refactor: move signature verification logic to its own module #2157

gsanchezgavier · 2026-02-06T14:43:29Z

moves out common signature abstractions so they can be reused by the oci signature verifier.

gsanchezgavier · 2026-02-06T14:44:15Z

agent-control/src/signature/public_key_fetcher.rs

+
+    /// Fetches all public keys from the JWKS endpoint. If any keys are invalid, they will be
+    /// skipped and a warning will be logged. If no valid keys are found, an error will be returned.
+    pub fn fetch(&self) -> Result<Vec<PublicKey>, PubKeyFetcherError> {


this is meant to be used by the new cosign verificator

We will probably need to update the signature and receive the url as an argument as we can have different public-key urls for different artifacts. However, we can leave that refactor for a different PR.

agent-control/src/opamp/remote_config/validators/signature/verifier.rs

agent-control/src/opamp/remote_config/signature.rs

agent-control/src/signature/public_key.rs

agent-control/src/signature/public_key_fetcher.rs

danielorihuela

Great job!!! I like it. From my side, we can merge it already.

sigilioso

LGTM 🚀

gsanchezgavier requested a review from a team as a code owner February 6, 2026 14:43

gsanchezgavier commented Feb 6, 2026

View reviewed changes

gsanchezgavier marked this pull request as draft February 6, 2026 14:46

refactor: move signature verification logic to its own module

35c2e11

gsanchezgavier force-pushed the gsanchez/feat/pubkey-fetcher-jwks branch from 675125c to 35c2e11 Compare February 9, 2026 07:39

gsanchezgavier marked this pull request as ready for review February 9, 2026 08:24