Add plugin interface for out-of-tree KMS providers

[bobcallaway]

Description

Investigate using go-plugin as an approach for out-of-tree KMS providers to integrate with Sigstore tooling without merging code into this repo.

I believe this is the correct interface to base the plugin design off of:

sigstore/pkg/signature/kms/kms.go

Line 72 in 8a49902

type SignerVerifier interface {

[haydentherapper]

Two other possible approaches:

• Go's plugin support. This notes that it only works on certain Linux distros and macOS so it's probably not the best approach
• kubectl has support for plugins. I haven't dug in yet, but given kubectl is written in go, I assume this either uses either the above or go-plugin, or something that's been written from scratch that we could maybe reuse.

[bobcallaway]

Two other possible approaches:

• Go's plugin support. This notes that it only works on certain Linux distros and macOS so it's probably not the best approach

Given lack of portability this is probably a non-starter

• kubectl has support for plugins. I haven't dug in yet, but given kubectl is written in go, I assume this either uses either the above or go-plugin, or something that's been written from scratch that we could maybe reuse.

this seems to be based on a convention of a separate binary being named kubectl-foo-bar and just launching that child process.

[akljph]

Hey Team - how close or far away are we from some sort decision on this and can we be of any help here?

[haydentherapper]

The go-plugin library seems like the most promising solution. We haven't started working on this yet. Are you interested in implementing it?

[akljph]

No promises, but I am talking to my dev team to potentially build it. I will get back to you when I have more info.

Update: Not sure we will be able to get to this as our team is quite busy.

[akljph]

@haydentherapper @bobcallaway any chance you and the team of contributors are going to get to this at some point? Unfortunately, we don't have the time.

[haydentherapper]

Yes, we're planning to take a look at this shortly.

[akljph]

Just another follow up on this one. Hope it's coming soon, and thanks so much for all your hard work 🙏

[ramonpetgrave64]

To update, we've started to take a look and experiment with this.

[ramonpetgrave64]

Draft PR and spec Link here. #1901

[haydentherapper]

This is now complete.