Repository: sigstore/fulcio
Pull request #1740 (2024-07-24 00:11:54)

Move gitlab to ci-provider
<!--
Thanks for opening a pull request! Please do not just delete this text.  The three fields below are mandatory.

Please remember to:
- This PR requires an issue. If it is a new feature, the issue should proceed the PR and will have allowed sufficent time for discussions to take place. Please use
issue tags such as "Closes #XYZ" or "Resolves sigstore/repo-name#XYZ".
  [documentation](https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
- ensure your commits are signed-off, as sigstore uses the [DCO](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) using `git commit -s`, or `git commit -s --amend` if you want to amend already existing commits
- lastly, ensure there are no merge commits!

Thank you :)
-->

#### Summary
Contribute towards https://github.com/sigstore/fulcio/issues/1111

Similarly to what has been done for github https://github.com/sigstore/fulcio/pull/1738, it moves gitlab for using ci-provider logic
<!--
 Explain the **motivation** for making this change. What existing problem does the pull request solve? How can reviewers test this PR?
-->

#### Release Note
<!--
Add a release note for each of the following conditions:

* Config changes (additions, deletions, updates)
* API additions—new endpoint, new response fields, or newly accepted request parameters
* Database changes (any)
* Websocket additions or changes
* Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
* New features and improvements, including behavioural changes, UI changes and CLI changes
* Bug fixes and fixes of previous known issues
* Deprecation warnings, breaking changes, or compatibility notes

If no release notes are required write NONE. Use past-tense.

-->

#### Documentation
<!--

Does this change require an update to documentation? How will users implement your new feature?

Please reference a PR within https://docs.sigstore.dev

-->


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/sigstore/fulcio/pull/1740?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 50.37%. Comparing base [(`cf238ac`)](https://app.codecov.io/gh/sigstore/fulcio/commit/cf238accd68ef13e1e3425a5d87db2f352de173c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) to head [(`9d4a9bc`)](https://app.codecov.io/gh/sigstore/fulcio/commit/9d4a9bc93b5a8fc7199ff111fb0a8de966ca83f8?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).
> Report is 152 commits behind head on main.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #1740      +/-   ##
==========================================
- Coverage   57.93%   50.37%   -7.56%     
==========================================
  Files          50       70      +20     
  Lines        3119     4121    +1002     
==========================================
+ Hits         1807     2076     +269     
- Misses       1154     1815     +661     
- Partials      158      230      +72     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/sigstore/fulcio/pull/1740?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).


Patch:
diff --git a/config/identity/config.yaml b/config/identity/config.yaml
index 672f25c..d9fb56f 100644
--- a/config/identity/config.yaml
+++ b/config/identity/config.yaml
@@ -12,8 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-define: &github-type "github-workflow"
-
+define:
+  - &github-type "github-workflow"
+  - &gitlab-type "gitlab-pipeline"
 oidc-issuers:
   https://accounts.google.com:
     issuer-url: https://accounts.google.com
@@ -43,19 +44,22 @@ oidc-issuers:
   https://dev.gitlab.org:
     issuer-url: https://dev.gitlab.org
     client-id: sigstore
-    type: gitlab-pipeline
+    type: ci-provider
+    ci-provider: *gitlab-type
     contact: distribution-be@gitlab.com
     description: "GitLab OIDC tokens for job identity"
   https://gitlab.archlinux.org:
     issuer-url: https://gitlab.archlinux.org
     client-id: sigstore
-    type: gitlab-pipeline
+    type: ci-provider
+    ci-provider: *gitlab-type
     contact: sigstore@archlinux.org
     description: "GitLab OIDC tokens for job identity"
   https://gitlab.com:
     issuer-url: https://gitlab.com
     client-id: sigstore
-    type: gitlab-pipeline
+    type: ci-provider
+    ci-provider: *gitlab-type
     contact: support@gitlab.com
     description: "GitLab OIDC tokens for job identity"
   https://issuer.enforce.dev:
@@ -86,7 +90,8 @@ oidc-issuers:
   https://ops.gitlab.net:
     issuer-url: https://ops.gitlab.net
     client-id: sigstore
-    type: gitlab-pipeline
+    type: ci-provider
+    ci-provider: *gitlab-type
     contact: distribution-be@gitlab.com
     description: "GitLab OIDC tokens for job identity"
   https://token.actions.githubusercontent.com:
@@ -117,7 +122,7 @@ ci-issuer-metadata:
   *github-type:
       default-template-values:
           url: "https://github.com"
-      extension-templates: 
+      extension-templates:
           github-workflow-trigger: "event_name"
           github-workflow-sha: "sha"
           github-workflow-name: "workflow"
@@ -138,3 +143,22 @@ ci-issuer-metadata:
           run-invocation-uri: "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}"
           source-repository-visibility-at-signing: "repository_visibility"
       subject-alternative-name-template: "{{ .url }}/{{ .job_workflow_ref }}"
+  *gitlab-type:
+    default-template-values:
+        url: "https://gitlab.com"
+    extension-templates:
+        build-signer-uri: "https://{{ .ci_config_ref_uri }}"
+        build-signer-digest: "ci_config_sha"
+        runner-environment: "runner_environment"
+        source-repository-uri: "{{ .url }}/{{ .repository }}"
+        source-repository-digest: "sha"
+        source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}/{{ .ref }}
+        source-repository-identifier: "project_id"
+        source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
+        source-repository-owner-identifier: "namespace_id"
+        build-config-uri: "https://{{ .ci_config_ref_uri }}"
+        build-config-digest: "ci_config_sha"
+        build-trigger: "pipeline_source"
+        run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
+        source-repository-visibility-at-signing: "repository_visibility"
+    subject-alternative-name-template: "https://{{ .ci_config_ref_uri }}"


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index aa387f9..e60b216 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -229,6 +229,10 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"workflow":              "foo",
 		"workflow_ref":          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
 		"workflow_sha":          "example-sha-other",
+		"ref_type":              "branch",
+		"ref_gitlab":            "main",
+		"ref_type_tag":          "tag",
+		"ref_tag":               "1.0.0",
 	}
 	issuerMetadata := map[string]string{
 		"url": "https://github.com",
@@ -269,18 +273,28 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "",
 			ExpectErr:      true,
 		},
+		`If else template`: {
+			Template:       `refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}{{ .ref_gitlab }}`,
+			ExpectedResult: "refs/heads/main",
+			ExpectErr:      false,
+		},
+		`If else template using else condition`: {
+			Template:       `refs/{{if eq .ref_type_tag "branch"}}heads/{{ else }}tags/{{end}}{{ .ref_tag }}`,
+			ExpectedResult: "refs/tags/1.0.0",
+			ExpectErr:      false,
+		},
 	}
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			res, err := applyTemplateOrReplace(test.Template, tokenClaims, issuerMetadata)
 			if res != test.ExpectedResult {
-				t.Errorf("expected result don't matches: Expected %s, received: %s",
-					test.ExpectedResult, res)
+				t.Errorf("expected result don't matches: Expected %s, received: %s, error: %v",
+					test.ExpectedResult, res, err)
 			}
 			if (err != nil) != test.ExpectErr {
-				t.Errorf("should raise an error don't matches: Expected %v, received: %v",
-					test.ExpectErr, err != nil)
+				t.Errorf("should raise an error don't matches: Expected %v, received: %v, error: %v",
+					test.ExpectErr, err != nil, err)
 			}
 		})
 	}