ctr-decoder pkcs11

[JimmyTab]

Can you point ctr-decoder to a private pkcs11 key config?

[stefanberger]

Yes, an example is in a test case.

A pkcs11 URI used by ctr is actually embedded in a file since some pkcs11 drivers need environment variables set etc.:

imgcrypt/script/tests/test_encryption.sh

Lines 1050 to 1056 in 87a6c43

	cat <<_EOF_ >${SOFTHSM_KEY}
	pkcs11:
	uri: ${keyuri}
	module:
	env:
	SOFTHSM2_CONF: ${SOFTHSM_SETUP_CONFIGDIR}/softhsm2.conf
	_EOF_

The file containing the pkcs11 URI is then used to decrypt an image:

imgcrypt/script/tests/test_encryption.sh

Lines 1089 to 1092 in 87a6c43

	for privkey in ${SOFTHSM_KEY}; do
	$CTR images decrypt \
	--key ${privkey} \
	${ALPINE_ENC} ${ALPINE_DEC}

[JimmyTab]

sorry not ctr-decoder.. ctd-decoder, can you point to a pkcs11 key file using --decryption-keys-path similar to config file created here https://github.com/containerd/imgcrypt in the README.md. I am currently able to successfully decrypt using the " ctr image decrypt --key "command. otherwise decryption via pkcs11 would be limited to CLI.

[stefanberger]

You have to use the ctr-enc tool to interact with containerd and pass the key file as shown in the test script above.