Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Token fixes #412

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Token fixes #412

wants to merge 4 commits into from

Commits on Oct 23, 2024

  1. oauth: Add simple test for an interactive token 

    Signed-off-by: Jussi Kukkonen <[email protected]>
    @jku
    jku committed Oct 23, 2024
    Configuration menu
    Copy the full SHA
    ae23ec2 View commit details
    Browse the repository at this point in the history

  2. oauth: Fix the token identity handling 

    * Make email optional when parsing JWT (e.g. GitHub actions does not use it)
* Add IdentityToken.identity field: this is the identity claim that we
  believe Fulcio uses for this issuer
* Fix the bundle signing so it uses the new identity field
* Add test with a GitHub Actions token

Note that signing with a Sub claim is still not supported but we're now
a bit closer.

Signed-off-by: Jussi Kukkonen <[email protected]>
    @jku
    jku committed Oct 23, 2024
    Configuration menu
    Copy the full SHA
    912186f View commit details
    Browse the repository at this point in the history

  3. bundle: Just use email OID regardless of actual value 

    Apparently Fulcio does not care about the CSR subject: just claim
everything is an email.

https://github.com/sigstore/fulcio/blob/main/fulcio.proto#L106

Signed-off-by: Jussi Kukkonen <[email protected]>
    @jku
    jku committed Oct 23, 2024
    Configuration menu
    Copy the full SHA
    07cb957 View commit details
    Browse the repository at this point in the history

Commits on Oct 24, 2024

  1. oauth: Make it clear that identity claim is untrusted 

    We don't judge the claims that OIDC provider makes (apart from some
compatibility checks): make this clear in the API and docs.

Signed-off-by: Jussi Kukkonen <[email protected]>
    @jku
    jku committed Oct 24, 2024
    Configuration menu
    Copy the full SHA
    817851b View commit details
    Browse the repository at this point in the history