Bundle verification

[shashankbr11]

Hi,

I've created a signed bundle using the private key i.e privkey.pem and sending the publickey.pem for verification while running the OPA server as shown below.

./opa run --verification-key publickey.pem --bundle --set bundles.example.resource=signedBundle/bundle.tar.gz --set services.example.url=http://localhost:8080

with HTTP server for policy at port 8080

I get the error

"Bundle load failed: verification key not provided"

Kindly suggest the correct format.

With regards,
Shashank

[anderseknert]

The "bundle mode" set by the --bundle flag applies only to bundles provided from files or directories. If you are fetching remote bundles, the verification key should be provided in the configuration, as described here.

I recently played around with this myself, and documented the process in this repo. Might be that you prefer that over the docs :)

[shashankbr11]

The suggestion of YAML file is configurable in a specific manner

[charlieegan3]

In the repo from Anders, the configuration file is here: https://github.com/anderseknert/opa-sign-verify/blob/main/opa-conf.yaml

The configuration file format is documented here: https://www.openpolicyagent.org/docs/latest/configuration/#keys

Does that help or are you having trouble getting it working still?