Add environment variable token provider. (#2864)

* Add environment variable token provider.

This adds a new token provider that looks for tokens located at SIGSTORE_ID_TOKEN.

This is an alternative to COSIGN_IDENTITY_TOKEN, which is implemented as
a Viper binding.

ID_TOKEN was used instead of IDENTITY_TOKEN, since this seems to be
consistent with other providers (e.g. ACTIONS_ID_TOKEN_REQUEST_TOKEN).
If this ends up being confusing we can add support for both variants
later if needed.

Signed-off-by: Billy Lynch <billy@chainguard.dev>

* Add envvar provider to providers/all.

Signed-off-by: Billy Lynch <billy@chainguard.dev>

---------

Signed-off-by: Billy Lynch <billy@chainguard.dev>

pkg/cosign/env/env.go

@@ -55,6 +55,7 @@ const (
 	VariableSigstoreCTLogPublicKeyFile Variable = "SIGSTORE_CT_LOG_PUBLIC_KEY_FILE"
 	VariableSigstoreRootFile           Variable = "SIGSTORE_ROOT_FILE"
 	VariableSigstoreRekorPublicKey     Variable = "SIGSTORE_REKOR_PUBLIC_KEY"
+	VariableSigstoreIDToken            Variable = "SIGSTORE_ID_TOKEN" //nolint:gosec
 
 	// Other external environment variables
 	VariableGitHubHost                Variable = "GITHUB_HOST"
@@ -197,6 +198,12 @@ var (
 			Sensitive:   false,
 			External:    true,
 		},
+		VariableSigstoreIDToken: {
+			Description: "is a OIDC token used to authenticate to Fulcio",
+			Expects:     "string with a OIDC token",
+			Sensitive:   true,
+			External:    true,
+		},
 	}
 )
 

pkg/providers/all/all.go

@@ -20,6 +20,7 @@ import (
 
 	// Link in all of the providers.
 	_ "github.com/sigstore/cosign/v2/pkg/providers/buildkite"
+	_ "github.com/sigstore/cosign/v2/pkg/providers/envvar"
 	_ "github.com/sigstore/cosign/v2/pkg/providers/filesystem"
 	_ "github.com/sigstore/cosign/v2/pkg/providers/github"
 	_ "github.com/sigstore/cosign/v2/pkg/providers/google"

pkg/providers/envvar/env.go

@@ -0,0 +1,42 @@
+//
+// Copyright 2023 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package envvar
+
+import (
+	"context"
+
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/providers"
+)
+
+func init() {
+	providers.Register("envvar", &envvar{})
+}
+
+type envvar struct{}
+
+var _ providers.Interface = (*envvar)(nil)
+
+// Enabled implements providers.Interface
+func (p *envvar) Enabled(context.Context) bool {
+	_, ok := env.LookupEnv(env.VariableSigstoreIDToken)
+	return ok
+}
+
+// Provide implements providers.Interface
+func (p *envvar) Provide(context.Context, string) (string, error) {
+	return env.Getenv(env.VariableSigstoreIDToken), nil
+}

pkg/providers/envvar/env_test.go

@@ -0,0 +1,67 @@
+//
+// Copyright 2023 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package envvar
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+)
+
+func TestEnvVar(t *testing.T) {
+	ctx := context.Background()
+	token := "tacocat"
+
+	for _, tc := range []struct {
+		envmap map[string]string
+		want   bool
+	}{
+		{
+			envmap: map[string]string{
+				env.VariableSigstoreIDToken.String(): token,
+			},
+			want: true,
+		},
+		{
+			want: false,
+		},
+	} {
+		t.Run(fmt.Sprint(tc.want), func(t *testing.T) {
+			for k, v := range tc.envmap {
+				t.Setenv(k, v)
+			}
+			e := &envvar{}
+
+			if enabled := e.Enabled(ctx); enabled != tc.want {
+				t.Errorf("Enabled: want %t, got %t", tc.want, enabled)
+			}
+
+			got, err := e.Provide(ctx, "")
+			if err != nil {
+				t.Fatalf("Provide: %v", err)
+			}
+			want := ""
+			if tc.want {
+				want = token
+			}
+			if got != want {
+				t.Fatalf("Provide: want %s, got %s", want, got)
+			}
+		})
+	}
+}