Add environment variable token provider. #2864
Conversation
Codecov Report
@@ Coverage Diff @@
## main #2864 +/- ##
==========================================
+ Coverage 29.47% 29.54% +0.06%
==========================================
Files 151 152 +1
Lines 9679 9681 +2
==========================================
+ Hits 2853 2860 +7
+ Misses 6387 6382 -5
Partials 439 439
... and 2 files with indirect coverage changes Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
This adds a new token provider that looks for tokens located at SIGSTORE_ID_TOKEN. This is an alternative to COSIGN_IDENTITY_TOKEN, which is implemented as a Viper binding. ID_TOKEN was used instead of IDENTITY_TOKEN, since this seems to be consistent with other providers (e.g. ACTIONS_ID_TOKEN_REQUEST_TOKEN). If this ends up being confusing we can add support for both variants later if needed. Signed-off-by: Billy Lynch <billy@chainguard.dev>
|
Why does this solve the GitLab provider issue? Does GitLab let you control which environment variable its ID token is written to, in contrast to the other CI providers which have predefined, fixed env vars? |
Yup! Exactly. So you should be able to do something like this: build:
stage: build
id_tokens:
SIGSTORE_ID_TOKEN:
aud: sigstore
script:
- cosign sign ...https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html |
|
Sweet, thanks for clarifying! Can you also update pkg/providers/all/all.go? |
|
After this is in, we'll cut Cosign 2.0.1 |
|
Yes, I'd say we need a section to describe our available environment variables. |
Done! |
Signed-off-by: Billy Lynch <billy@chainguard.dev>
Summary
This adds a new token provider that looks for tokens located at
SIGSTORE_ID_TOKEN.This is an alternative to
COSIGN_IDENTITY_TOKEN, which is implemented as a Viper binding.ID_TOKENwas used instead ofIDENTITY_TOKEN, since this seems to be consistent with other providers (e.g.ACTIONS_ID_TOKEN_REQUEST_TOKEN). If this ends up being confusing we can add support for both variants later if needed.Fixes #2863, #2697, #1254
Release Note
SIGSTORE_ID_TOKENenvironment variable.Documentation
Should docs be added before this is actually released and available to people? 🤔
(it would be great if we could base the docs on cosign versions)