OAuth: more debug logs, configurable browser #136
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
|
I am seeing: I replaced the real values for |
|
Thanks. That series of favicon requests looks suspiciously like the race condition we thought we fixed earlier.
Sent from mobile. Please excuse my brevity.
… On Jun 21, 2022, at 12:39 PM, Kushal Das ***@***.***> wrote:
I am seeing:
I replaced the real values for {AUTH_CODE_VALUE}&state={MYSTATE_VALUE}
DEBUG:sigstore._internal.oidc.oauth:GET: /auth/callback?code={AUTH_CODE_VALUE}&state={MYSTATE_VALUE}
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:sigstore._internal.oidc.oauth:GET: /favicon.ico
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): oauth2.sigstore.dev:443
DEBUG:urllib3.connectionpool:https://oauth2.sigstore.dev:443 "POST /auth/token HTTP/1.1" 400 70
Traceback (most recent call last):
File "/home/kdas/code/sigstore-python/sigstore/_internal/oidc/oauth.py", line 211, in get_identity_token
resp.raise_for_status()
File "/home/kdas/code/sigstore-python/.venv/lib64/python3.10/site-packages/requests/models.py", line 1022, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 400 Client Error: Bad Request for url: https://oauth2.sigstore.dev/auth/token
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/usr/lib64/python3.10/runpy.py", line 196, in _run_module_as_main
return _run_code(code, main_globals, None,
File "/usr/lib64/python3.10/runpy.py", line 86, in _run_code
exec(code, run_globals)
File "/home/kdas/code/sigstore-python/sigstore/__main__.py", line 22, in <module>
main()
File "/home/kdas/code/sigstore-python/sigstore/_cli.py", line 254, in main
_sign(args)
File "/home/kdas/code/sigstore-python/sigstore/_cli.py", line 333, in _sign
args.identity_token = get_identity_token(
File "/home/kdas/code/sigstore-python/sigstore/_internal/oidc/oauth.py", line 213, in get_identity_token
raise IdentityError from http_error
sigstore._internal.oidc.IdentityError
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were assigned.
|
Signed-off-by: William Woodruff <william@trailofbits.com>
|
@kushaldas could you try once more with the changes in 91b22a0? That should prevent any races if the browser attempts to spam us with favicon requests. |
Btw, I am on the slack in #python channel, just in case if you want to have a chat :) |
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
|
This should be good to go. It "fixes" the idempotency issue by doing one less call to |
di
reviewed
Jun 21, 2022
Signed-off-by: William Woodruff <william@trailofbits.com>
di
approved these changes
Jun 21, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WIP.This adds more debug logs and adds theSIGSTORE_OAUTH_BROWSERenvironment variable, which can be used to override thewebbrowser's default browser selection (e.g.SIGSTORE_OAUTH_BROWSER=firefox).Removed the
SIGSTORE_OAUTH_BROWSERvariable, since it's essentially a duplicate of whatwebbrowseralready does via theBROWSERvariable. Instead, this PR addsSIGSTORE_OAUTH_FORCE_OOB, which forcefully disables the in-band OAuth flow if set.See #96.