sigstore, test: add CircleCI credential detection #72
Conversation
See #31. Signed-off-by: William Woodruff <william@trailofbits.com>
|
Yep, correct. It looks like CircleCI uses a similar permission style as GitHub, but skips the indirection of a request.
Sent from mobile. Please excuse my brevity.
… On May 6, 2022, at 12:28 PM, Dustin Ingram ***@***.***> wrote:
@di commented on this pull request.
In sigstore/_internal/oidc/ambient.py:
> +
+
+def detect_circleci() -> Optional[str]:
+ logger.debug("CircleCI: looking for OIDC credentials")
+
+ if not os.getenv("CIRCLECI"):
+ logger.debug("CircleCI: environment doesn't look right; giving up")
+ return None
+
+ token = os.getenv("CIRCLE_OIDC_TOKEN")
+ if not token:
+ raise AmbientCredentialError(
+ "CircleCI: missing or insufficient OIDC token permissions"
+ )
+
+ return token
This is the actual identity token? We don't need to make additional requests here?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were assigned.
|
|
Sounds good! |
cb60aec to
44e94db
Compare
|
This seems like a dealbreaker. From https://circleci.com/docs/2.0/openid-connect-tokens/#format-of-the-openid-connect-id-token
|
|
Marking this as blocked on https://circleci.canny.io/cloud-feature-requests/p/customizable-audience-claim-in-oidc-tokens, please upvote that feature request if you need this feature. |
|
Oh well; that's too bad. At least the changeset here is pretty small, so we'll be able to move this along rapidly once that gets unblocked. |
|
When we're ready to merge this, we should go to https://app.circleci.com/settings/project/github/sigstore/sigstore-python/advanced and re-enable "GitHub Status Updates" before rebasing. |
|
Given the slow movement here, dropping this out of the 1.0 milestone. |
|
CircleCI has just added customizable audience claims in OIDC tokens =) https://circleci.com/docs/api/v2/index.html#tag/OIDC-Token-Management |
|
@jerdog fantastic, thanks for letting us know! This PR is pretty stale at this point, but I'll see about refreshing it. |
|
NB: This will require upstream changes to |
|
Upstream tracking: di/id#61 |
|
This has been done upstream. The only remaining item for CircleCI support in |
Signed-off-by: William Woodruff <william@trailofbits.com>
See #31.
Signed-off-by: William Woodruff william@trailofbits.com