feat(cas): Azure Blob Storage support #360
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
migmartri
changed the title
migmartri
commented
Sep 27, 2023
| @@ -161,6 +164,11 @@ func (s *ByteStreamService) Read(req *bytestream.ReadRequest, stream bytestream. | |||
| return sl.LogAndMaskErr(err, s.log) | |||
| } | |||
|
|
|||
| // check if the file has been tampered with and notify the client | |||
| if sw.GetChecksum() != req.ResourceName { | |||
There was a problem hiding this comment.
This is a verification server-side that the file has not been tampered with and we deliver only the file if it matches the digest. Note that we already do this check client-side but now server side makes it more robust.
|
|
||
| // Verify the checksum | ||
| if got, want := fmt.Sprintf("%x", gotChecksum.Sum(nil)), wantChecksum.Hex; got != want { | ||
| msg := fmt.Sprintf("checksums mismatch: got: %s, want: %s", got, want) |
There was a problem hiding this comment.
same here, we only push content to the browser if we know it matches the digest.
| @@ -33,8 +35,7 @@ import ( | |||
| type CASBackendProvider string | |||
|
|
|||
| const ( | |||
| CASBackendOCI CASBackendProvider = "OCI" | |||
There was a problem hiding this comment.
not needed, removed duplication.
| @@ -86,7 +86,7 @@ func (s *CASBackendService) Create(ctx context.Context, req *pb.CASBackendServic | |||
| } | |||
|
|
|||
| // For now we only support one backend which is set as default | |||
| res, err := s.uc.Create(ctx, currentOrg.ID, req.Location, req.Description, biz.CASBackendOCI, creds, req.Default) | |||
| res, err := s.uc.Create(ctx, currentOrg.ID, req.Location, req.Description, biz.CASBackendProvider(req.Provider), creds, req.Default) | |||
There was a problem hiding this comment.
so now we create other kinds of backends, specifically azureBlob
| @@ -17,6 +16,6 @@ data: | |||
| private_key: /data/server-certs/tls.key | |||
| {{- end }} | |||
| addr: 0.0.0.0:9000 | |||
| timeout: 1s | |||
| timeout: 5s | |||
There was a problem hiding this comment.
needed to make sure we leave room for the azure requests.
danlishka
approved these changes
Sep 27, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds support for Azure Blob Storage as Content Addressable Storage backend.
In practice this means:
Users can now onboard their Azure Storage Account with Chainloop
once done, it will appear in your list of registered backends
At this point there is nothing else that an user needs to do, the system automatically will upload attestations and pieces of evidence to the storageAccount/container automatically :)
Note that you can use this backend in combination of an OCI one, meaning that files that have been uploaded to an OCI backend are still accessible and routed accordingly
Refs #357