Skip to content

Allow signers to specify allow list of oidc ids #1909

Allow signers to specify allow list of oidc ids

Allow signers to specify allow list of oidc ids #1909

Triggered via push October 18, 2023 18:04
Status Failure
Total duration 4m 47s
Artifacts

ci.yaml

on: push
Matrix: build
Fit to window
Zoom out
Zoom in

Annotations

4 errors and 2 warnings
build (17): task ':sigstore-java:spotlessJavaCheck'#L1
Execution failed for task ':sigstore-java:spotlessJavaCheck': The following files had format violations: src/test/java/dev/sigstore/KeylessTest.java @@ -18,7 +18,6 @@ import·com.google.common.hash.Hashing; import·dev.sigstore.bundle.BundleFactory; import·dev.sigstore.encryption.certificates.Certificates; -import·dev.sigstore.oidc.client.OidcToken; import·dev.sigstore.rekor.client.RekorTypeException; import·dev.sigstore.rekor.client.RekorTypes; import·dev.sigstore.testkit.annotations.EnabledIfOidcExists; @@ -81,22 +80,29 @@ ··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB) ··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository ··public·void·sign_failGithubOidcCheck()·throws·Exception·{ -····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities( -········List.of(OidcIdentity.of("[email protected]",·"goose.com")) -····).build(); -····var·ex·=·Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests)); -····Assertions.assertEquals("Obtained·Oidc·Token·" -········+·OidcIdentity.of("github·machine",·"github.com") -········+·"·does·not·match·any·identities·in·allow·list",·ex.getMessage()); +····var·signer·= +········KeylessSigner.builder() +············.sigstorePublicDefaults() +············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goose.com"))) +············.build(); +····var·ex·= +········Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests)); +····Assertions.assertEquals( +········"Obtained·Oidc·Token·" +············+·OidcIdentity.of("github·machine",·"github.com") +············+·"·does·not·match·any·identities·in·allow·list", +········ex.getMessage()); ··} ··@test ··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB) ··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository ··public·void·sign_passGithubOidcCheck()·throws·Exception·{ -····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities( -········List.of(OidcIdentity.of("[email protected]",·"goog")) -····).build(); +····var·signer·= +········KeylessSigner.builder() +············.sigstorePublicDefaults() +············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goog"))) +············.build(); ····signer.sign(artifactDigests); ··} Run './gradlew :sigstore-java:spotlessApply' to fix these violations. at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:111) at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:53) at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:125) at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58) at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51) at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29) at org.gradle.api.internal.tasks.execution.TaskExecution$3.run(TaskExecution.java:248) at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29) at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26) at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66) at org.gradle.in
build (17)
Gradle build failed: see console output for details
build (11): task ':sigstore-java:spotlessJavaCheck'#L1
Execution failed for task ':sigstore-java:spotlessJavaCheck': The following files had format violations: src/test/java/dev/sigstore/KeylessTest.java @@ -18,7 +18,6 @@ import·com.google.common.hash.Hashing; import·dev.sigstore.bundle.BundleFactory; import·dev.sigstore.encryption.certificates.Certificates; -import·dev.sigstore.oidc.client.OidcToken; import·dev.sigstore.rekor.client.RekorTypeException; import·dev.sigstore.rekor.client.RekorTypes; import·dev.sigstore.testkit.annotations.EnabledIfOidcExists; @@ -81,22 +80,29 @@ ··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB) ··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository ··public·void·sign_failGithubOidcCheck()·throws·Exception·{ -····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities( -········List.of(OidcIdentity.of("[email protected]",·"goose.com")) -····).build(); -····var·ex·=·Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests)); -····Assertions.assertEquals("Obtained·Oidc·Token·" -········+·OidcIdentity.of("github·machine",·"github.com") -········+·"·does·not·match·any·identities·in·allow·list",·ex.getMessage()); +····var·signer·= +········KeylessSigner.builder() +············.sigstorePublicDefaults() +············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goose.com"))) +············.build(); +····var·ex·= +········Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests)); +····Assertions.assertEquals( +········"Obtained·Oidc·Token·" +············+·OidcIdentity.of("github·machine",·"github.com") +············+·"·does·not·match·any·identities·in·allow·list", +········ex.getMessage()); ··} ··@test ··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB) ··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository ··public·void·sign_passGithubOidcCheck()·throws·Exception·{ -····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities( -········List.of(OidcIdentity.of("[email protected]",·"goog")) -····).build(); +····var·signer·= +········KeylessSigner.builder() +············.sigstorePublicDefaults() +············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goog"))) +············.build(); ····signer.sign(artifactDigests); ··} Run './gradlew :sigstore-java:spotlessApply' to fix these violations. at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:111) at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:53) at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:125) at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58) at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51) at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29) at org.gradle.api.internal.tasks.execution.TaskExecution$3.run(TaskExecution.java:248) at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29) at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26) at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66) at org.gradle.in
build (11)
Gradle build failed: see console output for details
build (17)
Restore cache failed: Dependencies file is not found in /home/runner/work/sigstore-java/sigstore-java. Supported file pattern: go.sum
build (11)
Restore cache failed: Dependencies file is not found in /home/runner/work/sigstore-java/sigstore-java. Supported file pattern: go.sum