Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Codefresh OIDC provider #1593

Merged
merged 7 commits into from Apr 5, 2024
Merged

Add Codefresh OIDC provider #1593

merged 7 commits into from Apr 5, 2024

Conversation

ilia-medvedev-codefresh
Copy link
Contributor

Add support for Codefresh OIDC provider to allow keyless signing of artifacts in Codefresh pipelines

Closes #1592

@codecov Codecov
Copy link

codecov bot commented Mar 6, 2024 •
edited

Codecov Report

Attention: Patch coverage is 88.57143% with 8 lines in your changes are missing coverage. Please review.

Project coverage is 60.81%. Comparing base (cf238ac) to head (884900f).
Report is 64 commits behind head on main.

Files Patch % Lines
pkg/identity/codefresh/principal.go 89.83% 3 Missing and 3 partials ⚠️
pkg/identity/codefresh/issuer.go 71.42% 1 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #1593      +/-   ##
==========================================
+ Coverage   57.93%   60.81%   +2.88%     
==========================================
  Files          50       52       +2     
  Lines        3119     2519     -600     
==========================================
- Hits         1807     1532     -275     
+ Misses       1154      823     -331     
- Partials      158      164       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@haydentherapper
Copy link
Contributor

Hey @ilia-medvedev-codefresh, thanks so much for contributing the provider! Overall this looks good, I'll add a few folks who worked on the previous OIDC/CI integrations to review the claim mappings.

wlynch
wlynch reviewed Mar 11, 2024
View reviewed changes
docs/oid-info.md
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
| runner_environment | runner_environment | ?? | ?? | runner_environment | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
| server_url + repository | server_url + project_path | ?? | ?? | scm_repo_url | Source Repository URI | Should include a fully qualified repository URL. |
| sha | sha | ?? | build_commit | N/A | Source Repository Digest | An immutable reference to a specific version of the source code. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Out of scope for this PR, but an ask for Codefresh: it would be great if this could start to be captured in OIDC claims so that users can know what version of the pipeline config was used for the build.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your detailed review @wlynch! We will for sure discuss it internally and try to come up with a relevant claim.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this line actually refers to the SHA of the source code the pipeline pulls in (e.g. whatever https://codefresh.io/docs/docs/pipelines/steps/git-clone/ resolves, if I understand the documentation correctly). The isn't required generally, but is incredibly valuable in providing build provenance that not only points to the source repository but the specific SHA that the build used.

workflow_sha (or job_workflow_sha if the initial job calls another job to interact with Fulcio) would be the version of the pipeline config used by the build, and I agree that it is also very useful.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@steiza We will for sure take it into account. I'll work with the relevant dev team to have a relevant claim added in the near future, and will add it as soon as it is available.

docs/oid-info.md Outdated
| repository_id | project_id | ?? | ?? | N/A | Source Repository Identifier | Stable identifier for the owner of the source repository. |
| server_url + repository_owner | server_url + namespace_path | ?? | ?? | N/A | Source Repository Owner URI | Fully qualified URL for the owner of the source repository. |
| repository_owner_id | namespace_id | ?? | ?? | N/A | Source Repository Owner Identifier | Stable identifier for the owner of the source repository. |
| server_url + workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /build/ + workflow_id | Build Config URI | A reference to the initiating build instructions. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if this should be pipeline_id? 🤔

My current understanding is the pipeline_id stores the configuration, and workflow_id is a run of the pipeline.

If not, would another field be more appropriate?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed it to the API endpoint in Codefresh that returns the pipeline config, as the UI endpoint is a bit awkward as it requires a lot of query parameters. But the API endpoint should be completely valid and it uses the pipeine_id claim.

steiza
steiza reviewed Mar 15, 2024
View reviewed changes
Copy link
Member

@steiza steiza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just want to double-check if the URLs are namespaced at all; otherwise it looks to me like all the MUSTs in https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md are covered!

docs/oid-info.md
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
| runner_environment | runner_environment | ?? | ?? | runner_environment | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
| server_url + repository | server_url + project_path | ?? | ?? | scm_repo_url | Source Repository URI | Should include a fully qualified repository URL. |
| sha | sha | ?? | build_commit | N/A | Source Repository Digest | An immutable reference to a specific version of the source code. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this line actually refers to the SHA of the source code the pipeline pulls in (e.g. whatever https://codefresh.io/docs/docs/pipelines/steps/git-clone/ resolves, if I understand the documentation correctly). The isn't required generally, but is incredibly valuable in providing build provenance that not only points to the source repository but the specific SHA that the build used.

workflow_sha (or job_workflow_sha if the initial job calls another job to interact with Fulcio) would be the version of the pipeline config used by the build, and I agree that it is also very useful.

docs/oid-info.md
| iat | iat | iat | iat | iat | N/A | Only used to validate the JWT. |
| server_url + job_workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /build/ + workflow_id | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
| runner_environment | runner_environment | ?? | ?? | runner_environment | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent! I'm glad to see you support this, as the security properties of platform-hosted of customer self-hosted instances can be quite different.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to check, this is supported currently? I didn't see it mentioned in the docs.

docs/oid-info.md
| repository_owner_id | namespace_id | ?? | ?? | N/A | Source Repository Owner Identifier | Stable identifier for the owner of the source repository. |
| server_url + workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /api/pipelines/ + pipeline_id | Build Config URI | A reference to the initiating build instructions. |
| workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Config Digest | An immutable reference to the specific version of the top-level build instructions. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
| event_name | pipeline_source | ?? | ?? | N/A | Build Trigger | The event or action that triggered the build. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not required, but could this potentially be populated by https://codefresh.io/docs/docs/pipelines/triggers/?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not supported at the moment but I will take it internally, maybe we can support it In the future. Will make sure to add this extension when we do.

docs/oid-info.md
| exp | exp | exp | exp | exp | N/A | Only used to validate the JWT. |
| nbf | nbf | nbf | nbf | nbf | N/A | Only used to validate the JWT. Optional, as per the OIDC spec |
| iat | iat | iat | iat | iat | N/A | Only used to validate the JWT. |
| server_url + job_workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /build/ + workflow_id | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just want to check that the URLs starting with platform_url in this file in this pull request are right - they aren't namespaces by account_name or pipeline_name or anything like that?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, the urls are correct. Accounts in Codefresh are populated upon login (either through the UI or API tokens which are scoped to an account)

steiza
steiza approved these changes Mar 18, 2024
View reviewed changes
Copy link
Member

@steiza steiza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a Fulcio code owner, but the claim mapping make sense to me.

haydentherapper
haydentherapper reviewed Mar 18, 2024
View reviewed changes
Copy link
Contributor

@haydentherapper haydentherapper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks great! Just a few questions for subject value.

docs/oid-info.md
| iat | iat | iat | iat | iat | N/A | Only used to validate the JWT. |
| server_url + job_workflow_ref | ci_config_ref_uri ([WIP][gitlab-wip-cliams]) | ?? | ?? | platform_url + /build/ + workflow_id | Build Signer URI | Reference to specific build instructions that are responsible for signing. Can be the same as Build Config URI. For example a reusable workflow in GitHub Actions or a Circle CI Orbs. |
| job_workflow_sha | ci_config_sha ([WIP][gitlab-wip-cliams]) | ?? | ?? | N/A | Build Signer Digest | An immutable reference to the specific version of the build instructions that is responsible for signing. Should include the digest type followed by the digest, e.g. `sha1:abc123`. |
| runner_environment | runner_environment | ?? | ?? | runner_environment | Runner Environment | For platforms to specify whether the build took place in platform-hosted cloud infrastructure or customer-hosted infrastructure. For example: `platform-hosted` and `self-hosted`. |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to check, this is supported currently? I didn't see it mentioned in the docs.

pkg/identity/codefresh/principal.go
cert.ExtraExtensions, err = certificate.Extensions{
Issuer: w.issuer,
// URL of the build in Codefresh
BuildSignerURI: baseURL.JoinPath("build", w.workflowID).String(),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To confirm, a workflow comes from a pipeline, correct?

Typically build signer would be the same as the SAN, as it's meant to represent an stable identity rather than a more frequently changing identifier like a run ID. I think builder signer should be composed of the pipeline ID rather than workflow ID.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A workflow is an instance of a pipeline, yes. But it Codefresh, pipeline definitions are only accessible to authenticated users - if you have a public build only the workflow run URL is accessible to unauthenticated users. So in case of an open source project that uses Codefresh, if one wanted to see the pipeline that was used to build their artifact they can only access the workflow if they are not authenticated to Codefresh. Plus the workflow contains the pipeline definition that was used at the time of building the artifact which represents the signer well.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As for the runner_environment - it has been added recently to support Fulcio requirements. It is currently behind a feature flag - we will open it for everyone shortly.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the explanation, that makes sense. Would you be able to add a comment summarizing that, since this is the first example of a SAN being different than the build signer URI?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@haydentherapper sure thing. Comment was added.

pkg/identity/codefresh/principal.go Show resolved Hide resolved
@ilia-medvedev-codefresh
Copy link
Contributor Author

@haydentherapper @wlynch @feelepxyz Anything I can do or help clarify further?

haydentherapper
haydentherapper reviewed Apr 4, 2024
View reviewed changes
Copy link
Contributor

@haydentherapper haydentherapper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ilia-medvedev-codefresh sorry for the delay, this looks good overall! just two small comments

pkg/identity/codefresh/principal.go Show resolved Hide resolved
pkg/identity/codefresh/principal.go
cert.ExtraExtensions, err = certificate.Extensions{
Issuer: w.issuer,
// URL of the build in Codefresh
BuildSignerURI: baseURL.JoinPath("build", w.workflowID).String(),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the explanation, that makes sense. Would you be able to add a comment summarizing that, since this is the first example of a SAN being different than the build signer URI?

@ilia-medvedev-codefresh
Feat: Add Codefresh OIDC provider (#2)
5c32c2c 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@ilia-medvedev-codefresh
linting and licensing fixes
bc05b57 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@ilia-medvedev-codefresh
fix linting warnings
b79b152 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@ilia-medvedev-codefresh
fix last linting warnings
1ee2e9a 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@ilia-medvedev-codefresh
Change Run incovation URI extension to pipeline_id
9edc6ae 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@ilia-medvedev-codefresh
add comment explaining the usage of worklow url as buildsigner
b69aa37 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@haydentherapper
Copy link
Contributor

@ilia-medvedev-codefresh just needs a lint fix, then I'll merge, cut a release, and work on getting this out. I'll ping the thread once we have this in our staging environment so you can confirm it's working.

@ilia-medvedev-codefresh
fix linting
884900f 
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
@haydentherapper haydentherapper merged commit 60bf68a into sigstore:main Apr 5, 2024
13 checks passed
lance added a commit to securesign/fulcio that referenced this pull request May 14, 2024
@lance @dependabot
@bobcallaway @peer-jslater @ilia-medvedev-codefresh @haydentherapper
Merge upstream 1.4.5 (#127)
f30c922 
* Bump the go_modules group group with 2 updates

Bumps the go_modules group group with 2 updates: [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) and gopkg.in/go-jose/go-jose.v2.


Updates `github.com/go-jose/go-jose/v3` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/v3.0.3/CHANGELOG.md)
- [Commits](go-jose/go-jose@v3.0.2...v3.0.3)

Updates `gopkg.in/go-jose/go-jose.v2` from 2.6.1 to 2.6.3

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: gopkg.in/go-jose/go-jose.v2
  dependency-type: indirect
  dependency-group: go_modules-security-group
...

Signed-off-by: dependabot[bot] <support@github.com>

* move to golang 1.21.8 and bump other deps

Signed-off-by: Bob Callaway <bcallaway@google.com>

* use -dev image

Signed-off-by: Bob Callaway <bcallaway@google.com>

* bump validate-release

Signed-off-by: Bob Callaway <bcallaway@google.com>

* Add space

Signed-off-by: Bob Callaway <bcallaway@google.com>

* Bump github.com/prometheus/common from 0.49.0 to 0.50.0

Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.49.0 to 0.50.0.
- [Release notes](https://github.com/prometheus/common/releases)
- [Commits](prometheus/common@v0.49.0...v0.50.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/common
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/sigstore/sigstore/pkg/signature/kms/gcp

Bumps [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) from 1.8.1 to 1.8.2.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.1...v1.8.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/googleapis/api-linter in /hack/tools

Bumps [github.com/googleapis/api-linter](https://github.com/googleapis/api-linter) from 1.63.6 to 1.64.0.
- [Release notes](https://github.com/googleapis/api-linter/releases)
- [Changelog](https://github.com/googleapis/api-linter/blob/main/CHANGELOG.md)
- [Commits](googleapis/api-linter@v1.63.6...v1.64.0)

---
updated-dependencies:
- dependency-name: github.com/googleapis/api-linter
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump google.golang.org/grpc from 1.62.0 to 1.62.1

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.62.0 to 1.62.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.62.0...v1.62.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /hack/tools

Bumps google.golang.org/protobuf from 1.32.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/golang/protobuf from 1.5.3 to 1.5.4 (sigstore#1602)

Bumps [github.com/golang/protobuf](https://github.com/golang/protobuf) from 1.5.3 to 1.5.4.
- [Release notes](https://github.com/golang/protobuf/releases)
- [Commits](golang/protobuf@v1.5.3...v1.5.4)

---
updated-dependencies:
- dependency-name: github.com/golang/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Force sh scripts to checkout with lf line endings (sigstore#1606)

On Windows the files copied to the docker container's work environment
must have lf line endings to be properly executed.

Resolves sigstore#1605

Signed-off-by: Jordan Slater <Jordan.Slater@peergroup.com>

* Bump protocolbuffers/protobuf from 25.3 to 26.0

Bumps [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) from 25.3 to 26.0.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](protocolbuffers/protobuf@v25.3...v26.0)

---
updated-dependencies:
- dependency-name: protocolbuffers/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump cloud.google.com/go/security from 1.15.5 to 1.15.6

Bumps [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) from 1.15.5 to 1.15.6.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@kms/v1.15.5...kms/v1.15.6)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/security
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/google/certificate-transparency-go from 1.1.7 to 1.1.8

Bumps [github.com/google/certificate-transparency-go](https://github.com/google/certificate-transparency-go) from 1.1.7 to 1.1.8.
- [Release notes](https://github.com/google/certificate-transparency-go/releases)
- [Changelog](https://github.com/google/certificate-transparency-go/blob/master/CHANGELOG.md)
- [Commits](google/certificate-transparency-go@v1.1.7...v1.1.8)

---
updated-dependencies:
- dependency-name: github.com/google/certificate-transparency-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump google.golang.org/api from 0.167.0 to 0.170.0

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.167.0 to 0.170.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.167.0...v0.170.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump actions/checkout from 4.1.1 to 4.1.2

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@b4ffde6...9bb5618)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/prometheus/common from 0.50.0 to 0.51.1

Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.50.0 to 0.51.1.
- [Release notes](https://github.com/prometheus/common/releases)
- [Commits](prometheus/common@v0.50.0...v0.51.1)

---
updated-dependencies:
- dependency-name: github.com/prometheus/common
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump go.step.sm/crypto from 0.43.1 to 0.44.1

Bumps [go.step.sm/crypto](https://github.com/smallstep/crypto) from 0.43.1 to 0.44.1.
- [Release notes](https://github.com/smallstep/crypto/releases)
- [Commits](smallstep/crypto@v0.43.1...v0.44.1)

---
updated-dependencies:
- dependency-name: go.step.sm/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump google.golang.org/api from 0.170.0 to 0.171.0

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.170.0 to 0.171.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.170.0...v0.171.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0

Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](coreos/go-oidc@v3.9.0...v3.10.0)

---
updated-dependencies:
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump go.step.sm/crypto from 0.44.1 to 0.44.2

Bumps [go.step.sm/crypto](https://github.com/smallstep/crypto) from 0.44.1 to 0.44.2.
- [Release notes](https://github.com/smallstep/crypto/releases)
- [Commits](smallstep/crypto@v0.44.1...v0.44.2)

---
updated-dependencies:
- dependency-name: go.step.sm/crypto
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/sigstore/sigstore/pkg/signature/kms/hashivault

Bumps [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) from 1.8.2 to 1.8.3.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.2...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump codecov/codecov-action from 4.1.0 to 4.1.1

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4.1.0 to 4.1.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@54bcd87...c16abc2)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump protocolbuffers/protobuf from 26.0 to 26.1

Bumps [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) from 26.0 to 26.1.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](protocolbuffers/protobuf@v26.0...v26.1)

---
updated-dependencies:
- dependency-name: protocolbuffers/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3

Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.2 to 1.8.3.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.2...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump google.golang.org/api from 0.171.0 to 0.172.0

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.171.0 to 0.172.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.171.0...v0.172.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Add Codefresh OIDC provider (sigstore#1593)

* Feat: Add Codefresh OIDC provider (#2)

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* linting and licensing fixes

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* fix linting warnings

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* fix last linting warnings

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* Change Run incovation URI extension to pipeline_id

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* add comment explaining the usage of worklow url as buildsigner

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* fix linting

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

---------

Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>

* Add changelog for v1.4.5 (sigstore#1624)

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Bob Callaway <bcallaway@google.com>
Signed-off-by: Jordan Slater <Jordan.Slater@peergroup.com>
Signed-off-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Bob Callaway <bcallaway@google.com>
Co-authored-by: peer-jslater <160965343+peer-jslater@users.noreply.github.com>
Co-authored-by: ilia-medvedev-codefresh <ilia.medvedev@codefresh.io>
Co-authored-by: Hayden B <hblauzvern@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wlynch wlynch wlynch left review comments

@steiza steiza steiza approved these changes

@haydentherapper haydentherapper haydentherapper approved these changes

@feelepxyz feelepxyz Awaiting requested review from feelepxyz

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Codefresh OIDC provider support
4 participants
@ilia-medvedev-codefresh @haydentherapper @steiza @wlynch