README
¶
Security Token Services
This directory contains different drivers to obtain short lived tokens from STS providers. These are meant to be exchanged with Sigstore's Fulcio when obtaining a signing certificate. This readme is here mainly to answer the following question:
SHOULD I ADD PROVIDERS HERE?
Short answer: It depends 🙃
Where should I commit my new STS provider?
We are trying to keep the signer dependency list as short as we can. So if you write an STS provider:
- If it adds very few dependencies (note "very" is VERY few and lighweight), feel free to add it here.
- It it has a heaver dependency tree, add it to carabiner-dev/signer-extras.
Thanks!
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var DefaultProviders = map[string]Provider{ "gitlab": &gitlab.CI{}, "actions": &github.Actions{}, "gcp": &gcp.Provider{}, }
These are the default STS providers, the signer project has additional providers in https://github.com/carabiner-dev/signer-extras which have a heavier dependency footprint. gcp mints a service-account identity token from $GOOGLE_APPLICATION_CREDENTIALS or the Google Cloud metadata server and, like the others, reports no token when its environment is absent. Build it with gcp.New to pin a service account key explicitly.
Access the map through Providers/RegisterProvider/UnregisterProvider: iterating it directly is not synchronized with concurrent registration.
Functions ¶
func Providers ¶ added in v0.5.4
Providers returns a snapshot of the registered STS providers, safe to iterate while other goroutines register or unregister providers.
func RegisterProvider ¶
RegisterProvider registers a new provider
func UnregisterProvider ¶
UnregisterProvider removes a registered provider
Types ¶
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
providers
|
|
|
gcp
Package gcp implements an STS provider that mints Google Cloud OIDC identity tokens.
|
Package gcp implements an STS provider that mints Google Cloud OIDC identity tokens. |
|
github
Package github implements a client to requesta short lived token from github actions.
|
Package github implements a client to requesta short lived token from github actions. |
|
gitlab
Package gitlab implements a client to read OIDC tokens from GitLab CI using the SIGSTORE_ID_TOKEN environment variable.
|
Package gitlab implements a client to read OIDC tokens from GitLab CI using the SIGSTORE_ID_TOKEN environment variable. |