Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a updated version of the previous PR because the latest commit at the time (v3.4.0) is now outdated.
It is created based on our current codebase which is based on 3e92e75 (This is the revision that is used by v3.10.0 release. https://github.com/privacysandbox/bidding-auction-servers/blob/v3.10.0/WORKSPACE), so we set the our copy of 3e92e75
as the target.
It targets our fork because we can't create a PR against commits without branch name or tag in https://github.com/privacysandbox/data-plane-shared-libraries.
The first PR is left as it is because the branch is still used by our demo. The previous PR is also still available here, but please review this PR because this is based on a newer commit.
Adding Azure support
This PR is adding support for deployment of Google's Bidding and Auction Services on Azure.
Azure Privacy Sandbox architecture: https://1drv.ms/w/s!AmI-86sms1pYqJ5Uqgo5Qv2Ynmrcmw?e=BDC8BH
(We'll make a PR for the document in https://github.com/privacysandbox/protected-auction-services-docs/tree/main in future)
Now B&A services can fetch private and public HPKE keys from an Azure KMS, specifically designed to support the B&A services, and handle test requests.
To try this changes locally, please visit here.
The PR for bidding-auction-servers repository: KenGordon/bidding-auction-servers#32
azure-privacy-sandbox-kms branch that works with this PR: https://github.com/microsoft/azure-privacy-sandbox-kms/tree/add-azure-support-v3.10.0
Changes
--platform=azure
(for Bazel),kAzure
(C++ enum value).cpio/client_providers/
attestation
library to fetch attestation in Azure Confidential ACI. We implemented the core functionality of:kms_client_provider
parameter_client_provider
private_key_fetcher_provider
private_key_fetcher_provider
.auth_token_provider
role_credentials_provider
Also we return dummy values for
instance_client_provider
andblob_storage_client_provider
for now. Please see "TODOs for future PRs" section for the details.TODOs for future PRs
instance_client_provider
currently returns dummy values. It will be implemented properly after Azure auth_token_provider is ready.kKMSUnwrapPath
. We will either put the URL inKeyData::key_encryption_key_uri
or use an environment variableauth_token_provider
is using an environment variable to configure IDP path. We will try to find a better option.init_azure
private_key_cache_ttl_seconds
option.key_id
for private key APIPrivateKeyFetchingRequest
.azure_cpio_lib_inside_tee
andazure_cpio_lib_outside_tee
implementation. Current azure_cpio_lib_inside_tee uses fake attestation report silently when it's outside TEE.blob_storage_client_provider
. It just returns empty responses. We added it just to build errors when we runbuild_and_test_all_in_docker
.azure_platform
fortest_lib_cpio_provider