envoyproxy / envoyproxy/envoy

Wasm module signature verification

Open
#17,220 5 comments 0 reactions 0 assignees View on GitHub
area/security area/wasm enhancement help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

*Title*: *Wasm module signature verification*

*Description*:
Add the ability to configure verification options to satisfy before executing a Wasm module. This could include checking all/some/at least one signature is present from a list of specified verification keys in the Wasm bytecode according to https://github.com/jedisct1/wasmsign. I propose some kind of VerificationOption struct that contains
* repeated public keys
* verification type (at least 'n', ALL)
* signature type (maybe reference to wasmsign)

If this is something interesting/use-able to others, I am happy to continue implementation.

*Relevant Links*
Draft PR here: https://github.com/envoyproxy/envoy/pull/17221
The change depends on a PR in proxy-wasm-cpp-host: https://github.com/proxy-wasm/proxy-wasm-cpp-host/pull/177

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.