Sign with Google Cloud and a service account key file

[obones]

Hello,

I'm experimenting jsign with Google Cloud KMS and it works just fine with the syntax recommended in the documentation.
However, this uses a token from the gcloud CLI and it proves a bit difficult to automate on a headless system for me.
There is, however, the possibility to give google CLI tools the location of a json file containing the secret key for a service account to impersonate when using the API.
It's done via setting an environment variable:

set GOOGLE_APPLICATION_CREDENTIALS=C:\Path\To\credentials.json                             

This works fine with the CNG provider from Google, but I can't use it everywhere just like I would with jsign.
How can I specify the same value to jsign?
I tried removing the storepass option but it says it is required.
I tried giving a blank value (--storepass "") but it failed fetching the private key.
I tried using the file: prefix to point to the json file, but it stopped saying java.lang.IllegalArgumentException: Illegal character(s) in message header value

Thanks a lot for any suggestion.

[ebourg]

Jsign doesn't support the GOOGLE_APPLICATION_CREDENTIALS variable, you have to use the gcloud CLI to turn the secret key from credentials.json into an access token.

[obones]

Yes, the CNG provider indeed expects a fully qualified key version and fails with just the key name.

Where does the value after colon come from?
I have tried with --alias MyKeyName/cryptoKeyVersions/1 and just the "CryptoKey Signer/Verifier" role but it fails because jsign tries to use GetCryptoKeyVersion which is not granted by this role.
In the same situation, the CNG uses GetPublicKey just before calling AsymmetricSign but I don't know what it does with the result of the first call nor if it would be sufficient for jsign usage.

[ebourg]

Jsign needs to know the algorithm of the key (RSA or ECDSA), if it isn't provided it calls GetCryptoKeyVersion to get it. If the algorithm is appended after the version (for example myKeyName/cryptoKeyVersions/1:RSA), Jsign makes a direct call to asymmetricSign and doesn't require the viewer role.

[obones]

That's good to know, in my case it would ECDSA.
One thing to note though, is that the GetPublicKey API returns the algorithm for the key, if I read the documentation correctly. So maybe Jsign could use this API if the algorithm isn't provided and still not require the viewer role.

[ebourg]

I've updated the documentation to clarify the syntax of the alias parameter and the permissions required, thank you for your input. Also, the algorithm is now fetched from the certificate associated to the key, so the colon syntax is no longer necessary and one less API call is performed.

[obones]

Thanks, I'll make sure to update my scripts when a new version is out.