Add GCP KMS support (#73)

* Add GCP KMS support

pkg/signerverifier/gcp.go

@@ -0,0 +1,28 @@
+package signerverifier
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	gcpsigner "github.com/sigstore/sigstore/pkg/signature/kms/gcp"
+	"google.golang.org/api/option"
+)
+
+// using GCP KMS
+// reference should be in the format projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEY_RING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]
+func GetGCPSigner(ctx context.Context, reference string, opts ...option.ClientOption) (dsse.SignerVerifier, error) {
+	reference = fmt.Sprintf("gcpkms://%s", reference)
+	sv, err := gcpsigner.LoadSignerVerifier(ctx, reference, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("error loading gcp signer verifier: %w", err)
+	}
+	cs, _, err := sv.CryptoSigner(ctx, func(err error) {})
+	if err != nil {
+		return nil, fmt.Errorf("error getting gcp crypto signer: %w", err)
+	}
+	signer := &ECDSA256_SignerVerifier{
+		Signer: cs,
+	}
+	return signer, nil
+}

pkg/signerverifier/gcp_test.go

@@ -0,0 +1,33 @@
+package signerverifier
+
+const publicKeyPEM = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMswW3iu7PR/rWTQjlhVmUsPK7rF
+k2s4SO3XbQ2GG2alm289SUUpmBAuVxvT8muYQ8HC/QzixzyTACTXsBDjQg==
+-----END PUBLIC KEY-----`
+
+// to run locally, we need to impersonate the GCP service account
+// gcloud auth application-default login --impersonate-service-account attest-kms-test@attest-kms-test.iam.gserviceaccount.com
+
+// func TestGCPKMS_Signer(t *testing.T) {
+// 	// create a new signer
+// 	ctx := context.Background()
+// 	ref := "projects/attest-kms-test/locations/us-west1/keyRings/attest-kms-test/cryptoKeys/test-signing-key/cryptoKeyVersions/1"
+// 	signer, err := GetGCPSigner(ctx, ref)
+// 	require.NoError(t, err)
+// 	msg := []byte("hello world")
+// 	hash := util.SHA256(msg)
+
+// 	// sign message digest
+// 	sig, err := signer.Sign(ctx, hash)
+// 	require.NoError(t, err)
+// 	assert.NotEmpty(t, sig)
+// 	// get Key ID from signer
+// 	keyId, err := signer.KeyID()
+// 	require.NoError(t, err)
+// 	assert.NotEmpty(t, keyId)
+// 	publicKey, err := Parse([]byte(publicKeyPEM))
+// 	require.NoError(t, err)
+// 	// verify payload ecdsa signature
+// 	ok := ecdsa.VerifyASN1(publicKey, hash, sig)
+// 	assert.True(t, ok)
+// }