Allow signers to specify allow list of oidc ids #1910
Annotations
4 errors and 2 warnings
build (11):
task ':sigstore-java:spotlessJavaCheck'#L1
Execution failed for task ':sigstore-java:spotlessJavaCheck':
The following files had format violations:
src/test/java/dev/sigstore/KeylessTest.java
@@ -18,7 +18,6 @@
import·com.google.common.hash.Hashing;
import·dev.sigstore.bundle.BundleFactory;
import·dev.sigstore.encryption.certificates.Certificates;
-import·dev.sigstore.oidc.client.OidcToken;
import·dev.sigstore.rekor.client.RekorTypeException;
import·dev.sigstore.rekor.client.RekorTypes;
import·dev.sigstore.testkit.annotations.EnabledIfOidcExists;
@@ -81,22 +80,29 @@
··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB)
··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository
··public·void·sign_failGithubOidcCheck()·throws·Exception·{
-····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities(
-········List.of(OidcIdentity.of("[email protected]",·"goose.com"))
-····).build();
-····var·ex·=·Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests));
-····Assertions.assertEquals("Obtained·Oidc·Token·"
-········+·OidcIdentity.of("github·machine",·"github.com")
-········+·"·does·not·match·any·identities·in·allow·list",·ex.getMessage());
+····var·signer·=
+········KeylessSigner.builder()
+············.sigstorePublicDefaults()
+············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goose.com")))
+············.build();
+····var·ex·=
+········Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests));
+····Assertions.assertEquals(
+········"Obtained·Oidc·Token·"
+············+·OidcIdentity.of("github·machine",·"github.com")
+············+·"·does·not·match·any·identities·in·allow·list",
+········ex.getMessage());
··}
··@test
··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB)
··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository
··public·void·sign_passGithubOidcCheck()·throws·Exception·{
-····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities(
-········List.of(OidcIdentity.of("[email protected]",·"goog"))
-····).build();
+····var·signer·=
+········KeylessSigner.builder()
+············.sigstorePublicDefaults()
+············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goog")))
+············.build();
····signer.sign(artifactDigests);
··}
Run './gradlew :sigstore-java:spotlessApply' to fix these violations.
at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:111)
at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:53)
at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:125)
at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58)
at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51)
at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29)
at org.gradle.api.internal.tasks.execution.TaskExecution$3.run(TaskExecution.java:248)
at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29)
at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26)
at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
at org.gradle.in
|
build (11)
Gradle build failed: see console output for details
|
build (17):
task ':sigstore-java:spotlessJavaCheck'#L1
Execution failed for task ':sigstore-java:spotlessJavaCheck':
The following files had format violations:
src/test/java/dev/sigstore/KeylessTest.java
@@ -18,7 +18,6 @@
import·com.google.common.hash.Hashing;
import·dev.sigstore.bundle.BundleFactory;
import·dev.sigstore.encryption.certificates.Certificates;
-import·dev.sigstore.oidc.client.OidcToken;
import·dev.sigstore.rekor.client.RekorTypeException;
import·dev.sigstore.rekor.client.RekorTypes;
import·dev.sigstore.testkit.annotations.EnabledIfOidcExists;
@@ -81,22 +80,29 @@
··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB)
··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository
··public·void·sign_failGithubOidcCheck()·throws·Exception·{
-····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities(
-········List.of(OidcIdentity.of("[email protected]",·"goose.com"))
-····).build();
-····var·ex·=·Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests));
-····Assertions.assertEquals("Obtained·Oidc·Token·"
-········+·OidcIdentity.of("github·machine",·"github.com")
-········+·"·does·not·match·any·identities·in·allow·list",·ex.getMessage());
+····var·signer·=
+········KeylessSigner.builder()
+············.sigstorePublicDefaults()
+············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goose.com")))
+············.build();
+····var·ex·=
+········Assertions.assertThrows(KeylessSignerException.class,·()·->·signer.sign(artifactDigests));
+····Assertions.assertEquals(
+········"Obtained·Oidc·Token·"
+············+·OidcIdentity.of("github·machine",·"github.com")
+············+·"·does·not·match·any·identities·in·allow·list",
+········ex.getMessage());
··}
··@test
··@EnabledIfOidcExists(provider·=·OidcProviderType.GITHUB)
··//·this·test·will·only·pass·on·the·github.com/sigstore/sigstore-java·repository
··public·void·sign_passGithubOidcCheck()·throws·Exception·{
-····var·signer·=·KeylessSigner.builder().sigstorePublicDefaults().allowedOidcIdentities(
-········List.of(OidcIdentity.of("[email protected]",·"goog"))
-····).build();
+····var·signer·=
+········KeylessSigner.builder()
+············.sigstorePublicDefaults()
+············.allowedOidcIdentities(List.of(OidcIdentity.of("[email protected]",·"goog")))
+············.build();
····signer.sign(artifactDigests);
··}
Run './gradlew :sigstore-java:spotlessApply' to fix these violations.
at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:111)
at com.diffplug.gradle.spotless.SpotlessCheck.performAction(SpotlessCheck.java:53)
at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:125)
at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58)
at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51)
at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29)
at org.gradle.api.internal.tasks.execution.TaskExecution$3.run(TaskExecution.java:248)
at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29)
at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26)
at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
at org.gradle.in
|
build (17)
Gradle build failed: see console output for details
|
build (11)
Restore cache failed: Dependencies file is not found in /home/runner/work/sigstore-java/sigstore-java. Supported file pattern: go.sum
|
build (17)
Restore cache failed: Dependencies file is not found in /home/runner/work/sigstore-java/sigstore-java. Supported file pattern: go.sum
|