Support multiple issuers and alternative proofs (sigstore#23)

di · tetsuo-cpp · web-flow · commit 1b2037996d09 · 2022-04-11T12:44:00.000+10:00
* Change signed_email_address to signed_proof

* Support alternative proofs

* Add types-pyjwt as dev dependency

* Type hints

* Simplify OIDC issuers structure

Co-authored-by: Alex Cameron &lt;asc@tetsuo.sh&gt;
diff --git a/setup.py b/setup.py
@@ -43,6 +43,7 @@
             "mypy",
             "types-cryptography",
             "types-requests",
+            "types-pyjwt",
         ]
     },
     classifiers=[
diff --git a/sigstore/_internal/fulcio/_client.py b/sigstore/_internal/fulcio/_client.py
@@ -70,7 +70,7 @@ class FulcioCertificateSigningRequest:
     """Certificate request"""
 
     public_key: ec.EllipticCurvePublicKey
-    signed_email_address: bytes
+    signed_proof: bytes
 
     @property
     def data(self) -> str:
@@ -82,7 +82,7 @@ def data(self) -> str:
             "publicKey": {
                 "content": base64.b64encode(content).decode(),
             },
-            "signedEmailAddress": base64.b64encode(self.signed_email_address).decode(),
+            "signedEmailAddress": base64.b64encode(self.signed_proof).decode(),
         }
         return json.dumps(data)
 
diff --git a/sigstore/_internal/oidc.py b/sigstore/_internal/oidc.py
@@ -0,0 +1,42 @@
+import jwt
+
+# From https://github.com/sigstore/fulcio/blob/b2186c01da1ddf807bde3ea8c450226d8e001d88/pkg/config/config.go#L182-L201  # noqa
+OIDC_ISSUERS = {
+    "https://accounts.google.com": "email",
+    "https://oauth2.sigstore.dev/auth": "email",
+    "https://token.actions.githubusercontent.com": "sub",
+}
+AUDIENCE = "sigstore"
+
+
+class IdentityError(Exception):
+    pass
+
+
+class Identity:
+    def __init__(self, identity_token: str) -> None:
+        identity_jwt = jwt.decode(identity_token, options={"verify_signature": False})
+
+        if "iss" not in identity_jwt:
+            raise IdentityError("Identity token  missing the required 'iss' claim")
+
+        iss = identity_jwt.get("iss")
+
+        if iss not in OIDC_ISSUERS:
+            raise IdentityError(f"Not a valid OIDC issuer: {iss!r}")
+
+        if "aud" not in identity_jwt:
+            raise IdentityError("Identity token missing the required 'aud' claim")
+
+        aud = identity_jwt.get("aud")
+
+        if aud != AUDIENCE:
+            raise IdentityError(f"Audience should be {AUDIENCE!r}, not {aud!r}")
+
+        proof_claim = OIDC_ISSUERS[iss]
+        if proof_claim not in identity_jwt:
+            raise IdentityError(
+                f"Identity token missing the required {proof_claim!r} claim"
+            )
+
+        self.proof = identity_jwt.get(proof_claim)

Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,7 @@`
`43`	`43`	`"mypy",`
`44`	`44`	`"types-cryptography",`
`45`	`45`	`"types-requests",`
	`46`	`+ "types-pyjwt",`
`46`	`47`	`]`
`47`	`48`	`},`
`48`	`49`	`classifiers=[`