Skip to content

Commit 60bf68a

Browse files
ilia-medvedev-codefreshilia-medvedev-codefresh
authored
Add Codefresh OIDC provider (#1593)
* Feat: Add Codefresh OIDC provider (#2) Signed-off-by: Ilia Medvedev <[email protected]> * linting and licensing fixes Signed-off-by: Ilia Medvedev <[email protected]> * fix linting warnings Signed-off-by: Ilia Medvedev <[email protected]> * fix last linting warnings Signed-off-by: Ilia Medvedev <[email protected]> * Change Run incovation URI extension to pipeline_id Signed-off-by: Ilia Medvedev <[email protected]> * add comment explaining the usage of worklow url as buildsigner Signed-off-by: Ilia Medvedev <[email protected]> * fix linting Signed-off-by: Ilia Medvedev <[email protected]> --------- Signed-off-by: Ilia Medvedev <[email protected]>
1 parent 84d6136 commit 60bf68a

File tree

12 files changed

+827
-32
lines changed

12 files changed

+827
-32
lines changed

‎config/config.jsn‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@
2020
"IssuerURL": "https://token.actions.githubusercontent.com",
2121
"ClientID": "sigstore",
2222
"Type": "github-workflow"
23+
},
24+
"https://oidc.codefresh.io": {
25+
"IssuerURL": "https://oidc.codefresh.io",
26+
"ClientID": "sigstore",
27+
"Type": "codefresh-workflow"
2328
}
2429
}
2530
}

‎config/fulcio-config.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,11 @@ data:
6464
"Type": "email",
6565
"IssuerClaim": "$.federated_claims.connector_id"
6666
},
67+
"https://oidc.codefresh.io": {
68+
"IssuerURL": "https://oidc.codefresh.io",
69+
"ClientID": "sigstore",
70+
"Type": "codefresh-workflow"
71+
},
6772
"https://ops.gitlab.net": {
6873
"IssuerURL": "https://ops.gitlab.net",
6974
"ClientID": "sigstore",

‎docs/oid-info.md‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -189,27 +189,27 @@ that Sigstore operates.
189189

190190
## Mapping OIDC token claims to Fulcio OIDs
191191

192-
| GitHub [(docs)][github-oidc-doc] | GitLab [(docs)](https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html#token-payload) | CircleCI | Buildkite | Fulcio Certificate Extension | Why / Notes / Questions |
193-
|--------------------|--------|----------|-----------|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
194-
| aud | aud | aud | aud | N/A | Only used to validate the JWT. |
195-
| iss | iss | iss | iss | Issuer | This already exists. For example: https://token.actions.githubusercontent.com |
196-
| exp | exp | exp | exp | N/A | Only used to validate the JWT. |
197-
| nbf | nbf | nbf | nbf | N/A | Only used to validate the JWT. Optional, as per the OIDC spec |
198-
| iat | iat | iat | iat | N/A | Only used to validate the JWT. |
199-
| server_url + job_workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
200-
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
201-
| runner_environment | runner_environment | ?? | ?? | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
202-
| server_url + repository | server_url + project_path | ?? | ?? | Source Repository URI | Should include a fully qualified repository URL. |
203-
| sha | sha | ?? | build_commit | Source Repository Digest | An immutable reference to a specific version of the source code. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
204-
| ref | ref | ?? | build_branch | Source Repository Ref | The source ref that the build run was based upon. For example: refs/head/main. |
205-
| repository_id | project_id | ?? | ?? | Source Repository Identifier | Stable identifier for the owner of the source repository. |
206-
| server_url + repository_owner | server_url + namespace_path | ?? | ?? | Source Repository Owner URI | Fully qualified URL for the owner of the source repository. |
207-
| repository_owner_id | namespace_id | ?? | ?? | Source Repository Owner Identifier | Stable identifier for the owner of the source repository. |
208-
| server_url + workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Config URI | A reference to the initiating build instructions. |
209-
| workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Config Digest | An immutable reference to the specific version of the top-level build instructions. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
210-
| event_name | pipeline_source | ?? | ?? | Build Trigger | The event or action that triggered the build. |
211-
| server_url + repository + "/actions/runs/" + run_id + "/attempts/" + run_attempt | server_url + project_path + /-/jobs/ + job_id | ?? | ?? | Run Invocation URI | An immutable identifier that can uniquely identify the build execution |
212-
| repository_visibility | project_visibility | ?? | ?? | Source Repository Visibility At Signing | Source repository visibility at the time of signing the certificate |
192+
| GitHub [(docs)][github-oidc-doc] | GitLab [(docs)](https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html#token-payload) | CircleCI | Buildkite | Codefresh [(docs)](https://codefresh.io/docs/docs/integrations/oidc-pipelines/) | Fulcio Certificate Extension | Why / Notes / Questions |
193+
|--------------------|--------|----------|-----------|-----------|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
194+
| aud | aud | aud | aud | aud | N/A | Only used to validate the JWT. |
195+
| iss | iss | iss | iss | iss | Issuer | This already exists. For example: https://token.actions.githubusercontent.com |
196+
| exp | exp | exp | exp | exp | N/A | Only used to validate the JWT. |
197+
| nbf | nbf | nbf | nbf | nbf | N/A | Only used to validate the JWT. Optional, as per the OIDC spec |
198+
| iat | iat | iat | iat | iat | N/A | Only used to validate the JWT. |
199+
| server_url + job_workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /build/ + workflow_id | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
200+
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
201+
| runner_environment | runner_environment | ?? | ?? | runner_environment | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
202+
| server_url + repository | server_url + project_path | ?? | ?? | scm_repo_url | Source Repository URI | Should include a fully qualified repository URL. |
203+
| sha | sha | ?? | build_commit | N/A | Source Repository Digest | An immutable reference to a specific version of the source code. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
204+
| ref | ref | ?? | build_branch | scm_ref | Source Repository Ref | The source ref that the build run was based upon. For example: refs/head/main. |
205+
| repository_id | project_id | ?? | ?? | N/A | Source Repository Identifier | Stable identifier for the owner of the source repository. |
206+
| server_url + repository_owner | server_url + namespace_path | ?? | ?? | N/A | Source Repository Owner URI | Fully qualified URL for the owner of the source repository. |
207+
| repository_owner_id | namespace_id | ?? | ?? | N/A | Source Repository Owner Identifier | Stable identifier for the owner of the source repository. |
208+
| server_url + workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /api/pipelines/ + pipeline_id | Build Config URI | A reference to the initiating build instructions. |
209+
| workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Config Digest | An immutable reference to the specific version of the top-level build instructions. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
210+
| event_name | pipeline_source | ?? | ?? | N/A | Build Trigger | The event or action that triggered the build. |
211+
| server_url + repository + "/actions/runs/" + run_id + "/attempts/" + run_attempt | server_url + project_path + /-/jobs/ + job_id | ?? | ?? | platform_url + /build/ + workflow_id | Run Invocation URI | An immutable identifier that can uniquely identify the build execution |
212+
| repository_visibility | project_visibility | ?? | ?? | N/A | Source Repository Visibility At Signing | Source repository visibility at the time of signing the certificate |
213213

214214
[github-oidc-doc]: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token
215215
[oid-link]: http://oid-info.com/get/1.3.6.1.4.1.57264

‎federation/oidc.codefresh.io/config.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright 2023 The Sigstore Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
url: https://oidc.codefresh.io
16+
contact: [email protected]
17+
description: "Codefresh OIDC tokens for job identity"
18+
type: "codefresh-workflow"

‎pkg/config/config.go‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -273,14 +273,15 @@ func (fc *FulcioConfig) prepare() error {
273273
type IssuerType string
274274

275275
const (
276-
IssuerTypeBuildkiteJob = "buildkite-job"
277-
IssuerTypeEmail = "email"
278-
IssuerTypeGithubWorkflow = "github-workflow"
279-
IssuerTypeGitLabPipeline = "gitlab-pipeline"
280-
IssuerTypeKubernetes = "kubernetes"
281-
IssuerTypeSpiffe = "spiffe"
282-
IssuerTypeURI = "uri"
283-
IssuerTypeUsername = "username"
276+
IssuerTypeBuildkiteJob = "buildkite-job"
277+
IssuerTypeEmail = "email"
278+
IssuerTypeGithubWorkflow = "github-workflow"
279+
IssuerTypeCodefreshWorkflow = "codefresh-workflow"
280+
IssuerTypeGitLabPipeline = "gitlab-pipeline"
281+
IssuerTypeKubernetes = "kubernetes"
282+
IssuerTypeSpiffe = "spiffe"
283+
IssuerTypeURI = "uri"
284+
IssuerTypeUsername = "username"
284285
)
285286

286287
func parseConfig(b []byte) (cfg *FulcioConfig, err error) {
@@ -511,6 +512,8 @@ func issuerToChallengeClaim(issType IssuerType, challengeClaim string) string {
511512
return "email"
512513
case IssuerTypeGithubWorkflow:
513514
return "sub"
515+
case IssuerTypeCodefreshWorkflow:
516+
return "sub"
514517
case IssuerTypeKubernetes:
515518
return "sub"
516519
case IssuerTypeSpiffe:

‎pkg/config/config_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,9 @@ func Test_issuerToChallengeClaim(t *testing.T) {
495495
if claim := issuerToChallengeClaim(IssuerTypeGitLabPipeline, ""); claim != "sub" {
496496
t.Fatalf("expected sub subject claim for GitLab issuer, got %s", claim)
497497
}
498+
if claim := issuerToChallengeClaim(IssuerTypeCodefreshWorkflow, ""); claim != "sub" {
499+
t.Fatalf("expected sub subject claim for Codefresh issuer, got %s", claim)
500+
}
498501
if claim := issuerToChallengeClaim(IssuerTypeKubernetes, ""); claim != "sub" {
499502
t.Fatalf("expected sub subject claim for K8S issuer, got %s", claim)
500503
}

‎pkg/identity/codefresh/issuer.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Copyright 2023 The Sigstore Authors.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package codefresh
16+
17+
import (
18+
"context"
19+
"fmt"
20+
21+
"github.com/sigstore/fulcio/pkg/config"
22+
"github.com/sigstore/fulcio/pkg/identity"
23+
"github.com/sigstore/fulcio/pkg/identity/base"
24+
)
25+
26+
type codefreshIssuer struct {
27+
identity.Issuer
28+
}
29+
30+
func Issuer(issuerURL string) identity.Issuer {
31+
return &codefreshIssuer{base.Issuer(issuerURL)}
32+
}
33+
34+
func (e *codefreshIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
35+
idtoken, err := identity.Authorize(ctx, token, opts...)
36+
if err != nil {
37+
return nil, fmt.Errorf("authorizing codefresh issuer: %w", err)
38+
}
39+
return WorkflowPrincipalFromIDToken(ctx, idtoken)
40+
}

0 commit comments

Comments
 (0)