Add "Source Repository Visibility At Signing" ext #1279

feelepxyz · 2023-07-17T12:48:09Z

Summary

Adding a new Fulcio cert extension: "Source Repository Visibility At Signing"

Includes the source visibility at the time of signing/creating the certificate for GitHub Actions (backed by the repository_visibility clam in the GHA ID token) and GitLab (backed by the upcoming project_visibility claim).

TL'DR

Attesting to source visibility in the certificate means we can verify wether a provenance attestation came from a public/private source repository without performing a network request to the source repository at the time of signing
If you want to verify source visibility some time after signing you will need to make a unauthenticated network request to the source repository uri
npm will verify this extension value (if it's set) at the time of publishing a package to the registry and rejecting any public packages with provenance that come from a private source repository
- npm will also perform a just-in-time reachability checks to the source repository/commit when viewing a public package on npmjs.com
"Source Repository Visibility At Signing" extension will be optional in Fulcio to allow CI systems to omit it if they don't have access to this info

See full discussion here / closes:
#1263

Release Note

Add certificate extension 1.3.6.1.4.1.57264.1.22 for "Source Repository Visibility At Signing"

Adding a new Fulcio cert extension: "Source Repository Visibility At Signing" Includes the source visibility at the time of signing/creating the certificate for GitHub Actions (backed by the `repository_visibility` clam in the GHA ID token). The plan is for GitLab to add a backing ID token claim to support this extension in the next few weeks. TL'DR - Attesting to source visibility in the certificate means we can verify wether a provenance attestation came from a public/private source repository without performing a network request to the source repository at the time of signing - If you want to verify source visibility some time after signing you will need to make a unauthenticated network request to the source repository uri - npm will start to verify this extension value (if it's set) at the time of publish and rejecting any public packages with provenance that come from a private source repository - npm will also perform a just-in-time reachability checks to the source repository/commit when viewing a package on npmjs.com - "Source Repository Visibility At Signing" extension will be optional in Fulcio to allow CI systems to omit it if they don't have access to this info See full discussion here: sigstore#1263 Signed-off-by: Philip Harrison <philip@mailharrison.com>

codecov · 2023-07-17T13:46:55Z

Codecov Report

Merging #1279 (1072133) into main (cbe0910) will increase coverage by 0.10%.
The diff coverage is 92.68%.

@@            Coverage Diff             @@
##             main    #1279      +/-   ##
==========================================
+ Coverage   58.29%   58.40%   +0.10%     
==========================================
  Files          50       50              
  Lines        3031     3053      +22     
==========================================
+ Hits         1767     1783      +16     
- Misses       1108     1112       +4     
- Partials      156      158       +2

Impacted Files	Coverage Δ
pkg/certificate/extensions.go	`63.33% <53.84%> (-0.48%)`	⬇️
pkg/identity/github/principal.go	`95.38% <100.00%> (+0.22%)`	⬆️
pkg/identity/gitlabcom/principal.go	`64.34% <100.00%> (+0.84%)`	⬆️

... and 1 file with indirect coverage changes

feelepxyz · 2023-07-17T16:02:16Z

pkg/identity/gitlabcom/principal_test.go

+			},
+			WantErr: false,
+		},
+		`Token missing project_visibility is ok`: {


@marshall007 want to check my thinking here, I'm currently only setting this extension for GitLab if the claim exists, and once the gitlab MR lands we can change this to fail, does this make sense?

haydentherapper

Looks great! LGTM once the tests are passing

Signed-off-by: Philip Harrison <philip@mailharrison.com>

marshall007 · 2023-07-19T15:59:07Z

docs/oid-info.md

+### 1.3.6.1.4.1.57264.1.22 | Source Repository Visibility At Signing
+
+Source repository visibility at the time of signing the certificate. MAY be empty if there is no Source Repository Visibility information available. For example: `private` or `public`.
+


@feelepxyz can we clarify what we mean by "repository" in this context? GitLab uses the term "project" to refer to the namespace that encapsulates a git repository (and other features). We support visibility/permission toggles on a per-feature basis, so it is possible for a project to be public while the repository feature itself is private/disabled.

What if Run Invocation URI is not publicly accessible, for example? Can Source Repository Visibility At Signing be public despite Build Config URI pointing to a private project?

Should the intent be for this extension to broadly describe the visibility of all relevant features?

@haydentherapper sorry for the late feedback. I was typing out as you merged.

No worries, I'll wait for @feelepxyz in case there's any code changes that need to be made, but I think this should just be docs.

it is possible for a project to be public while the repository feature itself is private/disabled.

@marshall007 ah right, in this case would it mean that the Source Repository URI would not be reachable without authentication?

Should the intent be for this extension to broadly describe the visibility of all relevant features?

I would imagine the extension would broadly describe the publicly accessible source URIs, wether that is the run invocation uri or source repository uri.

Is project_visibility a good proxy for this?

I would imagine the extension would broadly describe the publicly accessible source URIs, wether that is the run invocation uri or source repository uri.

@feelepxyz yes, I agree and I think project_visibility is sufficient in signalling the intent.

haydentherapper · 2023-07-19T22:05:02Z

@feelepxyz @marshall007 This is now in staging (or will be in a few minutes), please take a look.

feelepxyz · 2023-07-20T09:31:48Z

@haydentherapper @marshall007 tested this on github and gitlab against staging fulcio ✅

As expected we get the new cert extension for github (also tested a private repo and works as expected):

For GitLab it's unset (as expected because the project_visibility claim isn't live yet):

haydentherapper · 2023-07-20T16:18:49Z

Will be in prod in about 5 minutes.

feelepxyz mentioned this pull request Jul 17, 2023

Proposal: Add a new certificate extension for "source_visibility" #1263

Closed

feelepxyz force-pushed the feelepxyz/source-visibility branch from b93b15a to c99f574 Compare July 17, 2023 13:26

feelepxyz force-pushed the feelepxyz/source-visibility branch from c99f574 to 6237781 Compare July 17, 2023 13:42

feelepxyz commented Jul 17, 2023

View reviewed changes

haydentherapper reviewed Jul 17, 2023

View reviewed changes

Add GitLab project_visibility

1072133

Signed-off-by: Philip Harrison <philip@mailharrison.com>

feelepxyz force-pushed the feelepxyz/source-visibility branch from 83bbd47 to 1072133 Compare July 18, 2023 08:36

feelepxyz requested a review from haydentherapper July 18, 2023 08:46

haydentherapper approved these changes Jul 18, 2023

View reviewed changes

haydentherapper merged commit a7a044b into sigstore:main Jul 19, 2023
13 checks passed

marshall007 reviewed Jul 19, 2023

View reviewed changes

feelepxyz deleted the feelepxyz/source-visibility branch July 20, 2023 08:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add "Source Repository Visibility At Signing" ext #1279

Add "Source Repository Visibility At Signing" ext #1279

feelepxyz commented Jul 17, 2023 •

edited

codecov bot commented Jul 17, 2023 •

edited

feelepxyz Jul 17, 2023

haydentherapper left a comment

marshall007 Jul 19, 2023

marshall007 Jul 19, 2023

haydentherapper Jul 19, 2023

feelepxyz Jul 19, 2023

marshall007 Jul 19, 2023

haydentherapper commented Jul 19, 2023

feelepxyz commented Jul 20, 2023

haydentherapper commented Jul 20, 2023

		### 1.3.6.1.4.1.57264.1.22 \| Source Repository Visibility At Signing

		Source repository visibility at the time of signing the certificate. MAY be empty if there is no Source Repository Visibility information available. For example: `private` or `public`.

Add "Source Repository Visibility At Signing" ext #1279

Add "Source Repository Visibility At Signing" ext #1279

Conversation

feelepxyz commented Jul 17, 2023 • edited

Summary

Release Note

codecov bot commented Jul 17, 2023 • edited

Codecov Report

feelepxyz Jul 17, 2023

Choose a reason for hiding this comment

haydentherapper left a comment

Choose a reason for hiding this comment

marshall007 Jul 19, 2023

Choose a reason for hiding this comment

marshall007 Jul 19, 2023

Choose a reason for hiding this comment

haydentherapper Jul 19, 2023

Choose a reason for hiding this comment

feelepxyz Jul 19, 2023

Choose a reason for hiding this comment

marshall007 Jul 19, 2023

Choose a reason for hiding this comment

haydentherapper commented Jul 19, 2023

feelepxyz commented Jul 20, 2023

haydentherapper commented Jul 20, 2023

feelepxyz commented Jul 17, 2023 •

edited

codecov bot commented Jul 17, 2023 •

edited