google-cloud-confidential_computing-v1 0.1.0 → 0.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +2 -2
- data/lib/google/cloud/confidential_computing/v1/confidential_computing/client.rb +10 -3
- data/lib/google/cloud/confidential_computing/v1/confidential_computing/rest/client.rb +10 -3
- data/lib/google/cloud/confidential_computing/v1/confidential_computing/rest/service_stub.rb +2 -2
- data/lib/google/cloud/confidential_computing/v1/version.rb +1 -1
- data/lib/google/cloud/confidentialcomputing/v1/service_pb.rb +30 -36
- data/proto_docs/google/api/client.rb +10 -1
- data/proto_docs/google/cloud/confidentialcomputing/v1/service.rb +86 -0
- data/proto_docs/google/protobuf/any.rb +7 -4
- data/proto_docs/google/protobuf/timestamp.rb +1 -3
- metadata +6 -7
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 42039146f14516a23edf4f069c0615b24f78b09b2736739975f86ae8e893d36f
|
|
4
|
+
data.tar.gz: ca62b162855d6a5e72f9a843222c1e3152af6bbe847455bf4281801820df3fad
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7f3c8b442a563e8bc0650ec89f89be9c63b2578e811ef55d317689238a7fdbc44baaafb26797c62026a6f42f13a115e53c5849b0d4364ef081d2456829abf568
|
|
7
|
+
data.tar.gz: d1e1b94eefcccf653ee9986e29fce14b286b0e88d19d72ce79b67a24741a6a59d23eef490e781b89650873bde006b3a8faccfc29c90f5d97cb01327a52dea3b6
|
data/README.md
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
# Ruby Client for the Confidential Computing V1 API
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Attestation verifier for Confidential Space.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
Attestation verifier for Confidential Space.
|
|
6
6
|
|
|
7
7
|
https://github.com/googleapis/google-cloud-ruby
|
|
8
8
|
|
|
@@ -136,7 +136,7 @@ module Google
|
|
|
136
136
|
credentials = @config.credentials
|
|
137
137
|
# Use self-signed JWT if the endpoint is unchanged from default,
|
|
138
138
|
# but only if the default endpoint does not have a region prefix.
|
|
139
|
-
enable_self_signed_jwt = @config.endpoint ==
|
|
139
|
+
enable_self_signed_jwt = @config.endpoint == Configuration::DEFAULT_ENDPOINT &&
|
|
140
140
|
!@config.endpoint.split(".").first.include?("-")
|
|
141
141
|
credentials ||= Credentials.default scope: @config.scope,
|
|
142
142
|
enable_self_signed_jwt: enable_self_signed_jwt
|
|
@@ -272,7 +272,7 @@ module Google
|
|
|
272
272
|
# @param options [::Gapic::CallOptions, ::Hash]
|
|
273
273
|
# Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
|
|
274
274
|
#
|
|
275
|
-
# @overload verify_attestation(challenge: nil, gcp_credentials: nil, tpm_attestation: nil)
|
|
275
|
+
# @overload verify_attestation(challenge: nil, gcp_credentials: nil, tpm_attestation: nil, confidential_space_info: nil, token_options: nil)
|
|
276
276
|
# Pass arguments to `verify_attestation` via keyword arguments. Note that at
|
|
277
277
|
# least one keyword argument is required. To specify no parameters, or to keep all
|
|
278
278
|
# the default parameter values, pass an empty Hash as a request object (see above).
|
|
@@ -287,6 +287,11 @@ module Google
|
|
|
287
287
|
# @param tpm_attestation [::Google::Cloud::ConfidentialComputing::V1::TpmAttestation, ::Hash]
|
|
288
288
|
# Required. The TPM-specific data provided by the attesting platform, used to
|
|
289
289
|
# populate any of the claims regarding platform state.
|
|
290
|
+
# @param confidential_space_info [::Google::Cloud::ConfidentialComputing::V1::ConfidentialSpaceInfo, ::Hash]
|
|
291
|
+
# Optional. Optional information related to the Confidential Space TEE.
|
|
292
|
+
# @param token_options [::Google::Cloud::ConfidentialComputing::V1::TokenOptions, ::Hash]
|
|
293
|
+
# Optional. A collection of optional, workload-specified claims that modify
|
|
294
|
+
# the token output.
|
|
290
295
|
#
|
|
291
296
|
# @yield [response, operation] Access the result along with the RPC operation
|
|
292
297
|
# @yieldparam response [::Google::Cloud::ConfidentialComputing::V1::VerifyAttestationResponse]
|
|
@@ -434,7 +439,9 @@ module Google
|
|
|
434
439
|
class Configuration
|
|
435
440
|
extend ::Gapic::Config
|
|
436
441
|
|
|
437
|
-
|
|
442
|
+
DEFAULT_ENDPOINT = "confidentialcomputing.googleapis.com"
|
|
443
|
+
|
|
444
|
+
config_attr :endpoint, DEFAULT_ENDPOINT, ::String
|
|
438
445
|
config_attr :credentials, nil do |value|
|
|
439
446
|
allowed = [::String, ::Hash, ::Proc, ::Symbol, ::Google::Auth::Credentials, ::Signet::OAuth2::Client, nil]
|
|
440
447
|
allowed += [::GRPC::Core::Channel, ::GRPC::Core::ChannelCredentials] if defined? ::GRPC
|
|
@@ -132,7 +132,7 @@ module Google
|
|
|
132
132
|
credentials = @config.credentials
|
|
133
133
|
# Use self-signed JWT if the endpoint is unchanged from default,
|
|
134
134
|
# but only if the default endpoint does not have a region prefix.
|
|
135
|
-
enable_self_signed_jwt = @config.endpoint ==
|
|
135
|
+
enable_self_signed_jwt = @config.endpoint == Configuration::DEFAULT_ENDPOINT &&
|
|
136
136
|
!@config.endpoint.split(".").first.include?("-")
|
|
137
137
|
credentials ||= Credentials.default scope: @config.scope,
|
|
138
138
|
enable_self_signed_jwt: enable_self_signed_jwt
|
|
@@ -241,7 +241,7 @@ module Google
|
|
|
241
241
|
# @param options [::Gapic::CallOptions, ::Hash]
|
|
242
242
|
# Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
|
|
243
243
|
#
|
|
244
|
-
# @overload verify_attestation(challenge: nil, gcp_credentials: nil, tpm_attestation: nil)
|
|
244
|
+
# @overload verify_attestation(challenge: nil, gcp_credentials: nil, tpm_attestation: nil, confidential_space_info: nil, token_options: nil)
|
|
245
245
|
# Pass arguments to `verify_attestation` via keyword arguments. Note that at
|
|
246
246
|
# least one keyword argument is required. To specify no parameters, or to keep all
|
|
247
247
|
# the default parameter values, pass an empty Hash as a request object (see above).
|
|
@@ -256,6 +256,11 @@ module Google
|
|
|
256
256
|
# @param tpm_attestation [::Google::Cloud::ConfidentialComputing::V1::TpmAttestation, ::Hash]
|
|
257
257
|
# Required. The TPM-specific data provided by the attesting platform, used to
|
|
258
258
|
# populate any of the claims regarding platform state.
|
|
259
|
+
# @param confidential_space_info [::Google::Cloud::ConfidentialComputing::V1::ConfidentialSpaceInfo, ::Hash]
|
|
260
|
+
# Optional. Optional information related to the Confidential Space TEE.
|
|
261
|
+
# @param token_options [::Google::Cloud::ConfidentialComputing::V1::TokenOptions, ::Hash]
|
|
262
|
+
# Optional. A collection of optional, workload-specified claims that modify
|
|
263
|
+
# the token output.
|
|
259
264
|
# @yield [result, operation] Access the result along with the TransportOperation object
|
|
260
265
|
# @yieldparam result [::Google::Cloud::ConfidentialComputing::V1::VerifyAttestationResponse]
|
|
261
266
|
# @yieldparam operation [::Gapic::Rest::TransportOperation]
|
|
@@ -371,7 +376,9 @@ module Google
|
|
|
371
376
|
class Configuration
|
|
372
377
|
extend ::Gapic::Config
|
|
373
378
|
|
|
374
|
-
|
|
379
|
+
DEFAULT_ENDPOINT = "confidentialcomputing.googleapis.com"
|
|
380
|
+
|
|
381
|
+
config_attr :endpoint, DEFAULT_ENDPOINT, ::String
|
|
375
382
|
config_attr :credentials, nil do |value|
|
|
376
383
|
allowed = [::String, ::Hash, ::Proc, ::Symbol, ::Google::Auth::Credentials, ::Signet::OAuth2::Client, nil]
|
|
377
384
|
allowed.any? { |klass| klass === value }
|
|
@@ -59,7 +59,7 @@ module Google
|
|
|
59
59
|
|
|
60
60
|
verb, uri, query_string_params, body = ServiceStub.transcode_create_challenge_request request_pb
|
|
61
61
|
query_string_params = if query_string_params.any?
|
|
62
|
-
query_string_params.to_h { |p| p.split
|
|
62
|
+
query_string_params.to_h { |p| p.split "=", 2 }
|
|
63
63
|
else
|
|
64
64
|
{}
|
|
65
65
|
end
|
|
@@ -97,7 +97,7 @@ module Google
|
|
|
97
97
|
|
|
98
98
|
verb, uri, query_string_params, body = ServiceStub.transcode_verify_attestation_request request_pb
|
|
99
99
|
query_string_params = if query_string_params.any?
|
|
100
|
-
query_string_params.to_h { |p| p.split
|
|
100
|
+
query_string_params.to_h { |p| p.split "=", 2 }
|
|
101
101
|
else
|
|
102
102
|
{}
|
|
103
103
|
end
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
1
2
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
|
2
3
|
# source: google/cloud/confidentialcomputing/v1/service.proto
|
|
3
4
|
|
|
@@ -9,44 +10,32 @@ require 'google/api/field_behavior_pb'
|
|
|
9
10
|
require 'google/api/resource_pb'
|
|
10
11
|
require 'google/protobuf/timestamp_pb'
|
|
11
12
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
repeated :service_account_id_tokens, :string, 2
|
|
35
|
-
end
|
|
36
|
-
add_message "google.cloud.confidentialcomputing.v1.TpmAttestation" do
|
|
37
|
-
repeated :quotes, :message, 1, "google.cloud.confidentialcomputing.v1.TpmAttestation.Quote"
|
|
38
|
-
optional :tcg_event_log, :bytes, 2
|
|
39
|
-
optional :canonical_event_log, :bytes, 3
|
|
40
|
-
optional :ak_cert, :bytes, 4
|
|
41
|
-
repeated :cert_chain, :bytes, 5
|
|
42
|
-
end
|
|
43
|
-
add_message "google.cloud.confidentialcomputing.v1.TpmAttestation.Quote" do
|
|
44
|
-
optional :hash_algo, :int32, 1
|
|
45
|
-
map :pcr_values, :int32, :bytes, 2
|
|
46
|
-
optional :raw_quote, :bytes, 3
|
|
47
|
-
optional :raw_signature, :bytes, 4
|
|
13
|
+
|
|
14
|
+
descriptor_data = "\n3google/cloud/confidentialcomputing/v1/service.proto\x12%google.cloud.confidentialcomputing.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xa5\x02\n\tChallenge\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0b\x63reate_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x34\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x11\n\x04used\x18\x04 \x01(\x08\x42\x03\xe0\x41\x03\x12\x16\n\ttpm_nonce\x18\x06 \x01(\tB\x03\xe0\x41\x03:n\xea\x41k\n.confidentialcomputing.googleapis.com/Challenge\x12\x39projects/{project}/locations/{location}/challenges/{uuid}\"\x9d\x01\n\x16\x43reateChallengeRequest\x12\x39\n\x06parent\x18\x01 \x01(\tB)\xe0\x41\x02\xfa\x41#\n!locations.googleapis.com/Location\x12H\n\tchallenge\x18\x02 \x01(\x0b\x32\x30.google.cloud.confidentialcomputing.v1.ChallengeB\x03\xe0\x41\x02\"\xc4\x03\n\x18VerifyAttestationRequest\x12I\n\tchallenge\x18\x01 \x01(\tB6\xe0\x41\x02\xfa\x41\x30\n.confidentialcomputing.googleapis.com/Challenge\x12S\n\x0fgcp_credentials\x18\x02 \x01(\x0b\x32\x35.google.cloud.confidentialcomputing.v1.GcpCredentialsB\x03\xe0\x41\x01\x12S\n\x0ftpm_attestation\x18\x03 \x01(\x0b\x32\x35.google.cloud.confidentialcomputing.v1.TpmAttestationB\x03\xe0\x41\x02\x12\x62\n\x17\x63onfidential_space_info\x18\x04 \x01(\x0b\x32<.google.cloud.confidentialcomputing.v1.ConfidentialSpaceInfoB\x03\xe0\x41\x01\x12O\n\rtoken_options\x18\x05 \x01(\x0b\x32\x33.google.cloud.confidentialcomputing.v1.TokenOptionsB\x03\xe0\x41\x01\";\n\x19VerifyAttestationResponse\x12\x1e\n\x11oidc_claims_token\x18\x02 \x01(\tB\x03\xe0\x41\x03\"3\n\x0eGcpCredentials\x12!\n\x19service_account_id_tokens\x18\x02 \x03(\t\"9\n\x0cTokenOptions\x12\x15\n\x08\x61udience\x18\x01 \x01(\tB\x03\xe0\x41\x01\x12\x12\n\x05nonce\x18\x02 \x03(\tB\x03\xe0\x41\x01\"\x8f\x03\n\x0eTpmAttestation\x12K\n\x06quotes\x18\x01 \x03(\x0b\x32;.google.cloud.confidentialcomputing.v1.TpmAttestation.Quote\x12\x15\n\rtcg_event_log\x18\x02 \x01(\x0c\x12\x1b\n\x13\x63\x61nonical_event_log\x18\x03 \x01(\x0c\x12\x0f\n\x07\x61k_cert\x18\x04 \x01(\x0c\x12\x12\n\ncert_chain\x18\x05 \x03(\x0c\x1a\xd6\x01\n\x05Quote\x12\x11\n\thash_algo\x18\x01 \x01(\x05\x12^\n\npcr_values\x18\x02 \x03(\x0b\x32J.google.cloud.confidentialcomputing.v1.TpmAttestation.Quote.PcrValuesEntry\x12\x11\n\traw_quote\x18\x03 \x01(\x0c\x12\x15\n\rraw_signature\x18\x04 \x01(\x0c\x1a\x30\n\x0ePcrValuesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x05\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\"j\n\x15\x43onfidentialSpaceInfo\x12Q\n\x0fsigned_entities\x18\x01 \x03(\x0b\x32\x33.google.cloud.confidentialcomputing.v1.SignedEntityB\x03\xe0\x41\x01\"w\n\x0cSignedEntity\x12g\n\x1a\x63ontainer_image_signatures\x18\x01 \x03(\x0b\x32>.google.cloud.confidentialcomputing.v1.ContainerImageSignatureB\x03\xe0\x41\x01\"\xaf\x01\n\x17\x43ontainerImageSignature\x12\x14\n\x07payload\x18\x01 \x01(\x0c\x42\x03\xe0\x41\x02\x12\x16\n\tsignature\x18\x02 \x01(\x0c\x42\x03\xe0\x41\x02\x12\x17\n\npublic_key\x18\x03 \x01(\x0c\x42\x03\xe0\x41\x02\x12M\n\x07sig_alg\x18\x04 \x01(\x0e\x32\x37.google.cloud.confidentialcomputing.v1.SigningAlgorithmB\x03\xe0\x41\x02*\x7f\n\x10SigningAlgorithm\x12!\n\x1dSIGNING_ALGORITHM_UNSPECIFIED\x10\x00\x12\x15\n\x11RSASSA_PSS_SHA256\x10\x01\x12\x1a\n\x16RSASSA_PKCS1V15_SHA256\x10\x02\x12\x15\n\x11\x45\x43\x44SA_P256_SHA256\x10\x03\x32\xb7\x04\n\x15\x43onfidentialComputing\x12\xd8\x01\n\x0f\x43reateChallenge\x12=.google.cloud.confidentialcomputing.v1.CreateChallengeRequest\x1a\x30.google.cloud.confidentialcomputing.v1.Challenge\"T\x82\xd3\xe4\x93\x02;\"./v1/{parent=projects/*/locations/*}/challenges:\tchallenge\xda\x41\x10parent,challenge\x12\xe8\x01\n\x11VerifyAttestation\x12?.google.cloud.confidentialcomputing.v1.VerifyAttestationRequest\x1a@.google.cloud.confidentialcomputing.v1.VerifyAttestationResponse\"P\x82\xd3\xe4\x93\x02J\"E/v1/{challenge=projects/*/locations/*/challenges/*}:verifyAttestation:\x01*\x1aX\xca\x41$confidentialcomputing.googleapis.com\xd2\x41.https://www.googleapis.com/auth/cloud-platformB\x97\x02\n)com.google.cloud.confidentialcomputing.v1B\x0cServiceProtoP\x01Z_cloud.google.com/go/confidentialcomputing/apiv1/confidentialcomputingpb;confidentialcomputingpb\xaa\x02%Google.Cloud.ConfidentialComputing.V1\xca\x02%Google\\Cloud\\ConfidentialComputing\\V1\xea\x02(Google::Cloud::ConfidentialComputing::V1b\x06proto3"
|
|
15
|
+
|
|
16
|
+
pool = Google::Protobuf::DescriptorPool.generated_pool
|
|
17
|
+
|
|
18
|
+
begin
|
|
19
|
+
pool.add_serialized_file(descriptor_data)
|
|
20
|
+
rescue TypeError => e
|
|
21
|
+
# Compatibility code: will be removed in the next major version.
|
|
22
|
+
require 'google/protobuf/descriptor_pb'
|
|
23
|
+
parsed = Google::Protobuf::FileDescriptorProto.decode(descriptor_data)
|
|
24
|
+
parsed.clear_dependency
|
|
25
|
+
serialized = parsed.class.encode(parsed)
|
|
26
|
+
file = pool.add_serialized_file(serialized)
|
|
27
|
+
warn "Warning: Protobuf detected an import path issue while loading generated file #{__FILE__}"
|
|
28
|
+
imports = [
|
|
29
|
+
["google.protobuf.Timestamp", "google/protobuf/timestamp.proto"],
|
|
30
|
+
]
|
|
31
|
+
imports.each do |type_name, expected_filename|
|
|
32
|
+
import_file = pool.lookup(type_name).file_descriptor
|
|
33
|
+
if import_file.name != expected_filename
|
|
34
|
+
warn "- #{file.name} imports #{expected_filename}, but that import was loaded as #{import_file.name}"
|
|
48
35
|
end
|
|
49
36
|
end
|
|
37
|
+
warn "Each proto file must use a consistent fully-qualified name."
|
|
38
|
+
warn "This will become an error in the next major version."
|
|
50
39
|
end
|
|
51
40
|
|
|
52
41
|
module Google
|
|
@@ -58,8 +47,13 @@ module Google
|
|
|
58
47
|
VerifyAttestationRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.VerifyAttestationRequest").msgclass
|
|
59
48
|
VerifyAttestationResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.VerifyAttestationResponse").msgclass
|
|
60
49
|
GcpCredentials = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.GcpCredentials").msgclass
|
|
50
|
+
TokenOptions = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.TokenOptions").msgclass
|
|
61
51
|
TpmAttestation = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.TpmAttestation").msgclass
|
|
62
52
|
TpmAttestation::Quote = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.TpmAttestation.Quote").msgclass
|
|
53
|
+
ConfidentialSpaceInfo = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.ConfidentialSpaceInfo").msgclass
|
|
54
|
+
SignedEntity = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.SignedEntity").msgclass
|
|
55
|
+
ContainerImageSignature = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.ContainerImageSignature").msgclass
|
|
56
|
+
SigningAlgorithm = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.confidentialcomputing.v1.SigningAlgorithm").enummodule
|
|
63
57
|
end
|
|
64
58
|
end
|
|
65
59
|
end
|
|
@@ -83,7 +83,7 @@ module Google
|
|
|
83
83
|
# long-running operation pattern.
|
|
84
84
|
# @!attribute [rw] new_issue_uri
|
|
85
85
|
# @return [::String]
|
|
86
|
-
# Link to a
|
|
86
|
+
# Link to a *public* URI where users can report issues. Example:
|
|
87
87
|
# https://issuetracker.google.com/issues/new?component=190865&template=1161103
|
|
88
88
|
# @!attribute [rw] documentation_uri
|
|
89
89
|
# @return [::String]
|
|
@@ -353,6 +353,15 @@ module Google
|
|
|
353
353
|
|
|
354
354
|
# Street View Org.
|
|
355
355
|
STREET_VIEW = 4
|
|
356
|
+
|
|
357
|
+
# Shopping Org.
|
|
358
|
+
SHOPPING = 5
|
|
359
|
+
|
|
360
|
+
# Geo Org.
|
|
361
|
+
GEO = 6
|
|
362
|
+
|
|
363
|
+
# Generative AI - https://developers.generativeai.google
|
|
364
|
+
GENERATIVE_AI = 7
|
|
356
365
|
end
|
|
357
366
|
|
|
358
367
|
# To where should client libraries be published?
|
|
@@ -73,6 +73,13 @@ module Google
|
|
|
73
73
|
# @return [::Google::Cloud::ConfidentialComputing::V1::TpmAttestation]
|
|
74
74
|
# Required. The TPM-specific data provided by the attesting platform, used to
|
|
75
75
|
# populate any of the claims regarding platform state.
|
|
76
|
+
# @!attribute [rw] confidential_space_info
|
|
77
|
+
# @return [::Google::Cloud::ConfidentialComputing::V1::ConfidentialSpaceInfo]
|
|
78
|
+
# Optional. Optional information related to the Confidential Space TEE.
|
|
79
|
+
# @!attribute [rw] token_options
|
|
80
|
+
# @return [::Google::Cloud::ConfidentialComputing::V1::TokenOptions]
|
|
81
|
+
# Optional. A collection of optional, workload-specified claims that modify
|
|
82
|
+
# the token output.
|
|
76
83
|
class VerifyAttestationRequest
|
|
77
84
|
include ::Google::Protobuf::MessageExts
|
|
78
85
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -98,6 +105,21 @@ module Google
|
|
|
98
105
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
99
106
|
end
|
|
100
107
|
|
|
108
|
+
# Options to modify claims in the token to generate custom-purpose tokens.
|
|
109
|
+
# @!attribute [rw] audience
|
|
110
|
+
# @return [::String]
|
|
111
|
+
# Optional. Optional string to issue the token with a custom audience claim.
|
|
112
|
+
# Required if one or more nonces are specified.
|
|
113
|
+
# @!attribute [rw] nonce
|
|
114
|
+
# @return [::Array<::String>]
|
|
115
|
+
# Optional. Optional parameter to place one or more nonces in the eat_nonce
|
|
116
|
+
# claim in the output token. The minimum size for JSON-encoded EATs is 10
|
|
117
|
+
# bytes and the maximum size is 74 bytes.
|
|
118
|
+
class TokenOptions
|
|
119
|
+
include ::Google::Protobuf::MessageExts
|
|
120
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
121
|
+
end
|
|
122
|
+
|
|
101
123
|
# TPM2 data containing everything necessary to validate any platform state
|
|
102
124
|
# measured into the TPM.
|
|
103
125
|
# @!attribute [rw] quotes
|
|
@@ -153,6 +175,70 @@ module Google
|
|
|
153
175
|
end
|
|
154
176
|
end
|
|
155
177
|
end
|
|
178
|
+
|
|
179
|
+
# ConfidentialSpaceInfo contains information related to the Confidential Space
|
|
180
|
+
# TEE.
|
|
181
|
+
# @!attribute [rw] signed_entities
|
|
182
|
+
# @return [::Array<::Google::Cloud::ConfidentialComputing::V1::SignedEntity>]
|
|
183
|
+
# Optional. A list of signed entities containing container image signatures
|
|
184
|
+
# that can be used for server-side signature verification.
|
|
185
|
+
class ConfidentialSpaceInfo
|
|
186
|
+
include ::Google::Protobuf::MessageExts
|
|
187
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
188
|
+
end
|
|
189
|
+
|
|
190
|
+
# SignedEntity represents an OCI image object containing everything necessary
|
|
191
|
+
# to verify container image signatures.
|
|
192
|
+
# @!attribute [rw] container_image_signatures
|
|
193
|
+
# @return [::Array<::Google::Cloud::ConfidentialComputing::V1::ContainerImageSignature>]
|
|
194
|
+
# Optional. A list of container image signatures attached to an OCI image
|
|
195
|
+
# object.
|
|
196
|
+
class SignedEntity
|
|
197
|
+
include ::Google::Protobuf::MessageExts
|
|
198
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
199
|
+
end
|
|
200
|
+
|
|
201
|
+
# ContainerImageSignature holds necessary metadata to verify a container image
|
|
202
|
+
# signature.
|
|
203
|
+
# @!attribute [rw] payload
|
|
204
|
+
# @return [::String]
|
|
205
|
+
# Required. The binary signature payload following the SimpleSigning format
|
|
206
|
+
# https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#simple-signing.
|
|
207
|
+
# This payload includes the container image digest.
|
|
208
|
+
# @!attribute [rw] signature
|
|
209
|
+
# @return [::String]
|
|
210
|
+
# Required. A signature over the payload.
|
|
211
|
+
# The container image digest is incorporated into the signature as follows:
|
|
212
|
+
# 1. Generate a SimpleSigning format payload that includes the container
|
|
213
|
+
# image digest.
|
|
214
|
+
# 2. Generate a signature over SHA256 digest of the payload.
|
|
215
|
+
# The signature generation process can be represented as follows:
|
|
216
|
+
# `Sign(sha256(SimpleSigningPayload(sha256(Image Manifest))))`
|
|
217
|
+
# @!attribute [rw] public_key
|
|
218
|
+
# @return [::String]
|
|
219
|
+
# Required. An associated public key used to verify the signature.
|
|
220
|
+
# @!attribute [rw] sig_alg
|
|
221
|
+
# @return [::Google::Cloud::ConfidentialComputing::V1::SigningAlgorithm]
|
|
222
|
+
# Required. The algorithm used to produce the container image signature.
|
|
223
|
+
class ContainerImageSignature
|
|
224
|
+
include ::Google::Protobuf::MessageExts
|
|
225
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
226
|
+
end
|
|
227
|
+
|
|
228
|
+
# SigningAlgorithm enumerates all the supported signing algorithms.
|
|
229
|
+
module SigningAlgorithm
|
|
230
|
+
# Unspecified signing algorithm.
|
|
231
|
+
SIGNING_ALGORITHM_UNSPECIFIED = 0
|
|
232
|
+
|
|
233
|
+
# RSASSA-PSS with a SHA256 digest.
|
|
234
|
+
RSASSA_PSS_SHA256 = 1
|
|
235
|
+
|
|
236
|
+
# RSASSA-PKCS1 v1.5 with a SHA256 digest.
|
|
237
|
+
RSASSA_PKCS1V15_SHA256 = 2
|
|
238
|
+
|
|
239
|
+
# ECDSA on the P-256 Curve with a SHA256 digest.
|
|
240
|
+
ECDSA_P256_SHA256 = 3
|
|
241
|
+
end
|
|
156
242
|
end
|
|
157
243
|
end
|
|
158
244
|
end
|
|
@@ -43,8 +43,12 @@ module Google
|
|
|
43
43
|
# if (any.is(Foo.class)) {
|
|
44
44
|
# foo = any.unpack(Foo.class);
|
|
45
45
|
# }
|
|
46
|
+
# // or ...
|
|
47
|
+
# if (any.isSameTypeAs(Foo.getDefaultInstance())) {
|
|
48
|
+
# foo = any.unpack(Foo.getDefaultInstance());
|
|
49
|
+
# }
|
|
46
50
|
#
|
|
47
|
-
#
|
|
51
|
+
# Example 3: Pack and unpack a message in Python.
|
|
48
52
|
#
|
|
49
53
|
# foo = Foo(...)
|
|
50
54
|
# any = Any()
|
|
@@ -54,7 +58,7 @@ module Google
|
|
|
54
58
|
# any.Unpack(foo)
|
|
55
59
|
# ...
|
|
56
60
|
#
|
|
57
|
-
#
|
|
61
|
+
# Example 4: Pack and unpack a message in Go
|
|
58
62
|
#
|
|
59
63
|
# foo := &pb.Foo{...}
|
|
60
64
|
# any, err := anypb.New(foo)
|
|
@@ -73,9 +77,8 @@ module Google
|
|
|
73
77
|
# in the type URL, for example "foo.bar.com/x/y.z" will yield type
|
|
74
78
|
# name "y.z".
|
|
75
79
|
#
|
|
76
|
-
#
|
|
77
80
|
# JSON
|
|
78
|
-
#
|
|
81
|
+
# ====
|
|
79
82
|
# The JSON representation of an `Any` value uses the regular
|
|
80
83
|
# representation of the deserialized, embedded message, with an
|
|
81
84
|
# additional field `@type` which contains the type URL. Example:
|
|
@@ -69,7 +69,6 @@ module Google
|
|
|
69
69
|
# Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
|
|
70
70
|
# .setNanos((int) ((millis % 1000) * 1000000)).build();
|
|
71
71
|
#
|
|
72
|
-
#
|
|
73
72
|
# Example 5: Compute Timestamp from Java `Instant.now()`.
|
|
74
73
|
#
|
|
75
74
|
# Instant now = Instant.now();
|
|
@@ -78,7 +77,6 @@ module Google
|
|
|
78
77
|
# Timestamp.newBuilder().setSeconds(now.getEpochSecond())
|
|
79
78
|
# .setNanos(now.getNano()).build();
|
|
80
79
|
#
|
|
81
|
-
#
|
|
82
80
|
# Example 6: Compute Timestamp from current time in Python.
|
|
83
81
|
#
|
|
84
82
|
# timestamp = Timestamp()
|
|
@@ -108,7 +106,7 @@ module Google
|
|
|
108
106
|
# [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
|
|
109
107
|
# the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
|
|
110
108
|
# the Joda Time's [`ISODateTimeFormat.dateTime()`](
|
|
111
|
-
# http://
|
|
109
|
+
# http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
|
|
112
110
|
# ) to obtain a formatter capable of generating timestamps in this format.
|
|
113
111
|
# @!attribute [rw] seconds
|
|
114
112
|
# @return [::Integer]
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: google-cloud-confidential_computing-v1
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.3.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Google LLC
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2023-
|
|
11
|
+
date: 2023-07-27 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: gapic-common
|
|
@@ -16,7 +16,7 @@ dependencies:
|
|
|
16
16
|
requirements:
|
|
17
17
|
- - ">="
|
|
18
18
|
- !ruby/object:Gem::Version
|
|
19
|
-
version: 0.
|
|
19
|
+
version: 0.19.1
|
|
20
20
|
- - "<"
|
|
21
21
|
- !ruby/object:Gem::Version
|
|
22
22
|
version: 2.a
|
|
@@ -26,7 +26,7 @@ dependencies:
|
|
|
26
26
|
requirements:
|
|
27
27
|
- - ">="
|
|
28
28
|
- !ruby/object:Gem::Version
|
|
29
|
-
version: 0.
|
|
29
|
+
version: 0.19.1
|
|
30
30
|
- - "<"
|
|
31
31
|
- !ruby/object:Gem::Version
|
|
32
32
|
version: 2.a
|
|
@@ -176,8 +176,7 @@ dependencies:
|
|
|
176
176
|
- - "~>"
|
|
177
177
|
- !ruby/object:Gem::Version
|
|
178
178
|
version: '0.9'
|
|
179
|
-
description: google-cloud-confidential_computing-v1
|
|
180
|
-
for the Confidential Computing V1 API. Note that google-cloud-confidential_computing-v1
|
|
179
|
+
description: Attestation verifier for Confidential Space. Note that google-cloud-confidential_computing-v1
|
|
181
180
|
is a version-specific client library. For most uses, we recommend installing the
|
|
182
181
|
main client library google-cloud-confidential_computing instead. See the readme
|
|
183
182
|
for more details.
|
|
@@ -235,5 +234,5 @@ requirements: []
|
|
|
235
234
|
rubygems_version: 3.4.2
|
|
236
235
|
signing_key:
|
|
237
236
|
specification_version: 4
|
|
238
|
-
summary:
|
|
237
|
+
summary: Attestation verifier for Confidential Space.
|
|
239
238
|
test_files: []
|