publish token to GH Pages?

[jku]

This is very neat (an abomination but a neat one) , I'm thinking of using this in my own testing as well... The only tricky part seems to be finding a token: see https://github.com/sigstore/sigstore-conformance/blob/6c958ac7c74146cb694b9bdb3f8111c3e447d6cf/test/conftest.py#L75 for an example

What if the workflow published to GitHub Pages with a static filename? That way the newest produced token could always be available at https://sigstore-conformance.github.io/extremely-dangerous-public-oidc-beacon/cursed-token.txt. Am I missing anything?

The downloader would still have to deal with the token being too old (unsure how at this hand waving stage) but all of this would go away:

• GitHub auth
• workflow run json download
• workflow run json parsing
• unzipping

[jku]

downloader would still have to deal with the token being too old (unsure how at this hand waving stage)

I think this is easiest:

token=jwt.decode(cursed_token_data[:-1], options={"verify_signature": False})
expiry=datetime.fromtimestamp(token["exp"])

should be trivial to retry if the token is not valid ( or is valid for less than 10 secs or however long we need it for)

[woodruffw]

What if the workflow published to GitHub Pages with a static filename? That way the newest produced token could always be available at https://sigstore-conformance.github.io/extremely-dangerous-public-oidc-beacon/cursed-token.txt. Am I missing anything?

This is a great idea, and should be way less flaky than the current approach!

If you have the time to work on this I'd be overjoyed to review and merge it, otherwise I'll try and find the time to do it in the near future 🙂

[jku]

If you have the time to work on this I'd be overjoyed to review and merge it, otherwise I'll try and find the time to do it in the near future 🙂

It's on my list of "when I need a break from actual project, try this"... so no promises but I might. I'll leave a note here if I do anything

[jku]

So... this is easy to do, I have it running in my fork.

Unfortunately

• the existing artifact can't be used to publish to Pages (pages requires a zip that contains a tar that contains a single directory)
• sigstore-conformance will break if I add another artifact

Plan:

• patch sigstore-conformance to not break if it sees multiple artifacts, hopefully there are no other users of this?
• later merge branch that adds another artifact and GH pages publish to this project
• later switch sigstore-conformance to actually use the GH pages published artifact

[woodruffw]

That plan SGTM -- I think it's safe to assume that sigstore-conformance is the only current user.