Repository navigation
Conversation
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 6, 2026 13:14
8da22da to
11871f4
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 6, 2026 13:28
11871f4 to
3a85db5
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
2 times, most recently
from
November 6, 2026 14:55
d2d41f0 to
b290770
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
2 times, most recently
from
November 6, 2026 15:02
d9aa0e4 to
f598471
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 6, 2026 15:09
f598471 to
7532e2a
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 6, 2026 15:13
7532e2a to
b76d262
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
2 times, most recently
from
November 7, 2026 03:30
4455b9a to
b047e1b
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 7, 2026 03:40
b047e1b to
80a58ee
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 7, 2026 03:58
80a58ee to
df99469
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 7, 2026 04:04
df99469 to
ef19968
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 7, 2026 04:11
ef19968 to
e4c281a
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 7, 2026 15:21
60b75a2 to
b252c50
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 7, 2026 15:25
b252c50 to
8ee4900
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 01:41
8ee4900 to
17e8f6f
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 01:44
17e8f6f to
a87d31b
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 02:21
a87d31b to
09849d9
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
2 times, most recently
from
November 8, 2026 03:34
00be909 to
f67797d
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 07:25
f67797d to
3bb10c2
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 09:21
3bb10c2 to
732131d
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 14:13
732131d to
a0c967c
Compare
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 14:14
a0c967c to
675f562
Compare
GetKey takes an optional root_epoch (unset = current) and reports the epoch it used, so apps can recover keys derived before a root rotation. The agent fetches an older epoch's app root from the KMS by number on first use and keeps it in memory. The Rust, Go, Python, and JS SDKs expose the selector and the returned epoch. Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
force-pushed
the
kms-getkey-root-epoch
branch
from
November 8, 2026 15:10
675f562 to
067897d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 4 of the KMS root key rotation stack (design: #1516). Based on #1520.
GetKeytakes an optionalroot_epoch(unset = current) and returns the epoch it used, so apps can recover keys derived before a rotation.CertRequestClient::get_app_key) and keeps it in memory.get_key_at_root_epoch, GoGetKeyAtRootEpoch, Pythonroot_epoch=, JSrootEpoch. Responses carryroot_epoch.Env migration is coming in a separate SealedEnv PR.
Rebased onto the direct-attestation key-retrieval stack. Historical key requests reuse the pinned KMS client; no temporary-CA protocol is required.