Add flag to verify OIDC issuer in certificate #1308
Conversation
|
Nice! @mattmoor FYI for the policy task force |
|
Awesome. Looks like it needs a rebase |
| cmd.Flags().StringVar(&o.CertEmail, "cert-email", "", | ||
| "the email expected in a valid Fulcio certificate") |
There was a problem hiding this comment.
We should consider changing this since only a handful of things use email, and the rest use URIs.
Doesn't have to be here (probably shouldn't be), but something related that's been bothering me.
There was a problem hiding this comment.
Could we change this to CertSubject? #1313
With github too, it's difficult to get the whole job workflow ref (maybe you only want to verify it came from A workflow in the org/repo -- could we do partial matches?)
There was a problem hiding this comment.
A lot of that info is in extensions already (I think you added it!), and I think this is where it may make more sense to pass some payload with all the data to something like Cue/Rego for policy may be more manageable.
There was a problem hiding this comment.
Left a comment in the bug, I think a cert subject flag would be great to handle both email and URIs.
Given that there is ongoing work for policies (correct?), I agree that we should probably avoid adding complex policy checks to flags, and keep flag-based checks simple.
This adds support for --cert-oidc-issuer. In combination with --cert-email, users should be able to verify and pin the expected identity of the Fulcio certificate. Also added certificate generation test utilities. Signed-off-by: Hayden Blauzvern <[email protected]>
haydentherapper
force-pushed
the
issuer
branch
from
24cad47
to
d3d0904
Compare
|
Rebased and updated with flag doc change. I also removed |
This adds support for --cert-oidc-issuer. In combination with --cert-email, users should be able to verify and pin the expected identity of the Fulcio certificate. Also added certificate generation test utilities. Signed-off-by: Hayden Blauzvern <[email protected]>
Summary
This PR adds support for --cert-oidc-issuer to verify the OIDC issuer of a Fulcio certificate. In combination with --cert-email, users should be able to verify and pin the expected identity of the Fulcio certificate.
Also added certificate generation test utilities. These might be more useful in sigstore/sigstore.
Ticket Link
Ref #556
Release Note