This is a simple client for the KBS that facilitates testing of the KBS and other basic attestation flows.
You can run this tool inside of a TEE to make a request with real attestation evidence. You can also provide pre-existing evidence or use the sample attester as a fallback.
The client tool can also be used to provision the KBS/AS with resources and policies.
For more sophisticated attestation clients, please refer to guest components
For help:
kbs-client -h
We have a community version of kbs-client on Github ORAS.
Build the client binary with support to the default features as:
make -C ../../ cli
By default the client is built with support to the sample attester, apart from the
TEE specific ones. If you want to build it with that sample attester only (this will
require fewer dependencies and so usually handy for CI) then you can pass the
sample_only
feature as:
make -C ../../ cli CLI_FEATURES=sample_only
Find the built binary at ../../../target/release/kbs-client
. You can get it
installed into the system as:
sudo make -C ../../ install-cli
Get a resource from the KBS (after attesting)
./kbs-client --url http://127.0.0.1:8080 get-resource --path my_repo/resource_type/123abc
Add a resource to the KBS
./kbs-client --url http://127.0.0.1:8080 config --auth-private-key ../../kbs/config/private.key set-resource --path my_repo/resource_type/123abc --resource-file test_resource
Set a resource policy
./kbs-client --url http://127.0.0.1:8080 config --auth-private-key ../../kbs/config/private.key set-resource-policy --policy-file allow_all.rego