739947de3d
This is based on some work I have been doing here: https://github.com/mattmoor/oidc-magic At present, it is fairly tedious to use the "keyless" flow inside of environments that have a form of ambient OIDC (e.g. GKE workload identity). For example, in the context of Tekton, one needs to overlay `cosign` on an image like `docker.io/google/cloud-sdk:slim`, and then during execution have the step do something like: ```yaml command: ["/bin/sh"] args: - "-c" - | # Generate an identity token. IDENTITY_TOKEN=$(gcloud auth print-identity-token --audiences=sigstore) # Use the identity token to sign the image. cosign sign \ -identity-token $IDENTITY_TOKEN \ my.registry/the-image@sha256:deadbeef ``` This change adds support for detecting when `cosign` is executing within an environment with this kind of ambient authentication, and automatically producing one when `-identity-token` is not specified (and `COSIGN_EXPERIMENTAL=true`). This means the same signing can now be done with: ```yaml args: ["sign", "my.registry/the-image@sha256:deadbeef"] ``` This is much simpler, but also the image will be both smaller (distroless) and more portable (not just GCP, but any provider we link). Signed-off-by: Matt Moore <mattomata@gmail.com>
18 lines
695 B
Go
18 lines
695 B
Go
//
|
|
// Copyright 2021 The Sigstore Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Package github defines a github implementation of the providers.Interface.
|
|
package github
|