/
helpers.go
61 lines (51 loc) · 1.53 KB
/
helpers.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
package google
import (
"context"
"fmt"
"strings"
"github.com/onflow/flow-go-sdk/crypto/cloudkms"
kms "cloud.google.com/go/kms/apiv1"
kmspb "google.golang.org/genproto/googleapis/cloud/kms/v1"
)
// AsymKey creates a new asymmetric signing key in Google KMS and returns
// a cloudkms.Key (the "raw" result isn't needed)
func AsymKey(ctx context.Context, parent, id string) (*cloudkms.Key, error) {
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
return nil, err
}
// Close the client connection to avoid leaking goroutines
defer c.Close()
r := &kmspb.CreateCryptoKeyRequest{
Parent: parent,
CryptoKeyId: id,
CryptoKey: &kmspb.CryptoKey{
Purpose: kmspb.CryptoKey_ASYMMETRIC_SIGN,
VersionTemplate: &kmspb.CryptoKeyVersionTemplate{
Algorithm: kmspb.CryptoKeyVersion_EC_SIGN_P256_SHA256,
},
// TODO: Set relevant labels at creation, update post-creation if necessary
Labels: map[string]string{
"service": "flow-wallet-api",
"account_address": "",
"chain_id": "",
"environment": "",
},
},
}
gk, err := c.CreateCryptoKey(ctx, r)
if err != nil {
return nil, err
}
// Append cryptoKeyVersions so that we can utilize the KeyFromResourceID method
k, err := cloudkms.KeyFromResourceID(fmt.Sprintf("%s/cryptoKeyVersions/1", gk.Name))
if err != nil {
return nil, err
}
// Validate key name
if !strings.HasPrefix(k.ResourceID(), gk.Name) {
err := fmt.Errorf("WARNING: created Google KMS key name does not match the expected")
return nil, err
}
return &k, nil
}