Skip to content

Commit 232020f

Browse files
loosebazookaloosebazooka
committed
Use the conformance token everywhere
Use the Untrusted GCP Beacon token provider dynamically in all tests and workflow examples, mostly avoiding dependency on ambient OIDC configuration in local development. Signed-off-by: Appu <appu@google.com>
1 parent 671f1b5 commit 232020f

8 files changed

Lines changed: 48 additions & 41 deletions

File tree

‎.github/workflows/examples.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ jobs:
1717
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.os }}-release
1818
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
1919

20-
permissions:
21-
id-token: write
22-
2320
steps:
2421
- name: Enable long paths in Git
2522
if: runner.os == 'Windows'

‎examples/hello-world/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ Simple sigstore signing examples
44

55
These examples sign with sigstore (and PGP as required by Maven Central)
66

7+
In CI: These example use env `SIGSTORE_JAVA_ID_TOKEN` from test.sh to use a throwaway id token
8+
79
## gradle
810

911
```

‎sigstore-gradle/sigstore-gradle-sign-base-plugin/src/test/kotlin/dev/sigstore/gradle/SigstoreSignTest.kt‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,19 @@
1717
package dev.sigstore.gradle
1818

1919
import dev.sigstore.testkit.BaseGradleTest
20-
import dev.sigstore.testkit.TestedGradle
2120
import dev.sigstore.testkit.TestedGradleAndSigstoreJava
22-
import dev.sigstore.testkit.TestedSigstoreJava
23-
import dev.sigstore.testkit.annotations.EnabledIfOidcExists
21+
import dev.sigstore.testkit.oidc.ConformanceTestingToken
2422
import org.assertj.core.api.Assertions.assertThat
2523
import org.gradle.util.GradleVersion
2624
import org.junit.jupiter.params.ParameterizedTest
2725
import org.junit.jupiter.params.provider.MethodSource
2826

29-
@EnabledIfOidcExists
3027
class SigstoreSignTest: BaseGradleTest() {
3128
@ParameterizedTest
3229
@MethodSource("gradleAndSigstoreJavaVersions")
3330
fun `sign file`(case: TestedGradleAndSigstoreJava) {
31+
val oidcToken = ConformanceTestingToken.getToken()
32+
gradleRunner.withEnvironment(mapOf("SIGSTORE_JAVA_ID_TOKEN" to oidcToken))
3433
val destLine =
3534
if (case.gradle.version < GradleVersion.version("8.0"))
3635
"""outputFile = file("helloProps.txt")"""

‎sigstore-gradle/sigstore-gradle-sign-plugin/src/test/kotlin/dev/sigstore/gradle/RemoveSigstoreAscTest.kt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,13 @@ package dev.sigstore.gradle
1919
import dev.sigstore.testkit.BaseGradleTest
2020
import dev.sigstore.testkit.TestedGradle
2121
import dev.sigstore.testkit.TestedGradleAndSigstoreJava
22-
import dev.sigstore.testkit.annotations.EnabledIfOidcExists
22+
import dev.sigstore.testkit.oidc.ConformanceTestingToken
2323
import org.assertj.core.api.Assertions.assertThat
2424
import org.assertj.core.api.SoftAssertions
2525
import org.gradle.util.GradleVersion
2626
import org.junit.jupiter.params.ParameterizedTest
2727
import org.junit.jupiter.params.provider.MethodSource
2828

29-
@EnabledIfOidcExists
3029
class RemoveSigstoreAscTest : BaseGradleTest() {
3130
companion object {
3231
@JvmStatic
@@ -102,6 +101,8 @@ class RemoveSigstoreAscTest : BaseGradleTest() {
102101
}
103102

104103
private fun prepareBuildScripts(case: TestedGradleAndSigstoreJava) {
104+
val oidcToken = ConformanceTestingToken.getToken()
105+
gradleRunner.withEnvironment(mapOf("SIGSTORE_JAVA_ID_TOKEN" to oidcToken))
105106
writeBuildGradle(
106107
"""
107108
plugins {

‎sigstore-gradle/sigstore-gradle-sign-plugin/src/test/kotlin/dev/sigstore/gradle/SigstorePublishSignTest.kt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,17 @@ package dev.sigstore.gradle
1818

1919
import dev.sigstore.testkit.BaseGradleTest
2020
import dev.sigstore.testkit.TestedGradleAndSigstoreJava
21-
import dev.sigstore.testkit.annotations.EnabledIfOidcExists
21+
import dev.sigstore.testkit.oidc.ConformanceTestingToken
2222
import org.assertj.core.api.Assertions.assertThat
2323
import org.junit.jupiter.params.ParameterizedTest
2424
import org.junit.jupiter.params.provider.MethodSource
2525

26-
@EnabledIfOidcExists
2726
class SigstorePublishSignTest : BaseGradleTest() {
2827
@ParameterizedTest
2928
@MethodSource("gradleAndSigstoreJavaVersions")
3029
fun `sign file`(case: TestedGradleAndSigstoreJava) {
30+
val oidcToken = ConformanceTestingToken.getToken()
31+
gradleRunner.withEnvironment(mapOf("SIGSTORE_JAVA_ID_TOKEN" to oidcToken))
3132
writeBuildGradle(
3233
"""
3334
plugins {

‎sigstore-java/src/test/java/dev/sigstore/KeylessTest.java‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@
1919
import dev.sigstore.bundle.Bundle;
2020
import dev.sigstore.dsse.InTotoPayload;
2121
import dev.sigstore.json.JsonParseException;
22+
import dev.sigstore.oidc.client.OidcClients;
23+
import dev.sigstore.oidc.client.TokenStringOidcClient;
2224
import dev.sigstore.testkit.annotations.DisabledIfSkipStaging;
2325
import dev.sigstore.testkit.annotations.EnabledIfOidcExists;
2426
import dev.sigstore.testkit.annotations.OidcProviderType;
27+
import dev.sigstore.testkit.oidc.ConformanceTestingToken;
2528
import dev.sigstore.trustroot.ImmutableSigstoreSigningConfig;
2629
import dev.sigstore.trustroot.Service;
2730
import dev.sigstore.tuf.SigstoreTufClient;
@@ -50,6 +53,9 @@ public class KeylessTest {
5053
public static List<byte[]> artifactDigests;
5154
public static String payload;
5255

56+
private static final OidcClients CONFORMANCE_TOKEN_CLIENT =
57+
OidcClients.of(TokenStringOidcClient.from(ConformanceTestingToken.newProvider()));
58+
5359
@BeforeAll
5460
public static void setupArtifact() throws IOException {
5561
artifactDigests = new ArrayList<>();
@@ -75,7 +81,7 @@ public static void setupArtifact() throws IOException {
7581

7682
@Test
7783
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
78-
public void sign_production() throws Exception {
84+
public void sign_production_and_test_oidc() throws Exception {
7985
var signer = KeylessSigner.builder().sigstorePublicDefaults().build();
8086
var results = signer.sign(artifactDigests);
8187

@@ -93,7 +99,6 @@ public void sign_production() throws Exception {
9399
* Should be merged into "sign_production" above when ready.
94100
*/
95101
@Test
96-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
97102
public void sign_production_rekorV2() throws Exception {
98103
// TODO(#1033): Get Rekor v2 service from TUF signing config when in prod
99104
var prodTufClient = SigstoreTufClient.builder().usePublicGoodInstance().build();
@@ -107,6 +112,7 @@ public void sign_production_rekorV2() throws Exception {
107112
var signer =
108113
KeylessSigner.builder()
109114
.sigstorePublicDefaults()
115+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
110116
.signingConfigProvider(() -> signingConfig)
111117
.enableRekorV2(true)
112118
.build();
@@ -123,11 +129,14 @@ public void sign_production_rekorV2() throws Exception {
123129

124130
@ParameterizedTest
125131
@ValueSource(booleans = {true, false})
126-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
127132
@DisabledIfSkipStaging
128133
public void sign_staging(boolean enableRekorV2) throws Exception {
129134
var signer =
130-
KeylessSigner.builder().sigstoreStagingDefaults().enableRekorV2(enableRekorV2).build();
135+
KeylessSigner.builder()
136+
.sigstoreStagingDefaults()
137+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
138+
.enableRekorV2(enableRekorV2)
139+
.build();
131140
var results = signer.sign(artifactDigests);
132141
verifySigningResult(results, enableRekorV2);
133142

@@ -139,7 +148,6 @@ public void sign_staging(boolean enableRekorV2) throws Exception {
139148
}
140149

141150
@Test
142-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
143151
public void attest_production() throws Exception {
144152
// TODO(#1033): Get Rekor v2 service from TUF signing config when in prod
145153
var prodTufClient = SigstoreTufClient.builder().usePublicGoodInstance().build();
@@ -153,6 +161,7 @@ public void attest_production() throws Exception {
153161
var signer =
154162
KeylessSigner.builder()
155163
.sigstorePublicDefaults()
164+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
156165
.signingConfigProvider(() -> signingConfig)
157166
.enableRekorV2(true)
158167
.build();
@@ -172,10 +181,14 @@ public void attest_production() throws Exception {
172181
}
173182

174183
@Test
175-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
176184
@DisabledIfSkipStaging
177185
public void attest_staging() throws Exception {
178-
var signer = KeylessSigner.builder().sigstoreStagingDefaults().enableRekorV2(true).build();
186+
var signer =
187+
KeylessSigner.builder()
188+
.sigstoreStagingDefaults()
189+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
190+
.enableRekorV2(true)
191+
.build();
179192
var result = signer.attest(payload);
180193

181194
Assertions.assertNotNull(result.getDsseEnvelope().get());

‎sigstore-maven-plugin/src/test/java/dev/sigstore/plugin/test/MavenTestProject.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
/**
3030
* Initialize a test project verifier. You should use this to inject the right local repository into
31-
* settings.xml and the proejct version into pom.xml. Works with the test Maven projects in the
31+
* settings.xml and the project version into pom.xml. Works with the test Maven projects in the
3232
* {@code resources/maven/projects} directory.
3333
*/
3434
public class MavenTestProject {

sigstore-testkit/src/main/java/dev/sigstore/testkit/oidc/ConformanceTestingTokenProvider.java renamed to sigstore-testkit/src/main/java/dev/sigstore/testkit/oidc/ConformanceTestingToken.java

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -29,33 +29,27 @@
2929
* should never be used by actual signers and should only be available in tests. Use this with the
3030
* {@link TokenStringOidcClient}.
3131
*/
32-
public class ConformanceTestingTokenProvider implements TokenStringOidcClient.TokenStringProvider {
32+
public class ConformanceTestingToken {
3333

34-
public static ConformanceTestingTokenProvider newProviderFromGithub() {
35-
return new ConformanceTestingTokenProvider(
36-
"https://raw.githubusercontent.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/refs/heads/current-token/oidc-token.txt");
37-
}
38-
39-
public static ConformanceTestingTokenProvider newProviderFromGcp() {
40-
return new ConformanceTestingTokenProvider(
41-
"https://storage.googleapis.com/sigstore-conformance-testing-token/untrusted-testing-token.txt");
42-
}
43-
44-
private final String tokenUrl;
45-
46-
private ConformanceTestingTokenProvider(String tokenUrl) {
47-
this.tokenUrl = tokenUrl;
48-
}
34+
public static TokenStringOidcClient.TokenStringProvider newProvider() {
35+
return new TokenStringOidcClient.TokenStringProvider() {
36+
@Override
37+
public String getTokenString(Map<String, String> env) throws Exception {
38+
return getToken();
39+
}
4940

50-
@Override
51-
public boolean isEnabled(Map<String, String> env) {
52-
return true;
41+
@Override
42+
public boolean isEnabled(Map<String, String> env) {
43+
return true;
44+
}
45+
};
5346
}
5447

55-
@Override
56-
public String getTokenString(Map<String, String> env) throws Exception {
48+
public static String getToken() throws Exception {
5749
HttpClient client = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL).build();
58-
URI fileUri = new URI(tokenUrl);
50+
URI fileUri =
51+
new URI(
52+
"https://storage.googleapis.com/sigstore-conformance-testing-token/untrusted-testing-token.txt");
5953
HttpRequest request =
6054
HttpRequest.newBuilder()
6155
.uri(fileUri)

0 commit comments

Comments
 (0)