build a single API service
+// that supports both gRPC APIs and REST APIs. Many systems, including [Google
+// APIs](https://github.com/googleapis/googleapis),
+// [Cloud Endpoints](https://cloud.google.com/endpoints), [gRPC
+// Gateway](https://github.com/grpc-ecosystem/grpc-gateway),
+// and [Envoy](https://github.com/envoyproxy/envoy) proxy support this feature
+// and use it for large scale production services.
+//
+// `HttpRule` defines the schema of the gRPC/REST mapping. The mapping specifies
+// how different portions of the gRPC request message are mapped to the URL
+// path, URL query parameters, and HTTP request body. It also controls how the
+// gRPC response message is mapped to the HTTP response body. `HttpRule` is
+// typically specified as an `google.api.http` annotation on the gRPC method.
+//
+// Each mapping specifies a URL path template and an HTTP method. The path
+// template may refer to one or more fields in the gRPC request message, as long
+// as each field is a non-repeated field with a primitive (non-message) type.
+// The path template controls how fields of the request message are mapped to
+// the URL path.
+//
+// Example:
+//
+//     service Messaging {
+//       rpc GetMessage(GetMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//             get: "/v1/{name=messages/*}"
+//         };
+//       }
+//     }
+//     message GetMessageRequest {
+//       string name = 1; // Mapped to URL path.
+//     }
+//     message Message {
+//       string text = 1; // The resource content.
+//     }
+//
+// This enables an HTTP REST to gRPC mapping as below:
+//
+// HTTP | gRPC
+// -----|-----
+// `GET /v1/messages/123456`  | `GetMessage(name: "messages/123456")`
+//
+// Any fields in the request message which are not bound by the path template
+// automatically become HTTP query parameters if there is no HTTP request body.
+// For example:
+//
+//     service Messaging {
+//       rpc GetMessage(GetMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//             get:"/v1/messages/{message_id}"
+//         };
+//       }
+//     }
+//     message GetMessageRequest {
+//       message SubMessage {
+//         string subfield = 1;
+//       }
+//       string message_id = 1; // Mapped to URL path.
+//       int64 revision = 2;    // Mapped to URL query parameter `revision`.
+//       SubMessage sub = 3;    // Mapped to URL query parameter `sub.subfield`.
+//     }
+//
+// This enables a HTTP JSON to RPC mapping as below:
+//
+// HTTP | gRPC
+// -----|-----
+// `GET /v1/messages/123456?revision=2&sub.subfield=foo` |
+// `GetMessage(message_id: "123456" revision: 2 sub: SubMessage(subfield:
+// "foo"))`
+//
+// Note that fields which are mapped to URL query parameters must have a
+// primitive type or a repeated primitive type or a non-repeated message type.
+// In the case of a repeated type, the parameter can be repeated in the URL
+// as `...?param=A&param=B`. In the case of a message type, each field of the
+// message is mapped to a separate parameter, such as
+// `...?foo.a=A&foo.b=B&foo.c=C`.
+//
+// For HTTP methods that allow a request body, the `body` field
+// specifies the mapping. Consider a REST update method on the
+// message resource collection:
+//
+//     service Messaging {
+//       rpc UpdateMessage(UpdateMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//           patch: "/v1/messages/{message_id}"
+//           body: "message"
+//         };
+//       }
+//     }
+//     message UpdateMessageRequest {
+//       string message_id = 1; // mapped to the URL
+//       Message message = 2;   // mapped to the body
+//     }
+//
+// The following HTTP JSON to RPC mapping is enabled, where the
+// representation of the JSON in the request body is determined by
+// protos JSON encoding:
+//
+// HTTP | gRPC
+// -----|-----
+// `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id:
+// "123456" message { text: "Hi!" })`
+//
+// The special name `*` can be used in the body mapping to define that
+// every field not bound by the path template should be mapped to the
+// request body.  This enables the following alternative definition of
+// the update method:
+//
+//     service Messaging {
+//       rpc UpdateMessage(Message) returns (Message) {
+//         option (google.api.http) = {
+//           patch: "/v1/messages/{message_id}"
+//           body: "*"
+//         };
+//       }
+//     }
+//     message Message {
+//       string message_id = 1;
+//       string text = 2;
+//     }
+//
+//
+// The following HTTP JSON to RPC mapping is enabled:
+//
+// HTTP | gRPC
+// -----|-----
+// `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id:
+// "123456" text: "Hi!")`
+//
+// Note that when using `*` in the body mapping, it is not possible to
+// have HTTP parameters, as all fields not bound by the path end in
+// the body. This makes this option more rarely used in practice when
+// defining REST APIs. The common usage of `*` is in custom methods
+// which don't use the URL at all for transferring data.
+//
+// It is possible to define multiple HTTP methods for one RPC by using
+// the `additional_bindings` option. Example:
+//
+//     service Messaging {
+//       rpc GetMessage(GetMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//           get: "/v1/messages/{message_id}"
+//           additional_bindings {
+//             get: "/v1/users/{user_id}/messages/{message_id}"
+//           }
+//         };
+//       }
+//     }
+//     message GetMessageRequest {
+//       string message_id = 1;
+//       string user_id = 2;
+//     }
+//
+// This enables the following two alternative HTTP JSON to RPC mappings:
+//
+// HTTP | gRPC
+// -----|-----
+// `GET /v1/messages/123456` | `GetMessage(message_id: "123456")`
+// `GET /v1/users/me/messages/123456` | `GetMessage(user_id: "me" message_id:
+// "123456")`
+//
+// ## Rules for HTTP mapping
+//
+// 1. Leaf request fields (recursive expansion nested messages in the request
+//    message) are classified into three categories:
+//    - Fields referred by the path template. They are passed via the URL path.
+//    - Fields referred by the [HttpRule.body][google.api.HttpRule.body]. They are passed via the HTTP
+//      request body.
+//    - All other fields are passed via the URL query parameters, and the
+//      parameter name is the field path in the request message. A repeated
+//      field can be represented as multiple query parameters under the same
+//      name.
+//  2. If [HttpRule.body][google.api.HttpRule.body] is "*", there is no URL query parameter, all fields
+//     are passed via URL path and HTTP request body.
+//  3. If [HttpRule.body][google.api.HttpRule.body] is omitted, there is no HTTP request body, all
+//     fields are passed via URL path and URL query parameters.
+//
+// ### Path template syntax
+//
+//     Template = "/" Segments [ Verb ] ;
+//     Segments = Segment { "/" Segment } ;
+//     Segment  = "*" | "**" | LITERAL | Variable ;
+//     Variable = "{" FieldPath [ "=" Segments ] "}" ;
+//     FieldPath = IDENT { "." IDENT } ;
+//     Verb     = ":" LITERAL ;
+//
+// The syntax `*` matches a single URL path segment. The syntax `**` matches
+// zero or more URL path segments, which must be the last part of the URL path
+// except the `Verb`.
+//
+// The syntax `Variable` matches part of the URL path as specified by its
+// template. A variable template must not contain other variables. If a variable
+// matches a single path segment, its template may be omitted, e.g. `{var}`
+// is equivalent to `{var=*}`.
+//
+// The syntax `LITERAL` matches literal text in the URL path. If the `LITERAL`
+// contains any reserved character, such characters should be percent-encoded
+// before the matching.
+//
+// If a variable contains exactly one path segment, such as `"{var}"` or
+// `"{var=*}"`, when such a variable is expanded into a URL path on the client
+// side, all characters except `[-_.~0-9a-zA-Z]` are percent-encoded. The
+// server side does the reverse decoding. Such variables show up in the
+// [Discovery
+// Document](https://developers.google.com/discovery/v1/reference/apis) as
+// `{var}`.
+//
+// If a variable contains multiple path segments, such as `"{var=foo/*}"`
+// or `"{var=**}"`, when such a variable is expanded into a URL path on the
+// client side, all characters except `[-_.~/0-9a-zA-Z]` are percent-encoded.
+// The server side does the reverse decoding, except "%2F" and "%2f" are left
+// unchanged. Such variables show up in the
+// [Discovery
+// Document](https://developers.google.com/discovery/v1/reference/apis) as
+// `{+var}`.
+//
+// ## Using gRPC API Service Configuration
+//
+// gRPC API Service Configuration (service config) is a configuration language
+// for configuring a gRPC service to become a user-facing product. The
+// service config is simply the YAML representation of the `google.api.Service`
+// proto message.
+//
+// As an alternative to annotating your proto file, you can configure gRPC
+// transcoding in your service config YAML files. You do this by specifying a
+// `HttpRule` that maps the gRPC method to a REST endpoint, achieving the same
+// effect as the proto annotation. This can be particularly useful if you
+// have a proto that is reused in multiple services. Note that any transcoding
+// specified in the service config will override any matching transcoding
+// configuration in the proto.
+//
+// Example:
+//
+//     http:
+//       rules:
+//         # Selects a gRPC method and applies HttpRule to it.
+//         - selector: example.v1.Messaging.GetMessage
+//           get: /v1/messages/{message_id}/{sub.subfield}
+//
+// ## Special notes
+//
+// When gRPC Transcoding is used to map a gRPC to JSON REST endpoints, the
+// proto to JSON conversion must follow the [proto3
+// specification](https://developers.google.com/protocol-buffers/docs/proto3#json).
+//
+// While the single segment variable follows the semantics of
+// [RFC 6570](https://tools.ietf.org/html/rfc6570) Section 3.2.2 Simple String
+// Expansion, the multi segment variable **does not** follow RFC 6570 Section
+// 3.2.3 Reserved Expansion. The reason is that the Reserved Expansion
+// does not expand special characters like `?` and `#`, which would lead
+// to invalid URLs. As the result, gRPC Transcoding uses a custom encoding
+// for multi segment variables.
+//
+// The path variables **must not** refer to any repeated or mapped field,
+// because client libraries are not capable of handling such variable expansion.
+//
+// The path variables **must not** capture the leading "/" character. The reason
+// is that the most common use case "{var}" does not capture the leading "/"
+// character. For consistency, all path variables must share the same behavior.
+//
+// Repeated message fields must not be mapped to URL query parameters, because
+// no client library can support such complicated mapping.
+//
+// If an API needs to use a JSON array for request or response body, it can map
+// the request or response body to a repeated field. However, some gRPC
+// Transcoding implementations may not support this feature.
+message HttpRule {
+  // Selects a method to which this rule applies.
+  //
+  // Refer to [selector][google.api.DocumentationRule.selector] for syntax details.
+  string selector = 1;
+
+  // Determines the URL pattern is matched by this rules. This pattern can be
+  // used with any of the {get|put|post|delete|patch} methods. A custom method
+  // can be defined using the 'custom' field.
+  oneof pattern {
+    // Maps to HTTP GET. Used for listing and getting information about
+    // resources.
+    string get = 2;
+
+    // Maps to HTTP PUT. Used for replacing a resource.
+    string put = 3;
+
+    // Maps to HTTP POST. Used for creating a resource or performing an action.
+    string post = 4;
+
+    // Maps to HTTP DELETE. Used for deleting a resource.
+    string delete = 5;
+
+    // Maps to HTTP PATCH. Used for updating a resource.
+    string patch = 6;
+
+    // The custom pattern is used for specifying an HTTP method that is not
+    // included in the `pattern` field, such as HEAD, or "*" to leave the
+    // HTTP method unspecified for this rule. The wild-card rule is useful
+    // for services that provide content to Web (HTML) clients.
+    CustomHttpPattern custom = 8;
+  }
+
+  // The name of the request field whose value is mapped to the HTTP request
+  // body, or `*` for mapping all request fields not captured by the path
+  // pattern to the HTTP body, or omitted for not having any HTTP request body.
+  //
+  // NOTE: the referred field must be present at the top-level of the request
+  // message type.
+  string body = 7;
+
+  // Optional. The name of the response field whose value is mapped to the HTTP
+  // response body. When omitted, the entire response message will be used
+  // as the HTTP response body.
+  //
+  // NOTE: The referred field must be present at the top-level of the response
+  // message type.
+  string response_body = 12;
+
+  // Additional HTTP bindings for the selector. Nested bindings must
+  // not contain an `additional_bindings` field themselves (that is,
+  // the nesting may only be one level deep).
+  repeated HttpRule additional_bindings = 11;
+}
+
+// A custom pattern is used for defining custom HTTP verb.
+message CustomHttpPattern {
+  // The name of this custom HTTP verb.
+  string kind = 1;
+
+  // The path matched by this custom verb.
+  string path = 2;
+}
diff --git a/tools.go b/tools.go
new file mode 100644
index 00000000..7fb3499c
--- /dev/null
+++ b/tools.go
@@ -0,0 +1,15 @@
+// Copyright 2020, Oath Inc.
+// Licensed under the terms of the Apache License 2.0. Please see LICENSE file in project root for terms.
+
+// +build tools
+
+package crypki
+
+// Use the same version of go based tools.
+// Ref - https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module
+import (
+	_ "github.com/golang/mock/mockgen"
+	_ "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway"
+	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
+	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
+)