-
Notifications
You must be signed in to change notification settings - Fork 551
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New flag --oidc-providers-disable to disable OIDC providers #1832
Conversation
cmd/cosign/cli/options/oidc.go
Outdated
@@ -66,4 +67,7 @@ func (o *OIDCOptions) AddFlags(cmd *cobra.Command) { | |||
|
|||
cmd.Flags().StringVar(&o.RedirectURL, "oidc-redirect-url", "", | |||
"[EXPERIMENTAL] OIDC redirect URL (Optional). The default oidc-redirect-url is 'http://localhost:0/auth/callback'.") | |||
|
|||
cmd.Flags().BoolVar(&o.DisableAmbientProviders, "oidc-providers-disable", false, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe the cli documentation is missing.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks hector! I just regenerated them.
4cdaece
to
99c1db0
Compare
Codecov Report
@@ Coverage Diff @@
## main #1832 +/- ##
==========================================
- Coverage 33.01% 32.99% -0.02%
==========================================
Files 147 147
Lines 9350 9355 +5
==========================================
Hits 3087 3087
- Misses 5909 5914 +5
Partials 354 354
Continue to review full report at Codecov.
|
99c1db0
to
1323866
Compare
cmd/cosign/cli/options/oidc.go
Outdated
@@ -66,4 +67,7 @@ func (o *OIDCOptions) AddFlags(cmd *cobra.Command) { | |||
|
|||
cmd.Flags().StringVar(&o.RedirectURL, "oidc-redirect-url", "", | |||
"[EXPERIMENTAL] OIDC redirect URL (Optional). The default oidc-redirect-url is 'http://localhost:0/auth/callback'.") | |||
|
|||
cmd.Flags().BoolVar(&o.DisableAmbientProviders, "oidc-providers-disable", false, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is yakshaving, but IMO the --oidc-providers-disable
flag could be a little more descriptive.
In sigstore-python we refer to these providers as "ambient" providers to distinguish them from explicit OAuth flows and other sources of identities. I think a flag name like --disable-ambient-oidc
or similar (--oidc-disable-ambient-providers
, etc.) would better capture the semantics here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds good to me, thanks for the suggestion @woodruffw , changed.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a ton!
This commit adds an option to tell the fulcio client to avoid trying to get an auth token from the internal OIDC providers. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
1323866
to
8ade296
Compare
…oviders This commit adds a command line flag `--oidc-providers-disable` to `cosign sign` and `cosign sign-blob` to disable the internal OIDC providers. This does not break compatibility with the current cli and skips the providers logic to jump straight to the OIDC flow. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
2346074
to
a440205
Compare
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
a440205
to
4f5ed66
Compare
…#1832) * Add KeyOpt to disable internal providers This commit adds an option to tell the fulcio client to avoid trying to get an auth token from the internal OIDC providers. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add --oidc-disable-ambient-providers flag to disable internal OIDC providers This commit adds a command line flag `--oidc-providers-disable` to `cosign sign` and `cosign sign-blob` to disable the internal OIDC providers. This does not break compatibility with the current cli and skips the providers logic to jump straight to the OIDC flow. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Update internal docs for new OIDC flag Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
Summary
This PR adds a new command line flag
--oidc-providers-disable
tocosign sign
andcosign sign-blob
to disable the internal OIDC providers. This does not break compatibility with the current cli and skips the providers logic to jump straight to the OIDC flow./cc @di @eddiezane
Signed-off-by: Adolfo García Veytia (Puerco) puerco@chainguard.dev
Ticket Link
Fixes #1819
Release Note