-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add issuer information to code signing certificates #204
Conversation
This is great work! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
just needs a rebase, but good for me.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
whoops didn't hit send
Type: IssuerTypeEmail, | ||
IssuerURL: "https://oauth2.sigstore.dev/auth", | ||
ClientID: "sigstore", | ||
IssuerClaim: "$.federated_claims.connector_id", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm wondering whether it makes sense to have the hard-coded DefaultConfig assume DEX?
This extracts a claim from the OIDC token (defaults to `iss`) and inserts it into the final code signing certificate issued by Fulcio. This provides an explicit link between the identity (i.e. the email or the URI that is the subject of the certificate) to the identity provider who is vouching for an entity holding valid credentials for said identity. The value is stored in an X509 extension with OID: 1.3.6.1.4.1.57264.1.1 Signed-off-by: Bob Callaway <[email protected]>
Signed-off-by: Bob Callaway <[email protected]>
1e7d17f
to
37fe45a
Compare
Signed-off-by: Bob Callaway <[email protected]>
This switches from using URIs to using the extensions that Bob is using in sigstore#204 Signed-off-by: Matt Moore <[email protected]>
This extracts a claim from the OIDC token (defaults to
iss
) and inserts it into the final code signing certificate issued by Fulcio in an X509 extension.This provides an explicit link between the identity (i.e. the email or the URI that is the subject of the certificate) to the identity provider who is vouching for an entity holding valid credentials for said identity.
The value is stored in an X509 extension with OID:
1.3.6.1.4.1.57264.1.1
WIP due to dexidp/dex#2289
Signed-off-by: Bob Callaway [email protected]