Implement standardized CI extensions for GitHub #1073
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This adds the set of standardized extensions and creates the mapping for GitHub Actions. All extension values are DER-encoded strings. This also creates a duplicated issuer extension to match the encoding that was used for the new extensions. OIDs 1.1 through 1.6 will be deprecated but still present in the certificates until a future major version of Fulcio. Updated the OID numbers so that the issuer is the first of the new OIDs. A future refactor will be ideal when implementing the extensions for other CI platforms. Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
|
Tested locally with a token from GHA: |
Codecov Report
@@ Coverage Diff @@
## main #1073 +/- ##
==========================================
+ Coverage 55.08% 55.91% +0.82%
==========================================
Files 48 48
Lines 2525 2783 +258
==========================================
+ Hits 1391 1556 +165
- Misses 1034 1097 +63
- Partials 100 130 +30
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
feelepxyz
reviewed
Mar 21, 2023
feelepxyz
reviewed
Mar 21, 2023
feelepxyz
previously approved these changes
Mar 21, 2023
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
|
Thanks for the reviews, updated! |
haydentherapper
commented
Mar 24, 2023
There was a problem hiding this comment.
With the changes, confirmed the extensions are still the same:
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
Code Signing
X509v3 Subject Key Identifier:
1F:75:6F:8E:37:A6:C8:5B:97:89:B8:19:93:D5:62:8A:82:AF:CB:43
X509v3 Authority Key Identifier:
5C:31:C1:66:6A:A3:F4:D1:72:70:26:BA:15:3F:C7:89:44:B5:E3:76
X509v3 Subject Alternative Name: critical
URI:https://github.com/haydentherapper/test-repository/.github/workflows/test.yaml@refs/heads/main
1.3.6.1.4.1.57264.1.1:
https://token.actions.githubusercontent.com
1.3.6.1.4.1.57264.1.2:
workflow_dispatch
1.3.6.1.4.1.57264.1.3:
618f07451338511a79a44612ae6bc87622e2f6ec
1.3.6.1.4.1.57264.1.4:
Test
1.3.6.1.4.1.57264.1.5:
haydentherapper/test-repository
1.3.6.1.4.1.57264.1.6:
refs/heads/main
1.3.6.1.4.1.57264.1.8:
.+https://token.actions.githubusercontent.com
1.3.6.1.4.1.57264.1.9:
.^https://github.com/haydentherapper/test-repository/.github/workflows/test.yaml@refs/heads/main
1.3.6.1.4.1.57264.1.10:
.(618f07451338511a79a44612ae6bc87622e2f6ec
1.3.6.1.4.1.57264.1.11:
github-hosted .
1.3.6.1.4.1.57264.1.12:
.2https://github.com/haydentherapper/test-repository
1.3.6.1.4.1.57264.1.13:
.(618f07451338511a79a44612ae6bc87622e2f6ec
1.3.6.1.4.1.57264.1.14:
..refs/heads/main
1.3.6.1.4.1.57264.1.15:
..606210217
1.3.6.1.4.1.57264.1.16:
."https://github.com/haydentherapper
1.3.6.1.4.1.57264.1.17:
..8418760
1.3.6.1.4.1.57264.1.18:
.^https://github.com/haydentherapper/test-repository/.github/workflows/test.yaml@refs/heads/main
1.3.6.1.4.1.57264.1.19:
.(618f07451338511a79a44612ae6bc87622e2f6ec
1.3.6.1.4.1.57264.1.20:
..workflow_dispatch
1.3.6.1.4.1.57264.1.21:
.Uhttps://github.com/haydentherapper/test-repository/actions/runs/4515368585/attempts/1
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
wlynch
approved these changes
Mar 24, 2023
bobcallaway
approved these changes
Mar 27, 2023
|
@haydentherapper amazing 🎉 is this deployed to staging? Happy to test this out. |
|
Will be in a few hours, I’ll update the pr once it’s live. |
|
@feelepxyz It's now in staging |
|
@haydentherapper Nice! 🎉 I successfully generated a sigstore bundle against staging fulcio but struggling to verify it using I can see the cert extensions: |
|
Is Sigstore-js expecting trusted_root.json, because we don’t have that in the staging TUF repo. It was manually set up once as a hacky solution. We can regenerate it with that file if needed, and long term make staging more like the prod repo |
Yep I think so, I was initially seeing weird results where it was using the prod tuf cache but clearing this it seems like the issue is that the staging repo doesn't have the new trusted root target. Regenerating with this file would be ace! cc @bdehamer |
|
This came up yesterday too for sigstore-python too. sigstore/root-signing#755 to track |
|
@feelepxyz this should now be in prod |
|
@feelepxyz Actually not yet, ran into some rollout issues |
|
@haydentherapper I'm out for the next week so won't be able to test this further. Are you still wanting to get the trusted root changes up on staging before we push this to prod? @bdehamer would you be up for doing a round of staging cert verification with sigstore-js when the staging root is up? |
|
Oh sorry, this is out in prod now! It was released last week while I was out. |
|
The trusted root file has also been rolled out to staging. |
Oh even better! 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds the set of standardized extensions and creates the mapping for GitHub Actions. All extension values are DER-encoded strings.
This also creates a duplicated issuer extension to match the encoding that was used for the new extensions. OIDs 1.1 through 1.6 will be deprecated but still present in the certificates until a future major version of Fulcio. Updated the OID numbers so that the issuer is the first of the new OIDs.
A future refactor will be ideal when implementing the extensions for other CI platforms. For now, this PR is optimized for just this one platform.
Fixes #754
Fixes #900
Summary
Release Note
Added a set of extensions for additional values for GitHub Actions. Added a second issuer extension with the proper DER encoding.
Documentation