-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Extract cli into a separate gem we can publish
So other workflows can `gem exec sigstore-cli` without rewriting its functionality over and over Signed-off-by: Samuel Giddins <segiddins@segiddins.me>
- Loading branch information
Showing
19 changed files
with
230 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| #!/usr/bin/env ruby | ||
| # frozen_string_literal: true | ||
|
|
||
| # | ||
| # This file was generated by Bundler. | ||
| # | ||
| # The application 'sigstore-cli' is installed as part of a gem, and | ||
| # this file is here to facilitate running it. | ||
| # | ||
|
|
||
| ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) | ||
|
|
||
| bundle_binstub = File.expand_path("bundle", __dir__) | ||
|
|
||
| if File.file?(bundle_binstub) | ||
| if File.read(bundle_binstub, 300).include?("This file was generated by Bundler") | ||
| load(bundle_binstub) | ||
| else | ||
| abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run. | ||
| Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.") | ||
| end | ||
| end | ||
|
|
||
| require "rubygems" | ||
| require "bundler/setup" | ||
|
|
||
| load Gem.bin_path("sigstore-cli", "sigstore-cli") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| pkg/ | ||
| *.gem |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| #!/usr/bin/env ruby | ||
| # frozen_string_literal: true | ||
|
|
||
| require "sigstore/cli" | ||
| Sigstore::CLI.start |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| # frozen_string_literal: true | ||
|
|
||
| class Sigstore::CLI | ||
| class IdToken | ||
| include Sigstore::Loggable | ||
|
|
||
| class AmbientCredentialError < Sigstore::Error | ||
| end | ||
|
|
||
| def self.detect_credential | ||
| [ | ||
| GitHub | ||
| # detect_gcp, | ||
| # detect_buildkite, | ||
| # detect_gitlab, | ||
| # detect_circleci | ||
| ].each do |detector| | ||
| credential = detector.call("sigstore") | ||
| return credential if credential | ||
| end | ||
|
|
||
| logger.debug { "failed to find ambient OIDC credential" } | ||
|
|
||
| nil | ||
| end | ||
|
|
||
| def self.call(audience) | ||
| new(audience).call | ||
| end | ||
|
|
||
| def initialize(audience) | ||
| @audience = audience | ||
| end | ||
|
|
||
| def call | ||
| raise NotImplementedError, "#{self.class}#call" | ||
| end | ||
|
|
||
| class GitHub < IdToken | ||
| class PermissionCredentialError < Sigstore::Error | ||
| end | ||
|
|
||
| def call | ||
| logger.debug { "looking for OIDC credentials" } | ||
| unless ENV["GITHUB_ACTIONS"] | ||
| logger.debug { "environment doesn't look like a GH action; giving up" } | ||
| return | ||
| end | ||
|
|
||
| req_token = ENV.fetch("ACTIONS_ID_TOKEN_REQUEST_TOKEN", nil) | ||
| unless req_token | ||
| raise PermissionCredentialError, | ||
| "missing or insufficient OIDC token permissions, " \ | ||
| "the ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variable was unset" | ||
| end | ||
|
|
||
| req_url = ENV.fetch("ACTIONS_ID_TOKEN_REQUEST_URL", nil) | ||
| unless req_url | ||
| raise PermissionCredentialError, | ||
| "missing or insufficient OIDC token permissions, " \ | ||
| "the ACTIONS_ID_TOKEN_REQUEST_URL environment variable was unset" | ||
| end | ||
| req_url = URI.parse(req_url) | ||
| req_url.query = "audience=#{URI.encode_uri_component(@audience)}" | ||
|
|
||
| logger.debug { "requesting OIDC token" } | ||
| resp = Net::HTTP.get_request( | ||
| req_url, { "Authorization" => "bearer #{req_token}" } | ||
| ) | ||
|
|
||
| begin | ||
| resp.value | ||
| rescue Net::HTTPExceptions | ||
| raise AmbientCredentialError, "OIDC token request failed (code=#{resp.code}, body=#{resp.body})" | ||
| rescue Timeout::Error | ||
| raise AmbientCredentialError, "OIDC token request timed out" | ||
| end | ||
|
|
||
| begin | ||
| body = JSON.parse resp.body | ||
| rescue StandardError | ||
| raise AmbientCredentialError, "malformed or incomplete json" | ||
| else | ||
| body.fetch("value") | ||
| end | ||
| end | ||
| end | ||
| end | ||
| end |
Oops, something went wrong.