Skip to content

Commit a4b3e12

Browse files
marshall007marshall007
authored
Update GitLab claim mappings for build configs (#1206)
* Update GitLab claim mappings for build configs Assigns new `pipeline_ref/sha` claims to `Build Config` and `Build Signer` related OIDs. Depends on https://gitlab.com/gitlab-org/gitlab/-/merge_requests/121597 Related to #1182 Signed-off-by: marshall007 <[email protected]> * update docs to reflect GitLab claim mappings Signed-off-by: marshall007 <[email protected]> * updates to match new claim names Signed-off-by: marshall007 <[email protected]> * fix issuer test Signed-off-by: marshall007 <[email protected]> * address PR feedback Signed-off-by: marshall007 <[email protected]> * fix failing grpc server tests Signed-off-by: marshall007 <[email protected]> * fix lint error Signed-off-by: marshall007 <[email protected]> --------- Signed-off-by: marshall007 <[email protected]>
1 parent 07f0ac4 commit a4b3e12

File tree

5 files changed

+169
-38
lines changed

5 files changed

+169
-38
lines changed

‎docs/oid-info.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -191,19 +191,20 @@ that Sigstore operates.
191191
| exp | exp | exp | exp | N/A | Only used to validate the JWT. |
192192
| nbf | nbf | nbf | nbf | N/A | Only used to validate the JWT. Optional, as per the OIDC spec |
193193
| iat | iat | iat | iat | N/A | Only used to validate the JWT. |
194-
| server_url + job_workflow_ref | server_url + project_path + /-/jobs/ + job_id | ?? | ?? | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
195-
| job_workflow_sha | N/A | ?? | ?? | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
194+
| server_url + job_workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
195+
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
196196
| runner_environment | runner_environment | ?? | ?? | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
197197
| server_url + repository | server_url + project_path | ?? | ?? | Source Repository URI | Should include a fully qualified repository URL. |
198198
| sha | sha | ?? | build_commit | Source Repository Digest | An immutable reference to a specific version of the source code. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
199199
| ref | ref | ?? | build_branch | Source Repository Ref | The source ref that the build run was based upon. For example: refs/head/main. |
200200
| repository_id | project_id | ?? | ?? | Source Repository Identifier | Stable identifier for the owner of the source repository. |
201201
| server_url + repository_owner | server_url + namespace_path | ?? | ?? | Source Repository Owner URI | Fully qualified URL for the owner of the source repository. |
202202
| repository_owner_id | namespace_id | ?? | ?? | Source Repository Owner Identifier | Stable identifier for the owner of the source repository. |
203-
| server_url + workflow_ref | pipeline_ref ([WIP](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117923)) | ?? | ?? | Build Config URI | A reference to the initiating build instructions. |
204-
| workflow_sha | pipeline_sha ([WIP](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117923)) | ?? | ?? | Build Config Digest | An immutable reference to the specific version of the top-level build instructions. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
203+
| server_url + workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Config URI | A reference to the initiating build instructions. |
204+
| workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | Build Config Digest | An immutable reference to the specific version of the top-level build instructions. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
205205
| event_name | pipeline_source | ?? | ?? | Build Trigger | The event or action that triggered the build. |
206-
| server_url + repository + "/actions/runs/" + run_id + "/attempts/" + run_attempt | server_url + project_path + /-/pipelines/ + pipeline_id | ?? | ?? | Run Invocation URI | An immutable identifier that can uniquely identify the build execution |
206+
| server_url + repository + "/actions/runs/" + run_id + "/attempts/" + run_attempt | server_url + project_path + /-/jobs/ + job_id | ?? | ?? | Run Invocation URI | An immutable identifier that can uniquely identify the build execution |
207207

208208
[github-oidc-doc]: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token
209209
[oid-link]: http://oid-info.com/get/1.3.6.1.4.1.57264
210+
[gitlab-wip-cliams]: https://gitlab.com/gitlab-org/gitlab/-/issues/404722

‎pkg/identity/gitlabcom/issuer_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ func TestIssuer(t *testing.T) {
5353
"user_email": "[email protected]",
5454
"pipeline_id": "757451528",
5555
"pipeline_source": "push",
56+
"ci_config_ref_uri": "gitlab.com/cpanto/testing-cosign//.gitlab-ci.yml@refs/head/main",
5657
"job_id": "3659681386",
5758
"sha": "714a629c0b401fdce83e847fc9589983fc6f46bc",
5859
"runner_id": 1,

‎pkg/identity/gitlabcom/principal.go‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,13 @@ type jobPrincipal struct {
4444
// Pipeline ID
4545
pipelineID string
4646

47+
// Ref of top-level pipeline definition. E.g. gitlab.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main
48+
ciConfigRefURI string
49+
50+
// Commit sha of top-level pipeline definition, and is
51+
// only populated when `ciConfigRefURI` is local to the GitLab instance
52+
ciConfigSha string
53+
4754
// Repository building built
4855
repository string
4956

@@ -78,6 +85,8 @@ func JobPrincipalFromIDToken(_ context.Context, token *oidc.IDToken) (identity.P
7885
ProjectID string `json:"project_id"`
7986
PipelineSource string `json:"pipeline_source"`
8087
PipelineID string `json:"pipeline_id"`
88+
CiConfigRefURI string `json:"ci_config_ref_uri"`
89+
CiConfigSha string `json:"ci_config_sha"`
8190
NamespacePath string `json:"namespace_path"`
8291
NamespaceID string `json:"namespace_id"`
8392
JobID string `json:"job_id"`
@@ -104,6 +113,10 @@ func JobPrincipalFromIDToken(_ context.Context, token *oidc.IDToken) (identity.P
104113
return nil, errors.New("missing pipeline_id claim in ID token")
105114
}
106115

116+
if claims.CiConfigRefURI == "" {
117+
return nil, errors.New("missing ci_config_ref_uri claim in ID token")
118+
}
119+
107120
if claims.JobID == "" {
108121
return nil, errors.New("missing job_id claim in ID token")
109122
}
@@ -156,6 +169,8 @@ func JobPrincipalFromIDToken(_ context.Context, token *oidc.IDToken) (identity.P
156169
url: `https://gitlab.com/`,
157170
eventName: claims.PipelineSource,
158171
pipelineID: claims.PipelineID,
172+
ciConfigRefURI: claims.CiConfigRefURI,
173+
ciConfigSha: claims.CiConfigSha,
159174
repository: claims.ProjectPath,
160175
ref: ref,
161176
repositoryID: claims.ProjectID,
@@ -178,13 +193,30 @@ func (p jobPrincipal) Embed(_ context.Context, cert *x509.Certificate) error {
178193
return err
179194
}
180195

196+
// ci_config_ref_uri claim is a URI that does not include protocol scheme so we need to normalize it
197+
ciConfigRefURL, err := url.Parse(p.ciConfigRefURI)
198+
if err != nil {
199+
return err
200+
}
201+
202+
// default to https
203+
ciConfigRefURL.Scheme = "https"
204+
205+
// or use scheme from issuer if from the same host
206+
if baseURL.Host == ciConfigRefURL.Host {
207+
ciConfigRefURL.Scheme = baseURL.Scheme
208+
}
209+
181210
// Set workflow ref URL to SubjectAlternativeName on certificate
182-
cert.URIs = []*url.URL{baseURL.JoinPath(fmt.Sprintf("%s@%s", p.repository, p.ref))}
211+
cert.URIs = []*url.URL{ciConfigRefURL}
183212

184213
// Embed additional information into custom extensions
185214
cert.ExtraExtensions, err = certificate.Extensions{
186215
Issuer: p.issuer,
187-
BuildSignerURI: baseURL.JoinPath(p.repository, "/-/jobs/", p.jobID).String(),
216+
BuildConfigURI: ciConfigRefURL.String(),
217+
BuildConfigDigest: p.ciConfigSha,
218+
BuildSignerURI: ciConfigRefURL.String(),
219+
BuildSignerDigest: p.ciConfigSha,
188220
RunnerEnvironment: p.runnerEnvironment,
189221
SourceRepositoryURI: baseURL.JoinPath(p.repository).String(),
190222
SourceRepositoryDigest: p.sha,
@@ -193,7 +225,7 @@ func (p jobPrincipal) Embed(_ context.Context, cert *x509.Certificate) error {
193225
SourceRepositoryOwnerURI: baseURL.JoinPath(p.repositoryOwner).String(),
194226
SourceRepositoryOwnerIdentifier: p.repositoryOwnerID,
195227
BuildTrigger: p.eventName,
196-
RunInvocationURI: baseURL.JoinPath(p.repository, "/-/pipelines/", p.pipelineID).String(),
228+
RunInvocationURI: baseURL.JoinPath(p.repository, "/-/jobs/", p.jobID).String(),
197229
}.Render()
198230
if err != nil {
199231
return err

0 commit comments

Comments
 (0)