Code signing with hashicorp key vault

[ashi]

We can store keys and a valid signing cert in Key Vault but there does not seem to be a crypto provider (CSP) that can be called from the code signing utilities. We would like to sign authenticode and Java binaries. Is it supported by Hashicorp key vault ?

[Becca Petrin]

Hi Ashi,

Good question! Vault is written in Go and subsequently our engineering staff and infrastructure all focus around Go language and tooling. Thus, we haven't developed a Java CSP, and I also personally haven't heard of one existing externally. I'm aware of a Spring integration, more here, in case it's any help.

-Becca

[angel visri]

Hi Becca,

Thank you.

My requirement is : I want to use the keys stored in hashicorp vault to digitally sign Microsoft(Signing tool used is signtool.exe) and java(signing tool used is jarsigner.exe) artifacts.

Is there any way of doing it ?

Thanks. 

[Becca Petrin]

Hi Ashi,

Ah! The Transit secrets engine can provide signatures.

• Overview of Transit
• API docs
• The signing endpoint specifically

-Becca