The GitHub Actions provider decoded the response body without checking the
status code, so a failing OIDC endpoint surfaced as a raw json error:
fetching ambient OIDC credentials: invalid character 'u' looking for
beginning of value
Check the status code first and report it along with a truncated body, and
wrap decode failures with the provider name:
fetching ambient OIDC credentials: identity token request to provider
github-actions failed with status 502 Bad Gateway: "upstream connect
error or disconnect/reset before headers"
Fixes#4438
Signed-off-by: Eugene Kalinin <e.v.kalinin@gmail.com>
The GitHub Actions OIDC token provider uses Header.Add inside a retry
loop. On each retry iteration, an additional Authorization header is
appended to the request. By the third attempt, three identical headers
are sent. Some servers and proxies reject requests with duplicate
Authorization headers, causing retries to fail when they should
succeed.
Replace Header.Add with Header.Set so only one Authorization header
is ever present, regardless of how many retries occur.
Add a test that forces two retries via connection hijack and asserts
exactly one Authorization header is received on every attempt.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
* Remove explicit staticcheck and unused linter enables
They are enabled by default. For consistency, do not list them like
others that are enabled by default (for example govet) are not
explicitly listed either.
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* Enable makezero and nilnesserr linters
There are no findings from either at the moment, but they serve useful
purposes.
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* Ensure closing of TSA response body, enable bodyclose linter
This was flagged by bodyclose.
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* Vet internal ui.Infof/Warnf uses
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* Enable usestdlibvars linter, address findings
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* test: update e2e rekor service count
https://github.com/sigstore/cosign/pull/4213#pullrequestreview-2876276830
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
* Update e2e_test.sh to handle different healthy service totals
Rekor has healthchecks for 5 services, Fulcio currently has healthchecks for 3.
Signed-off-by: Hayden B <haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
Signed-off-by: Hayden B <haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden B <haydentherapper@users.noreply.github.com>
I've been seeing this quite a bit recently. I'm not sure why it happens,
but hopefully this helps.
Also, plumb context into the right place.
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>
These were removed in #2322, which made it an accidentally-semver-breaking
change. This unbreaks semver.
These should be removed at the next major version release or sooner if we decide
keeping semver is not important.
Signed-off-by: Zachary Newman <zjn@chainguard.dev>
Signed-off-by: Zachary Newman <zjn@chainguard.dev>
This is based on some work I have been doing here: https://github.com/mattmoor/oidc-magic
At present, it is fairly tedious to use the "keyless" flow inside of environments that have a form of ambient OIDC (e.g. GKE workload identity). For example, in the context of Tekton, one needs to overlay `cosign` on an image like `docker.io/google/cloud-sdk:slim`, and then during execution have the step do something like:
```yaml
command: ["/bin/sh"]
args:
- "-c"
- |
# Generate an identity token.
IDENTITY_TOKEN=$(gcloud auth print-identity-token --audiences=sigstore)
# Use the identity token to sign the image.
cosign sign \
-identity-token $IDENTITY_TOKEN \
my.registry/the-image@sha256:deadbeef
```
This change adds support for detecting when `cosign` is executing within an environment with this kind of ambient authentication, and automatically producing one when `-identity-token` is not specified (and `COSIGN_EXPERIMENTAL=true`).
This means the same signing can now be done with:
```yaml
args: ["sign", "my.registry/the-image@sha256:deadbeef"]
```
This is much simpler, but also the image will be both smaller (distroless) and more portable (not just GCP, but any provider we link).
Signed-off-by: Matt Moore <mattomata@gmail.com>
