Move data encoding to vault client (spiffe#5058)

InverseIntegral · Sep 8, 2024 · ed6cb04 · ed6cb04
1 parent 9d3d15d
commit ed6cb04
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 8 deletions.
diff --git a/pkg/server/plugin/keymanager/hashicorpvault/hashicorp_vault.go b/pkg/server/plugin/keymanager/hashicorpvault/hashicorp_vault.go
@@ -3,7 +3,6 @@ package hashicorpvault
 import (
 	"context"
 	"crypto/sha256"
-	"encoding/base64"
 	"encoding/hex"
 	"encoding/pem"
 	"errors"
@@ -219,10 +218,7 @@ func (p *Plugin) SignData(ctx context.Context, req *keymanagerv1.SignDataRequest
 		}
 	}
 
-	// TODO: Should the encoding be done in SignData?
-	encodedData := base64.StdEncoding.EncodeToString(req.Data)
-
-	signature, err := p.vc.SignData(ctx, req.KeyId, encodedData, hashAlgo, signingAlgo)
+	signature, err := p.vc.SignData(ctx, req.KeyId, req.Data, hashAlgo, signingAlgo)
 	if err != nil {
 		return nil, err
 	}

diff --git a/pkg/server/plugin/keymanager/hashicorpvault/vault_client.go b/pkg/server/plugin/keymanager/hashicorpvault/vault_client.go
@@ -39,7 +39,7 @@ const (
 type cloudKeyManagementService interface {
 	CreateKey(ctx context.Context, spireKeyID string, keyType TransitKeyType) error
 	GetKey(ctx context.Context, spireKeyID string) (string, error)
-	SignData(ctx context.Context, spireKeyID string, data string, hashAlgo TransitHashAlgorithm, signatureAlgo TransitSignatureAlgorithm) ([]byte, error)
+	SignData(ctx context.Context, spireKeyID string, data []byte, hashAlgo TransitHashAlgorithm, signatureAlgo TransitSignatureAlgorithm) ([]byte, error)
 }
 
 type AuthMethod int
@@ -423,9 +423,11 @@ func (c *Client) GetKey(ctx context.Context, spireKeyID string) (string, error)
 	return pkStr, nil
 }
 
-func (c *Client) SignData(ctx context.Context, spireKeyID string, data string, hashAlgo TransitHashAlgorithm, signatureAlgo TransitSignatureAlgorithm) ([]byte, error) {
+func (c *Client) SignData(ctx context.Context, spireKeyID string, data []byte, hashAlgo TransitHashAlgorithm, signatureAlgo TransitSignatureAlgorithm) ([]byte, error) {
+	encodedData := base64.StdEncoding.EncodeToString(data)
+
 	body := map[string]interface{}{
-		"input":                 data,
+		"input":                 encodedData,
 		"signature_algorithm":   signatureAlgo,
 		"marshalling_algorithm": "asn1",
 		"prehashed":             "true",