Improving --signer-fulcio-token flag to accept both path and raw token string

hack/test.token

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJhYmNkMTIzIiwiZXhwaXJ5IjoxNjQ2NjM1NjExMzAxfQ.3Thp81rDFrKXr3WrY1MyMnNK8kKoZBX9lg-JwFznR-M

signer/fulcio/fulcio.go

@@ -93,7 +93,7 @@ func init() {
 		),
 		registry.StringConfigOption(
 			"token",
-			"Raw token to use for authentication",
+			"Raw token to use for authentication. The token or a path to the file containing the token is accepted",
 			"",
 			func(sp signer.SignerProvider, token string) (signer.SignerProvider, error) {
 				fsp, ok := sp.(FulcioSignerProvider)
@@ -211,7 +211,11 @@ func (fsp FulcioSignerProvider) Signer(ctx context.Context) (cryptoutil.Signer,
 		}
 
 	case fsp.Token != "":
-		raw = fsp.Token
+		// reading from file if a path was supplied
+		raw, err = idToken(fsp.Token)
+		if err != nil {
+			return nil, err
+		}
 
 	case fsp.Token == "" && isatty.IsTerminal(os.Stdin.Fd()):
 		tok, err := oauthflow.OIDConnect(fsp.OidcIssuer, fsp.OidcClientID, "", "", oauthflow.DefaultIDTokenGetter)
@@ -403,3 +407,17 @@ func newClient(ctx context.Context, fulcioURL string, fulcioPort int, isInsecure
 	// Create the Fulcio client
 	return fulciopb.NewCAClient(conn), nil
 }
+
+// idToken tries to parse a string as a token in JWS form. If it fails,
+// it treats the string as a path and tries to open the file at that path
+func idToken(s string) (string, error) {
+	// If this is a valid raw token, just return it
+	// NOTE: could be replaced with https://pkg.go.dev/go.step.sm/crypto/jose in future if features helpful
+	if _, err := jwt.ParseSigned(s); err == nil {
+		return s, nil
+	}
+
+	// Otherwise, if this is a path to a token return the contents
+	c, err := os.ReadFile(s)
+	return string(c), err
+}

signer/fulcio/fulcio_test.go

@@ -24,6 +24,7 @@
 	"fmt"
 	"log"
 	"net"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -33,6 +34,7 @@
 	fulciopb "github.com/sigstore/fulcio/pkg/generated/protobuf"
 	"github.com/stretchr/testify/require"
 	"go.step.sm/crypto/jose"
+	"path/filepath"
 
 	"google.golang.org/grpc"
 	"gopkg.in/square/go-jose.v2/jwt"
@@ -76,6 +78,37 @@
 	require.NotNil(t, client)
 }
 
+func TestIDToken(t *testing.T) {
+	// test when supplying a raw token, the same token is returned
+	tok := generateTestToken("[email protected]", "testsubject")
+	out, err := idToken(tok)
+	require.NoError(t, err)
+	require.Equal(t, tok, out)
+
+	// test when supplying a path, a valid token is returned
+	// NOTE: this function could be refactored to accept a fileSystem or io.Reader so reading the file can be mocked,
+	// but unsure if this is the way we want to go for now
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("failed to get working directory: %v", err)
+	}
+	rootDir := filepath.Dir(filepath.Dir(wd))
+	tok = filepath.Join(rootDir, "hack", "test.token")
+	testTok, err := os.ReadFile(tok)
+	if err != nil {
+		t.Fatalf("failed to read test token file: %v", err)
+	}
+
+	out, err = idToken(tok)
+	require.NoError(t, err)
+	require.Equal(t, string(testTok), out)
+
+	// test that when neither valid token nor a path is supplied, an error is returned
+	tok = "test"
+	out, err = idToken(tok)
+	require.Error(t, err)
+}
+
 type dummyCAClientService struct {
 	client fulciopb.CAClient
 	server *grpc.Server