Support configurable OIDC issuers

[tetsuo-cpp]

Signed-off-by: Alex Cameron [email protected]

Summary

This PR adds support for configurable OIDC issuers. An oidc-issuer flag has been added for this purpose. sigstore will query the issuer's .well-known/openid-configuration to find its endpoints and then use them to retrieve an OIDC token. The following flags have also been exposed since they need to be customised on a per issuer basis:

• oidc-client-id
• oidc-client-secret

[tetsuo-cpp]

This works fine for the default issuer. I'm still looking for another issuer that I can use to test this without making some kind of billing account.

[woodruffw]

N.B.: I think sign will currently fail for issuers that aren't included in OIDC_ISSUERS, since we do this check:

        if iss not in OIDC_ISSUERS:
            raise IdentityError(f"Not a valid OIDC issuer: {iss!r}")

But perhaps that's intended behavior?

[tetsuo-cpp]

N.B.: I think sign will currently fail for issuers that aren't included in OIDC_ISSUERS, since we do this check:

        if iss not in OIDC_ISSUERS:
            raise IdentityError(f"Not a valid OIDC issuer: {iss!r}")

But perhaps that's intended behavior?

Hmm, good point. I'll have a look and see how cosign handles this.

[di]

As far as I can tell cosign doesn't handle it. I don't think it makes sense for us to maintain a separate list of the issuers that Fulcio supports, we should just let the user try to submit the certificate request and handle it if Fulcio fails.

[tetsuo-cpp]

As far as I can tell cosign doesn't handle it. I don't think it makes sense for us to maintain a separate list of the issuers that Fulcio supports, we should just let the user try to submit the certificate request and handle it if Fulcio fails.

Do you mean that it should just assume that the challenge is the email signed? It's not going to work for Github Actions though. Maybe it should just default to using email for unrecognized issuers.

[woodruffw]

Do you mean that it should just assume that the challenge is the email signed? It's not going to work for Github Actions though. Maybe it should just default to using email for unrecognized issuers.

Based on my reading of https://github.com/sigstore/fulcio/blob/f6016fda1ec6f1bd550699c7b8f53c2057ada174/pkg/challenges/challenges.go#L437-L478, I think we should default to sub for most unrecognized issuers. That'll cause the proof of possession to fail if it's the wrong claim, but all of this should be obviated once we're using X.509 CSRs.

That's what I've done in e812ec3.

[tetsuo-cpp]

Nice. This is looking good.

I can't approve this since I opened this PR. If one of you could approve, I think this is good to go.