From 663220a7fb4e4df2ee8e0f87c8cc0610dddd49d8 Mon Sep 17 00:00:00 2001
From: Patrick Kwiatkowski <patrick.r.kwiatkowski@lmco.com>
Date: Sun, 19 Nov 2023 11:01:44 -0500
Subject: [PATCH 1/2] fix: added oidc redirect url option for fulcio

Signed-off-by: Patrick Kwiatkowski <patrick.r.kwiatkowski@lmco.com>
---
 signer/fulcio/fulcio.go | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/signer/fulcio/fulcio.go b/signer/fulcio/fulcio.go
index 8983f8c0..7b9e7966 100644
--- a/signer/fulcio/fulcio.go
+++ b/signer/fulcio/fulcio.go
@@ -105,14 +105,29 @@ func init() {
 				return fsp, nil
 			},
 		),
+		registry.StringConfigOption(
+			"oidc-redirect-url",
+			"OIDC redirect URL (Optional). The default oidc-redirect-url is 'http://localhost:0/auth/callback'.",
+			"",
+			func(sp signer.SignerProvider, oidcRedirectUrl string) (signer.SignerProvider, error) {
+				fsp, ok := sp.(FulcioSignerProvider)
+				if !ok {
+					return sp, fmt.Errorf("provided signer provider is not a fulcio signer provider")
+				}
+
+				WithOidcRedirectUrl(oidcRedirectUrl)(&fsp)
+				return fsp, nil
+			},
+		),
 	)
 }
 
 type FulcioSignerProvider struct {
-	FulcioURL    string
-	OidcIssuer   string
-	OidcClientID string
-	Token        string
+	FulcioURL        string
+	OidcIssuer       string
+	OidcClientID     string
+	Token            string
+	OidcRedirectUrl  string
 }
 
 type Option func(*FulcioSignerProvider)
@@ -141,6 +156,12 @@ func WithToken(tokenOption string) Option {
 	}
 }
 
+func WithOidcRedirectUrl(oidcRedirectUrl string) Option {
+	return func(fsp *FulcioSignerProvider) {
+		fsp.OidcRedirectUrl = oidcRedirectUrl
+	}
+}
+
 func New(opts ...Option) FulcioSignerProvider {
 	fsp := FulcioSignerProvider{}
 	for _, opt := range opts {
@@ -214,7 +235,7 @@ func (fsp FulcioSignerProvider) Signer(ctx context.Context) (cryptoutil.Signer,
 		raw = fsp.Token
 
 	case fsp.Token == "" && isatty.IsTerminal(os.Stdin.Fd()):
-		tok, err := oauthflow.OIDConnect(fsp.OidcIssuer, fsp.OidcClientID, "", "", oauthflow.DefaultIDTokenGetter)
+		tok, err := oauthflow.OIDConnect(fsp.OidcIssuer, fsp.OidcClientID, "", fsp.OidcRedirectUrl, oauthflow.DefaultIDTokenGetter)
 		if err != nil {
 			return nil, err
 		}

From d22d879832ef626f5b880e643cc5c610f6d55f2a Mon Sep 17 00:00:00 2001
From: Tom Meadows <tom@tmlabs.co.uk>
Date: Fri, 12 Jan 2024 17:23:43 +0000
Subject: [PATCH 2/2] Update fulcio.go

---
 signer/fulcio/fulcio.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/signer/fulcio/fulcio.go b/signer/fulcio/fulcio.go
index bfc4afed..fc4c55d8 100644
--- a/signer/fulcio/fulcio.go
+++ b/signer/fulcio/fulcio.go
@@ -141,7 +141,7 @@ type FulcioSignerProvider struct {
 	OidcIssuer       string
 	OidcClientID     string
 	Token            string
-  TokenPath        string
+  	TokenPath        string
 	OidcRedirectUrl  string
 }