OAuth flow: intermittent 400 errors #96
Description
Description
When running sigstore locally with the OAuth OIDC flow, I occasionally get HTTP 400s. Happens with both sigstore.dev and sigstage.dev as the instance. The error code indicates that it's almost certainly a payload construction error on our side, possibly due to raciness when setting up the local HTTP listener.
Example invocation:
$ sigstore sign README.mdExample traceback:
BUG:urllib3.connectionpool:https://oauth2.sigstage.dev:443 "POST /auth/token HTTP/1.1" 400 70
Traceback (most recent call last):
File "/Users/william/devel/sigstore-python/sigstore/_internal/oidc/oauth.py", line 193, in get_identity_token
resp.raise_for_status()
File "/Users/william/devel/sigstore-python/env/lib/python3.10/site-packages/requests/models.py", line 960, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 400 Client Error: Bad Request for url: https://oauth2.sigstage.dev/auth/token
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/Users/william/devel/sigstore-python/env/bin/sigstore", line 8, in <module>
sys.exit(main())
File "/Users/william/devel/sigstore-python/env/lib/python3.10/site-packages/click/core.py", line 1130, in __call__
return self.main(*args, **kwargs)
File "/Users/william/devel/sigstore-python/env/lib/python3.10/site-packages/click/core.py", line 1055, in main
rv = self.invoke(ctx)
File "/Users/william/devel/sigstore-python/env/lib/python3.10/site-packages/click/core.py", line 1657, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "/Users/william/devel/sigstore-python/env/lib/python3.10/site-packages/click/core.py", line 1404, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/Users/william/devel/sigstore-python/env/lib/python3.10/site-packages/click/core.py", line 760, in invoke
return __callback(*args, **kwargs)
File "/Users/william/devel/sigstore-python/sigstore/_cli.py", line 110, in _sign
identity_token = get_identity_token(
File "/Users/william/devel/sigstore-python/sigstore/_internal/oidc/oauth.py", line 195, in get_identity_token
raise IdentityError from http_error
sigstore._internal.oidc.IdentityError