Contrast for Multi-Party Use Cases

[strieflin]

The documentation / website on Contrast explicitely mentions multi-party use cases as on application area. However, that would require immutable deployments, i.e., preventing subsequent contrast manifest updates after the initial upload (similar to what is available for MarbleRun, see https://marblerun-docs.netlify.app/marblerun/features/manifest#immutable-deployment). Is there a way to do this in Contrast? If not, what is the recommended way to ensure sensitive state is not "propagated" from one deployment to another. I could image to use some manifest-specific secret for encrypting volumes, but didn't found anything that would qualify for that.

[thomasten]

Hi Sven,
To make the deployment immutable, you can delete the WorkloadOwnerKeyDigests (to prevent manifest updates) and/or SeedshareOwnerPubKeys (to prevent recovery and decrypting state) sections from the manifest after generate and before set. The former can also be achieved with the --disable-updates flag on contrast generate. We're currently extending the docs. This is not covered yet.

[strieflin]

Just to get it right: By deleting the respective files, contrast set configures the coordinator to not accept any future manifest updates. The data owners don't have to trust the workload owner that he actually deleted and purged these files. Is this understanding correct?

[thomasten]

These are fields in the manifest. If you delete them from the manifest, (1) the related files/keys become useless and (2) the data owners can use this manifest (without these fields) to verify the coordinator and this proves that manifest updates are not possible.

[strieflin]

Thanks @thomasten. The fact that it's a manifest entry somehow slipped through. Makes sense.