[Bug]: Unable to use AWS KMS BYOK (Bring your own key) functionality to generate attestations

[lovleshmalik]

What steps did you take and what happened:

Witness provides option to use AWS KMS for generating attestations and policy signing but the drawback is when we have to distribute the artifacts, there is no way to establish chain of trust as only AWS KMS generated keys are used for encryption/decryption.
For this purpose I plan to use AWS KMS BYOK functionality, where I can import my own key pair in KMS. And along with this I also plan to use public certificate corresponding to this key pair.
So, effectively my command becomes

witness run -s build -a environment --signer-kms-ref=awskms:/// --signer-file-cert-path <CERT_PATH_LOCAL> -o build-attestation.json -- bash -c "echo 'hello' > hello.txt"

When using this command, it is throwing error "failed to create file signer: failed to open key file: open : no such file or directory ". The command still exits with exit code 0 but certificate is not appended in the build-attestation.json

What did you expect to happen:

I expected the above command to work by having certificate details in build-attestation.json file.

Anything else you would like to add:

Environment:

• Witness version: 0.8.1
• Architecture: Darwin Kernel Version 23.1.0 arm64
• Attestors used: environment
• Archivista version: NA

[colek42]

Thank you for reporting this issue and clearly describing your expectations and the confusion it caused. I completely understand how the current behavior, returning a misleading success code and an unclear error message, could be frustrating or confusing.

Right now, Witness doesn't support embedding a BYOK certificate when using AWS KMS keys. However, at a minimum, we should ensure the user experience clearly reflects this limitation. To that end, we'll prioritize improving the error messaging and validation logic so Witness explicitly informs users when incompatible flags like --signer-file-cert-path and --signer-kms-ref are used together.

While BYOK certificate embedding isn't currently on our roadmap, it could certainly be valuable to users who need a stronger chain-of-trust story when distributing attestations. If this feature would be important for your use case or you're interested in exploring this further, we'd love to hear more about your requirements and perspective.

Thanks again for highlighting this! Your feedback helps us make Witness better for everyone.

[mikhailswift]

Hmm, taking a look at this, I think this actually may be happening because the cert is supplied as a file on disk. The witness cli will try to load a file signer if you use the certificate flag -- assuming your private key is also on disk.

If you remove the --signer-file-cert-path flag signing with the AWS KMS signer should work. However, if the certificate you are providing is relevant to your BYOK KMS key but not available from the KMS, we may need to look at solutions to combine these.