Script and process to generate OIDC config from federation directory. (…

…#139)

Signed-off-by: Dan Lorenc <dlorenc@google.com>

.github/workflows/verify.yml

@@ -47,3 +47,15 @@ jobs:
         with:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
           version: v1.41
+
+  oidc-config:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.4
+      - uses: actions/setup-go@v2
+      - name: check-config
+        run: |
+          set -e
+          go run federation/main.go
+          git diff --exit-code

config/fulcio-config.yaml

@@ -12,25 +12,29 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: fulcio-config
-  namespace: fulcio-dev
 data:
-  config.json: |
-    {
-      "OIDCIssuers": {
-        "https://accounts.google.com": {
-          "IssuerURL": "https://accounts.google.com",
-          "ClientID": "sigstore",
-          "Type": "email"
-        },
-        "https://oauth2.sigstore.dev/auth": {
-          "IssuerURL": "https://oauth2.sigstore.dev/auth",
-          "ClientID": "sigstore",
-          "Type": "email"
+    config.json: |-
+        {
+          "OIDCIssuers": {
+            "https://accounts.google.com": {
+              "IssuerURL": "https://accounts.google.com",
+              "ClientID": "sigstore",
+              "Type": "email"
+            },
+            "https://oauth2.sigstore.dev/auth": {
+              "IssuerURL": "https://oauth2.sigstore.dev/auth",
+              "ClientID": "sigstore",
+              "Type": "email"
+            },
+            "https://oidc.dlorenc.dev": {
+              "IssuerURL": "https://oidc.dlorenc.dev",
+              "ClientID": "sigstore",
+              "Type": "spiffe"
+            }
+          }
         }
-      }
-    }
+kind: ConfigMap
+metadata:
+    name: fulcio-config
+    namespace: fulcio-dev

federation/README.md

@@ -0,0 +1,23 @@
+# OIDC Federation Configs
+
+This directory contains configurations for individual OIDC endpoints that the public good instance of Fulcio should accept identity tokens from.
+
+## Usage
+
+To update the k8s `ConfigMap`, run `go run federation/main.go` from the root directory of this repository.
+
+## Adding New Entries
+
+We'll happily accept new entries here in the form of a pull request!
+Open one up with your endpoint, filling in a directory and a `config.yaml` with the following structure:
+
+```yaml
+url: <discovery url>
+contact: <your contact email>
+description: <a description of the use case>
+type: <spiffe|email>
+```
+
+You'll then have to regenerate the ConfigMap with `go run federation/main.go`, and then send your PR.
+
+We'll discuss your use-case with you over the pull request, and merge!

federation/accounts.google.com/config.yaml

@@ -0,0 +1,18 @@
+# Copyright 2021 The Sigstore Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+url: https://accounts.google.com
+contact: lorenc.d@gmail.com
+description: "standard google OIDC auth"
+type: "email"

federation/external/oidc.dlorenc.dev/config.yaml

@@ -0,0 +1,18 @@
+# Copyright 2021 The Sigstore Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+url: https://oidc.dlorenc.dev
+contact: lorenc.d@gmail.com
+description: "test address for federation!"
+type: "spiffe"

federation/main.go

@@ -0,0 +1,108 @@
+// Copyright 2021 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package main
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"path/filepath"
+
+	"github.com/sigstore/fulcio/pkg/config"
+	"gopkg.in/yaml.v3"
+)
+
+var rootPaths = []string{"federation", "federation/external"}
+var boilerPlate = `#
+# Copyright 2021 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+`
+
+type federationConfig struct {
+	URL  string
+	Type string
+}
+
+func main() {
+	matches := []string{}
+	for _, rp := range rootPaths {
+		glob := filepath.Join(rp, "*/config.yaml")
+		globs, err := filepath.Glob(glob)
+		if err != nil {
+			panic(err)
+		}
+		matches = append(matches, globs...)
+	}
+	fulcioConfig := config.FulcioConfig{
+		OIDCIssuers: map[string]config.OIDCIssuer{},
+	}
+	for _, m := range matches {
+		b, err := ioutil.ReadFile(m)
+		if err != nil {
+			panic(err)
+		}
+		cfg := federationConfig{}
+		if err := yaml.Unmarshal(b, &cfg); err != nil {
+			panic(err)
+		}
+
+		fulcioCfg := config.OIDCIssuer{
+			IssuerURL: cfg.URL,
+			ClientID:  "sigstore",
+			Type:      config.IssuerType(cfg.Type),
+		}
+		fulcioConfig.OIDCIssuers[cfg.URL] = fulcioCfg
+	}
+
+	m, err := json.MarshalIndent(fulcioConfig, "", "  ")
+	if err != nil {
+		panic(err)
+	}
+
+	// Update the yaml
+	yb, err := ioutil.ReadFile("config/fulcio-config.yaml")
+	if err != nil {
+		panic(err)
+	}
+
+	cm := map[string]interface{}{}
+	if err := yaml.Unmarshal(yb, &cm); err != nil {
+		panic(err)
+	}
+	data := cm["data"].(map[string]interface{})
+	data["config.json"] = string(m)
+
+	newYaml, err := yaml.Marshal(cm)
+	if err != nil {
+		panic(err)
+	}
+
+	yamlWithBoilerplate := boilerPlate + string(newYaml)
+
+	if err := ioutil.WriteFile("config/fulcio-config.yaml", []byte(yamlWithBoilerplate), 0600); err != nil {
+		panic(err)
+	}
+}

federation/oauth2.sigstore.dev/config.yaml

@@ -0,0 +1,18 @@
+# Copyright 2021 The Sigstore Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+url: https://oauth2.sigstore.dev/auth
+contact: lorenc.d@gmail.com
+description: "dex address for fulcio"
+type: "email"

go.mod

@@ -43,4 +43,5 @@ require (
 	google.golang.org/genproto v0.0.0-20210721163202-f1cecdd8b78a
 	google.golang.org/protobuf v1.27.1
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
 )