Skip to content

Commit 6d418e2

Browse files
loosebazookaloosebazooka
authored
Merge pull request #1216 from sigstore/use-conformance-token-everywhere
Use the conformance token everywhere
2 parents 5a3896e + 3fbb471 commit 6d418e2

8 files changed

Lines changed: 48 additions & 41 deletions

File tree

‎.github/workflows/examples.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ jobs:
1717
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.os }}-release
1818
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
1919

20-
permissions:
21-
id-token: write
22-
2320
steps:
2421
- name: Enable long paths in Git
2522
if: runner.os == 'Windows'

‎examples/hello-world/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ Simple sigstore signing examples
44

55
These examples sign with sigstore (and PGP as required by Maven Central)
66

7+
In CI: These example use env `SIGSTORE_JAVA_ID_TOKEN` from test.sh to use a throwaway id token
8+
79
## gradle
810

911
```

‎sigstore-gradle/sigstore-gradle-sign-base-plugin/src/test/kotlin/dev/sigstore/gradle/SigstoreSignTest.kt‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,19 @@
1717
package dev.sigstore.gradle
1818

1919
import dev.sigstore.testkit.BaseGradleTest
20-
import dev.sigstore.testkit.TestedGradle
2120
import dev.sigstore.testkit.TestedGradleAndSigstoreJava
22-
import dev.sigstore.testkit.TestedSigstoreJava
23-
import dev.sigstore.testkit.annotations.EnabledIfOidcExists
21+
import dev.sigstore.testkit.oidc.ConformanceTestingToken
2422
import org.assertj.core.api.Assertions.assertThat
2523
import org.gradle.util.GradleVersion
2624
import org.junit.jupiter.params.ParameterizedTest
2725
import org.junit.jupiter.params.provider.MethodSource
2826

29-
@EnabledIfOidcExists
3027
class SigstoreSignTest: BaseGradleTest() {
3128
@ParameterizedTest
3229
@MethodSource("gradleAndSigstoreJavaVersions")
3330
fun `sign file`(case: TestedGradleAndSigstoreJava) {
31+
val oidcToken = ConformanceTestingToken.getToken()
32+
gradleRunner.withEnvironment(mapOf("SIGSTORE_JAVA_ID_TOKEN" to oidcToken))
3433
val destLine =
3534
if (case.gradle.version < GradleVersion.version("8.0"))
3635
"""outputFile = file("helloProps.txt")"""

‎sigstore-gradle/sigstore-gradle-sign-plugin/src/test/kotlin/dev/sigstore/gradle/RemoveSigstoreAscTest.kt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,13 @@ package dev.sigstore.gradle
1919
import dev.sigstore.testkit.BaseGradleTest
2020
import dev.sigstore.testkit.TestedGradle
2121
import dev.sigstore.testkit.TestedGradleAndSigstoreJava
22-
import dev.sigstore.testkit.annotations.EnabledIfOidcExists
22+
import dev.sigstore.testkit.oidc.ConformanceTestingToken
2323
import org.assertj.core.api.Assertions.assertThat
2424
import org.assertj.core.api.SoftAssertions
2525
import org.gradle.util.GradleVersion
2626
import org.junit.jupiter.params.ParameterizedTest
2727
import org.junit.jupiter.params.provider.MethodSource
2828

29-
@EnabledIfOidcExists
3029
class RemoveSigstoreAscTest : BaseGradleTest() {
3130
companion object {
3231
@JvmStatic
@@ -102,6 +101,8 @@ class RemoveSigstoreAscTest : BaseGradleTest() {
102101
}
103102

104103
private fun prepareBuildScripts(case: TestedGradleAndSigstoreJava) {
104+
val oidcToken = ConformanceTestingToken.getToken()
105+
gradleRunner.withEnvironment(mapOf("SIGSTORE_JAVA_ID_TOKEN" to oidcToken))
105106
writeBuildGradle(
106107
"""
107108
plugins {

‎sigstore-gradle/sigstore-gradle-sign-plugin/src/test/kotlin/dev/sigstore/gradle/SigstorePublishSignTest.kt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,17 @@ package dev.sigstore.gradle
1818

1919
import dev.sigstore.testkit.BaseGradleTest
2020
import dev.sigstore.testkit.TestedGradleAndSigstoreJava
21-
import dev.sigstore.testkit.annotations.EnabledIfOidcExists
21+
import dev.sigstore.testkit.oidc.ConformanceTestingToken
2222
import org.assertj.core.api.Assertions.assertThat
2323
import org.junit.jupiter.params.ParameterizedTest
2424
import org.junit.jupiter.params.provider.MethodSource
2525

26-
@EnabledIfOidcExists
2726
class SigstorePublishSignTest : BaseGradleTest() {
2827
@ParameterizedTest
2928
@MethodSource("gradleAndSigstoreJavaVersions")
3029
fun `sign file`(case: TestedGradleAndSigstoreJava) {
30+
val oidcToken = ConformanceTestingToken.getToken()
31+
gradleRunner.withEnvironment(mapOf("SIGSTORE_JAVA_ID_TOKEN" to oidcToken))
3132
writeBuildGradle(
3233
"""
3334
plugins {

‎sigstore-java/src/test/java/dev/sigstore/KeylessTest.java‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@
1919
import dev.sigstore.bundle.Bundle;
2020
import dev.sigstore.dsse.InTotoPayload;
2121
import dev.sigstore.json.JsonParseException;
22+
import dev.sigstore.oidc.client.OidcClients;
23+
import dev.sigstore.oidc.client.TokenStringOidcClient;
2224
import dev.sigstore.testkit.annotations.DisabledIfSkipStaging;
2325
import dev.sigstore.testkit.annotations.EnabledIfOidcExists;
2426
import dev.sigstore.testkit.annotations.OidcProviderType;
27+
import dev.sigstore.testkit.oidc.ConformanceTestingToken;
2528
import dev.sigstore.trustroot.ImmutableSigstoreSigningConfig;
2629
import dev.sigstore.trustroot.Service;
2730
import dev.sigstore.tuf.SigstoreTufClient;
@@ -50,6 +53,9 @@ public class KeylessTest {
5053
public static List<byte[]> artifactDigests;
5154
public static String payload;
5255

56+
private static final OidcClients CONFORMANCE_TOKEN_CLIENT =
57+
OidcClients.of(TokenStringOidcClient.from(ConformanceTestingToken.newProvider()));
58+
5359
@BeforeAll
5460
public static void setupArtifact() throws IOException {
5561
artifactDigests = new ArrayList<>();
@@ -75,7 +81,7 @@ public static void setupArtifact() throws IOException {
7581

7682
@Test
7783
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
78-
public void sign_production() throws Exception {
84+
public void sign_production_and_test_oidc() throws Exception {
7985
var signer = KeylessSigner.builder().sigstorePublicDefaults().build();
8086
var results = signer.sign(artifactDigests);
8187

@@ -93,7 +99,6 @@ public void sign_production() throws Exception {
9399
* Should be merged into "sign_production" above when ready.
94100
*/
95101
@Test
96-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
97102
public void sign_production_rekorV2() throws Exception {
98103
// TODO(#1033): Get Rekor v2 service from TUF signing config when in prod
99104
var prodTufClient = SigstoreTufClient.builder().usePublicGoodInstance().build();
@@ -107,6 +112,7 @@ public void sign_production_rekorV2() throws Exception {
107112
var signer =
108113
KeylessSigner.builder()
109114
.sigstorePublicDefaults()
115+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
110116
.signingConfigProvider(() -> signingConfig)
111117
.enableRekorV2(true)
112118
.build();
@@ -123,11 +129,14 @@ public void sign_production_rekorV2() throws Exception {
123129

124130
@ParameterizedTest
125131
@ValueSource(booleans = {true, false})
126-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
127132
@DisabledIfSkipStaging
128133
public void sign_staging(boolean enableRekorV2) throws Exception {
129134
var signer =
130-
KeylessSigner.builder().sigstoreStagingDefaults().enableRekorV2(enableRekorV2).build();
135+
KeylessSigner.builder()
136+
.sigstoreStagingDefaults()
137+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
138+
.enableRekorV2(enableRekorV2)
139+
.build();
131140
var results = signer.sign(artifactDigests);
132141
verifySigningResult(results, enableRekorV2);
133142

@@ -139,7 +148,6 @@ public void sign_staging(boolean enableRekorV2) throws Exception {
139148
}
140149

141150
@Test
142-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
143151
public void attest_production() throws Exception {
144152
// TODO(#1033): Get Rekor v2 service from TUF signing config when in prod
145153
var prodTufClient = SigstoreTufClient.builder().usePublicGoodInstance().build();
@@ -153,6 +161,7 @@ public void attest_production() throws Exception {
153161
var signer =
154162
KeylessSigner.builder()
155163
.sigstorePublicDefaults()
164+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
156165
.signingConfigProvider(() -> signingConfig)
157166
.enableRekorV2(true)
158167
.build();
@@ -172,10 +181,14 @@ public void attest_production() throws Exception {
172181
}
173182

174183
@Test
175-
@EnabledIfOidcExists(provider = OidcProviderType.ANY)
176184
@DisabledIfSkipStaging
177185
public void attest_staging() throws Exception {
178-
var signer = KeylessSigner.builder().sigstoreStagingDefaults().enableRekorV2(true).build();
186+
var signer =
187+
KeylessSigner.builder()
188+
.sigstoreStagingDefaults()
189+
.forceCredentialProviders(CONFORMANCE_TOKEN_CLIENT)
190+
.enableRekorV2(true)
191+
.build();
179192
var result = signer.attest(payload);
180193

181194
Assertions.assertNotNull(result.getDsseEnvelope().get());

‎sigstore-maven-plugin/src/test/java/dev/sigstore/plugin/test/MavenTestProject.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
/**
3030
* Initialize a test project verifier. You should use this to inject the right local repository into
31-
* settings.xml and the proejct version into pom.xml. Works with the test Maven projects in the
31+
* settings.xml and the project version into pom.xml. Works with the test Maven projects in the
3232
* {@code resources/maven/projects} directory.
3333
*/
3434
public class MavenTestProject {

sigstore-testkit/src/main/java/dev/sigstore/testkit/oidc/ConformanceTestingTokenProvider.java renamed to sigstore-testkit/src/main/java/dev/sigstore/testkit/oidc/ConformanceTestingToken.java

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -29,33 +29,27 @@
2929
* should never be used by actual signers and should only be available in tests. Use this with the
3030
* {@link TokenStringOidcClient}.
3131
*/
32-
public class ConformanceTestingTokenProvider implements TokenStringOidcClient.TokenStringProvider {
32+
public class ConformanceTestingToken {
3333

34-
public static ConformanceTestingTokenProvider newProviderFromGithub() {
35-
return new ConformanceTestingTokenProvider(
36-
"https://raw.githubusercontent.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/refs/heads/current-token/oidc-token.txt");
37-
}
38-
39-
public static ConformanceTestingTokenProvider newProviderFromGcp() {
40-
return new ConformanceTestingTokenProvider(
41-
"https://storage.googleapis.com/sigstore-conformance-testing-token/untrusted-testing-token.txt");
42-
}
43-
44-
private final String tokenUrl;
45-
46-
private ConformanceTestingTokenProvider(String tokenUrl) {
47-
this.tokenUrl = tokenUrl;
48-
}
34+
public static TokenStringOidcClient.TokenStringProvider newProvider() {
35+
return new TokenStringOidcClient.TokenStringProvider() {
36+
@Override
37+
public String getTokenString(Map<String, String> env) throws Exception {
38+
return getToken();
39+
}
4940

50-
@Override
51-
public boolean isEnabled(Map<String, String> env) {
52-
return true;
41+
@Override
42+
public boolean isEnabled(Map<String, String> env) {
43+
return true;
44+
}
45+
};
5346
}
5447

55-
@Override
56-
public String getTokenString(Map<String, String> env) throws Exception {
48+
public static String getToken() throws Exception {
5749
HttpClient client = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL).build();
58-
URI fileUri = new URI(tokenUrl);
50+
URI fileUri =
51+
new URI(
52+
"https://storage.googleapis.com/sigstore-conformance-testing-token/untrusted-testing-token.txt");
5953
HttpRequest request =
6054
HttpRequest.newBuilder()
6155
.uri(fileUri)

0 commit comments

Comments
 (0)