CoCoKeyprovider: Support Image Encryption with KMS

Cargo.toml

@@ -13,6 +13,7 @@ members = [
     "attestation-agent/test-binaries",
     "confidential-data-hub/hub",
     "confidential-data-hub/kms",
+    "confidential-data-hub/image",
     "confidential-data-hub/secret",
     "image-rs",
     "ocicrypt-rs",

attestation-agent/coco_keyprovider/Cargo.toml

@@ -8,22 +8,29 @@ edition = "2021"
 [dependencies]
 aes-gcm.workspace = true
 anyhow.workspace = true
+async-trait.workspace = true
 base64.workspace = true
 clap = { workspace = true, features = ["derive"] }
+config = "0.13.3"
+crypto = { path = "../deps/crypto", default-features = false, optional = true }
 ctr.workspace = true
 env_logger = "0.10.0"
 futures = "0.3.5"
+image = { path = "../../confidential-data-hub/image", default-features = false }
 jwt-simple = "0.11.4"
+kms = { path = "../../confidential-data-hub/kms", default-features = false }
 log.workspace = true
 prost.workspace = true
 rand.workspace = true
 reqwest.workspace = true
+resource_uri = { path = "../deps/resource_uri", optional = true }
 serde.workspace = true
 serde_json.workspace = true
 strum.workspace = true
 tokio = { workspace = true, features = ["fs", "rt-multi-thread"] }
 tonic.workspace = true
 uuid = { workspace = true, features = ["fast-rng", "v4"] }
+zeroize.workspace = true
 
 [build-dependencies]
 shadow-rs = "0.23.0"
@@ -33,3 +40,7 @@ tonic-build.workspace = true
 rstest.workspace = true
 
 [features]
+default = ["kbs"]
+
+kbs = ["resource_uri", "crypto"]
+aliyun = ["kms/aliyun"]

attestation-agent/coco_keyprovider/src/config.rs

@@ -0,0 +1,49 @@
+// Copyright (c) 2023 Alibaba Cloud
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+use std::net::SocketAddr;
+
+use anyhow::anyhow;
+use clap::Parser;
+use serde::Deserialize;
+
+const DEFAULT_SOCKET: &str = "127.0.0.1:50000";
+
+/// Contains all configurable CoCoKeyprovider properties.
+#[derive(Clone, Debug, Deserialize)]
+pub struct CoCoKeyproviderConfig {
+    /// KBS provider configurations
+    #[cfg(feature = "kbs")]
+    pub kbs_config: crate::plugins::kbs::Config,
+
+    /// Socket addresses (IP:port) to listen on, e.g. 127.0.0.1:50000.
+    pub socket: SocketAddr,
+}
+
+impl TryFrom<&str> for CoCoKeyproviderConfig {
+    type Error = anyhow::Error;
+
+    /// Load `Config` from a configuration file. Supported formats are all formats supported by the
+    /// `config` crate. See [`Config`] for schema information.
+    fn try_from(config_path: &str) -> Result<Self, Self::Error> {
+        let c = config::Config::builder()
+            .set_default("sockets", vec![DEFAULT_SOCKET])?
+            .add_source(config::File::with_name(config_path))
+            .build()?;
+
+        c.try_deserialize()
+            .map_err(|e| anyhow!("invalid config: {}", e.to_string()))
+    }
+}
+
+/// KBS command-line arguments.
+#[derive(Debug, Parser)]
+#[command(author, version, about, long_about = None)]
+pub struct Cli {
+    /// Path to a CoCoKeyprovider config file. Supported formats: TOML, YAML, JSON and possibly other formats
+    /// supported by the `config` crate.
+    #[arg(short, long)]
+    pub config_file: String,
+}