Repository: sigstore/fulcio
Pull request #1271 (2023-07-11 22:11:33)

Expose SkipExpiryCheck OIDC Config Option in Verifier
This PR exposes some oidc config options allowed by the go-oidc library that we use, specifically [SkipExpiryCheck](https://github.com/coreos/go-oidc/blob/b203e58c24394ddf5e816706a7645f01280245c7/oidc/verify.go#L96). 

It updates the LRU cache for verifiers to include both the verifier and the config in the cache, so that Verifier A with a normal config can be distinguished from Verifier A with a config with SkipExpiryCheck set

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
> Merging [#1271](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (aa6fefc) into [main](https://app.codecov.io/gh/sigstore/fulcio/commit/b55b6bae041fdcd2e301821e5b289b9c9eeb41ad?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (b55b6ba) will **increase** coverage by `0.38%`.
> The diff coverage is `65.45%`.

```diff
@@            Coverage Diff             @@
##             main    #1271      +/-   ##
==========================================
+ Coverage   58.01%   58.39%   +0.38%     
==========================================
  Files          50       50              
  Lines        3013     3031      +18     
==========================================
+ Hits         1748     1770      +22     
+ Misses       1113     1106       -7     
- Partials      152      155       +3     
```


| [Impacted Files](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) | Coverage Δ | |
|---|---|---|
| [pkg/identity/authorize.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2F1dGhvcml6ZS5nbw==) | `0.00% <0.00%> (ø)` | |
| [pkg/config/config.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2NvbmZpZy9jb25maWcuZ28=) | `74.23% <51.51%> (+4.20%)` | :arrow_up: |
| [pkg/identity/github/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2dpdGh1Yi9pc3N1ZXIuZ28=) | `62.50% <66.66%> (ø)` | |
| [pkg/identity/base/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2Jhc2UvaXNzdWVyLmdv) | `88.46% <100.00%> (ø)` | |
| [pkg/identity/buildkite/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2J1aWxka2l0ZS9pc3N1ZXIuZ28=) | `62.50% <100.00%> (ø)` | |
| [pkg/identity/email/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2VtYWlsL2lzc3Vlci5nbw==) | `62.50% <100.00%> (ø)` | |
| [pkg/identity/gitlabcom/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2dpdGxhYmNvbS9pc3N1ZXIuZ28=) | `62.50% <100.00%> (ø)` | |
| [pkg/identity/issuerpool.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2lzc3VlcnBvb2wuZ28=) | `100.00% <100.00%> (ø)` | |
| [pkg/identity/kubernetes/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L2t1YmVybmV0ZXMvaXNzdWVyLmdv) | `62.50% <100.00%> (ø)` | |
| [pkg/identity/spiffe/issuer.go](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL2lkZW50aXR5L3NwaWZmZS9pc3N1ZXIuZ28=) | `62.50% <100.00%> (ø)` | |
| ... and [2 more](https://app.codecov.io/gh/sigstore/fulcio/pull/1271?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) | |

... and [1 file with indirect coverage changes](https://app.codecov.io/gh/sigstore/fulcio/pull/1271/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore)



Patch:
diff --git a/Dockerfile b/Dockerfile
index 0d055bf..8369430 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.20.5@sha256:fd9306e1c664bd49a11d4a4a04e41303430e069e437d137876e9290a555e06fb AS builder
+FROM golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -28,7 +28,7 @@ RUN go build -o server main.go
 RUN CGO_ENABLED=1 go build -gcflags "all=-N -l" -o server_debug main.go
 
 # Multi-Stage production build
-FROM golang:1.20.5@sha256:fd9306e1c664bd49a11d4a4a04e41303430e069e437d137876e9290a555e06fb as deploy
+FROM golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c as deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/server /usr/local/bin/fulcio-server
diff --git a/Dockerfile.ctfe_init b/Dockerfile.ctfe_init
index f45c68a..c62a75b 100644
--- a/Dockerfile.ctfe_init
+++ b/Dockerfile.ctfe_init
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.20.5@sha256:fd9306e1c664bd49a11d4a4a04e41303430e069e437d137876e9290a555e06fb AS builder
+FROM golang:1.20.6@sha256:8e5a0067e6b387263a01d06b91ef1a983f90e9638564f6e25392fd2695f7ab6c AS builder
 
 WORKDIR /root/
 
diff --git a/go.mod b/go.mod
index 79f03de..2c89452 100644
--- a/go.mod
+++ b/go.mod
@@ -33,10 +33,10 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.16.0
 	github.com/spiffe/go-spiffe/v2 v2.1.6
-	go.step.sm/crypto v0.32.2
+	go.step.sm/crypto v0.32.3
 	go.uber.org/zap v1.24.0
-	google.golang.org/api v0.130.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc
+	google.golang.org/api v0.131.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529
 	google.golang.org/grpc v1.56.2
 	google.golang.org/protobuf v1.31.0
 	gopkg.in/square/go-jose.v2 v2.6.0
@@ -46,10 +46,10 @@ require (
 
 require (
 	cloud.google.com/go v0.110.2 // indirect
-	cloud.google.com/go/compute v1.20.0 // indirect
+	cloud.google.com/go/compute v1.20.1 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	cloud.google.com/go/iam v1.1.0 // indirect
-	cloud.google.com/go/kms v1.12.1 // indirect
+	cloud.google.com/go/kms v1.13.0 // indirect
 	cloud.google.com/go/longrunning v0.5.0 // indirect
 	filippo.io/edwards25519 v1.0.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1 // indirect
@@ -59,7 +59,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v0.8.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
-	github.com/aws/aws-sdk-go v1.44.288 // indirect
+	github.com/aws/aws-sdk-go v1.44.295 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.18.1 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.18.27 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.13.26 // indirect
@@ -90,7 +90,7 @@ require (
 	github.com/google/s2a-go v0.1.4 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
-	github.com/googleapis/gax-go/v2 v2.11.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -142,15 +142,15 @@ require (
 	goa.design/goa v2.2.5+incompatible // indirect
 	golang.org/x/crypto v0.11.0 // indirect
 	golang.org/x/net v0.12.0 // indirect
-	golang.org/x/oauth2 v0.9.0 // indirect
+	golang.org/x/oauth2 v0.10.0 // indirect
 	golang.org/x/sync v0.3.0 // indirect
 	golang.org/x/sys v0.10.0 // indirect
 	golang.org/x/term v0.10.0 // indirect
 	golang.org/x/text v0.11.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230629202037-9506855d4529 // indirect
+	google.golang.org/genproto v0.0.0-20230629202037-9506855d4529 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index 360c5f8..927af97 100644
--- a/go.sum
+++ b/go.sum
@@ -27,16 +27,16 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.20.0 h1:cUOcywWuowO9It2i1KX1lIb0HH7gLv6nENKuZGnlcSo=
-cloud.google.com/go/compute v1.20.0/go.mod h1:kn5BhC++qUWR/AM3Dn21myV7QbgqejW04cAOrtppaQI=
+cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg=
+cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/iam v1.1.0 h1:67gSqaPukx7O8WLLHMa0PNs3EBGd2eE4d+psbO/CO94=
 cloud.google.com/go/iam v1.1.0/go.mod h1:nxdHjaKfCr7fNYx/HJMM8LgiMugmveWlkatear5gVyk=
-cloud.google.com/go/kms v1.12.1 h1:xZmZuwy2cwzsocmKDOPu4BL7umg8QXagQx6fKVmf45U=
-cloud.google.com/go/kms v1.12.1/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM=
+cloud.google.com/go/kms v1.13.0 h1:s+sRhcowXwuLsa2Z8g3Tmh5l0HWNBf//HogCgiuDs/0=
+cloud.google.com/go/kms v1.13.0/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM=
 cloud.google.com/go/longrunning v0.5.0 h1:DK8BH0+hS+DIvc9a2TPnteUievsTCH4ORMAASSb7JcQ=
 cloud.google.com/go/longrunning v0.5.0/go.mod h1:0JNuqRShmscVAhIACGtskSAWtqtOoPkwP0YF1oVEchc=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
@@ -79,8 +79,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.44.288 h1:Ln7fIao/nl0ACtelgR1I4AiEw/GLNkKcXfCaHupUW5Q=
-github.com/aws/aws-sdk-go v1.44.288/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.44.295 h1:SGjU1+MqttXfRiWHD6WU0DRhaanJgAFY+xIhEaugV8Y=
+github.com/aws/aws-sdk-go v1.44.295/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go-v2 v1.18.1 h1:+tefE750oAb7ZQGzla6bLkOwfcQCEtC5y2RqoqCeqKo=
 github.com/aws/aws-sdk-go-v2 v1.18.1/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2/config v1.18.27 h1:Az9uLwmssTE6OGTpsFqOnaGpLnKDqNYOJzWuC6UAYzA=
@@ -261,8 +261,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvki
 github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
-github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
+github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
+github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
@@ -483,8 +483,8 @@ go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLk
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.20.0 h1:BLOA1cZBAGSbRiNuGCCKiFrCdYB7deeHDeD1SueyOfA=
 go.opentelemetry.io/proto/otlp v0.20.0/go.mod h1:3QgjzPALBIv9pcknj2EXGPXjYPFdUh/RQfF8Lz3+Vnw=
-go.step.sm/crypto v0.32.2 h1:EhJpFRNgU3RaNEO3WZ62Kn2gF9NWNglNG4DvSPeuiTs=
-go.step.sm/crypto v0.32.2/go.mod h1:JwarCq+Sn6N8IbRSKfSJfjUNKfO8c4N1mcNxYXuxXzc=
+go.step.sm/crypto v0.32.3 h1:lKR5MuIy2ZGorMKc5S7FI/32E4r0E0vJoC9vJvwQiwI=
+go.step.sm/crypto v0.32.3/go.mod h1:A009Gtqx80nTz/9DreRMflMGgaSWTuhK8En6XycK9yA=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
@@ -595,8 +595,8 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.9.0 h1:BPpt2kU7oMRq3kCHAA1tbSEshXRw1LpG2ztgDwrzuAs=
-golang.org/x/oauth2 v0.9.0/go.mod h1:qYgFZaFiu6Wg24azG8bdV52QJXJGbZzIIsRCdVKzbLw=
+golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
+golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -753,8 +753,8 @@ google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz513
 google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.130.0 h1:A50ujooa1h9iizvfzA4rrJr2B7uRmWexwbekQ2+5FPQ=
-google.golang.org/api v0.130.0/go.mod h1:J/LCJMYSDFvAVREGCbrESb53n4++NMBDetSHGL5I5RY=
+google.golang.org/api v0.131.0 h1:AcgWS2edQ4chVEt/SxgDKubVu/9/idCJy00tBGuGB4M=
+google.golang.org/api v0.131.0/go.mod h1:7vtkbKv2REjJbxmHSkBTBQ5LUGvPdAqjjvt84XAfhpA=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -801,12 +801,12 @@ google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
-google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
-google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
-google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230629202037-9506855d4529 h1:DEH99RbiLZhMxrpEJCZ0A+wdTe0EOgou/poSLx9vWf4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230629202037-9506855d4529/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
+google.golang.org/genproto v0.0.0-20230629202037-9506855d4529 h1:9JucMWR7sPvCxUFd6UsOUNmA5kCcWOfORaT3tpAsKQs=
+google.golang.org/genproto v0.0.0-20230629202037-9506855d4529/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
+google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529 h1:s5YSX+ZH5b5vS9rnpGymvIyMpLRJizowqDlOuyjXnTk=
+google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 h1:2FZP5XuJY9zQyGM5N0rtovnoXjiMUEIUMvw0m9wlpLc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 0e8de68..4aad30d 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -3,7 +3,7 @@ module github.com/sigstore/fulcio/hack/tools
 go 1.20
 
 require (
-	github.com/googleapis/api-linter v1.52.4
+	github.com/googleapis/api-linter v1.53.0
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
 	google.golang.org/protobuf v1.31.0
@@ -28,10 +28,10 @@ require (
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
 	golang.org/x/sys v0.8.0 // indirect
 	golang.org/x/text v0.11.0 // indirect
-	google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/grpc v1.55.0 // indirect
+	google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 // indirect
+	google.golang.org/grpc v1.56.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 69623aa..98464a0 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -19,8 +19,8 @@ github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/googleapis/api-linter v1.52.4 h1:kHd1eL4KEjlSn/zcbH+sKPbEUxQkNNKfLDzWeiZCekg=
-github.com/googleapis/api-linter v1.52.4/go.mod h1:8NLgBx7i+8QuKiDEeoVlInXZWlvacv/tTcDtHevlpMU=
+github.com/googleapis/api-linter v1.53.0 h1:T5pkxmPL+f3A8eAmzsBNqWE27ultLTf+DSJaD6cGp0g=
+github.com/googleapis/api-linter v1.53.0/go.mod h1:WKXJlMy9cqmrhxGi6Zq0idFS/w28VymkJXj7sZIuhfk=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
@@ -57,14 +57,14 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
 golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
-google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
-google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529 h1:s5YSX+ZH5b5vS9rnpGymvIyMpLRJizowqDlOuyjXnTk=
-google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 h1:Au6te5hbKUV8pIYWHqOUZ1pva5qK/rwbIhoXEUB9Lu8=
+google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:O9kGHb51iE/nOGvQaDUuadVYqovW56s5emA88lQnj6Y=
+google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98 h1:FmF5cCW94Ij59cfpoLiwTgodWmm60eEV0CjlsVg2fuw=
+google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 h1:2FZP5XuJY9zQyGM5N0rtovnoXjiMUEIUMvw0m9wlpLc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
+google.golang.org/grpc v1.56.2 h1:fVRFRnXvU+x6C4IlHZewvJOVHoOv1TUuQyoRsYnB4bI=
+google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index db1a200..45f0c17 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -24,6 +24,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"reflect"
 	"regexp"
 	"strings"
 	"time"
@@ -41,6 +42,11 @@ const defaultOIDCDiscoveryTimeout = 10 * time.Second
 // top-level and second-level domain
 const minimumHostnameLength = 2
 
+type verifierWithConfig struct {
+	*oidc.IDTokenVerifier
+	*oidc.Config
+}
+
 type FulcioConfig struct {
 	OIDCIssuers map[string]OIDCIssuer `json:"OIDCIssuers,omitempty"`
 
@@ -54,7 +60,7 @@ type FulcioConfig struct {
 	MetaIssuers map[string]OIDCIssuer `json:"MetaIssuers,omitempty"`
 
 	// verifiers is a fixed mapping from our OIDCIssuers to their OIDC verifiers.
-	verifiers map[string]*oidc.IDTokenVerifier
+	verifiers map[string][]*verifierWithConfig
 	// lru is an LRU cache of recently used verifiers for our meta issuers.
 	lru *lru.TwoQueueCache
 }
@@ -129,25 +135,38 @@ func (fc *FulcioConfig) GetIssuer(issuerURL string) (OIDCIssuer, bool) {
 // GetVerifier fetches a token verifier for the given `issuerURL`
 // coming from an incoming OIDC token.  If no matching configuration
 // is found, then it returns `false`.
-func (fc *FulcioConfig) GetVerifier(issuerURL string) (*oidc.IDTokenVerifier, bool) {
+func (fc *FulcioConfig) GetVerifier(issuerURL string, opts ...InsecureOIDCConfigOption) (*oidc.IDTokenVerifier, bool) {
+	iss, ok := fc.GetIssuer(issuerURL)
+	if !ok {
+		return nil, false
+	}
+	cfg := &oidc.Config{ClientID: iss.ClientID}
+	for _, o := range opts {
+		o(cfg)
+	}
 	// Look up our fixed issuer verifiers
 	v, ok := fc.verifiers[issuerURL]
 	if ok {
-		return v, true
+		for _, c := range v {
+			if reflect.DeepEqual(c.Config, cfg) {
+				return c.IDTokenVerifier, true
+			}
+		}
 	}
 
 	// Look in the LRU cache for a verifier
 	untyped, ok := fc.lru.Get(issuerURL)
 	if ok {
-		return untyped.(*oidc.IDTokenVerifier), true
+		v := untyped.([]*verifierWithConfig)
+		for _, c := range v {
+			if reflect.DeepEqual(c.Config, cfg) {
+				return c.IDTokenVerifier, true
+			}
+		}
 	}
-	// If this issuer hasn't been recently used, then create a new verifier
-	// and add it to the LRU cache.
 
-	iss, ok := fc.GetIssuer(issuerURL)
-	if !ok {
-		return nil, false
-	}
+	// If this issuer hasn't been recently used, or we have special config options, then create a new verifier
+	// and add it to the LRU cache.
 
 	ctx, cancel := context.WithTimeout(context.Background(), defaultOIDCDiscoveryTimeout)
 	defer cancel()
@@ -156,9 +175,24 @@ func (fc *FulcioConfig) GetVerifier(issuerURL string) (*oidc.IDTokenVerifier, bo
 		log.Logger.Warnf("Failed to create provider for issuer URL %q: %v", issuerURL, err)
 		return nil, false
 	}
-	verifier := provider.Verifier(&oidc.Config{ClientID: iss.ClientID})
-	fc.lru.Add(issuerURL, verifier)
-	return verifier, true
+
+	vwf := &verifierWithConfig{provider.Verifier(cfg), cfg}
+	if untyped == nil {
+		v = []*verifierWithConfig{vwf}
+	} else {
+		v = append(v, vwf)
+	}
+
+	fc.lru.Add(issuerURL, v)
+	return vwf.IDTokenVerifier, true
+}
+
+type InsecureOIDCConfigOption func(opt *oidc.Config)
+
+func WithSkipExpiryCheck() InsecureOIDCConfigOption {
+	return func(c *oidc.Config) {
+		c.SkipExpiryCheck = true
+	}
 }
 
 // ToIssuers returns a proto representation of the OIDC issuer configuration.
@@ -189,7 +223,7 @@ func (fc *FulcioConfig) ToIssuers() []*fulciogrpc.OIDCIssuer {
 }
 
 func (fc *FulcioConfig) prepare() error {
-	fc.verifiers = make(map[string]*oidc.IDTokenVerifier, len(fc.OIDCIssuers))
+	fc.verifiers = make(map[string][]*verifierWithConfig, len(fc.OIDCIssuers))
 	for _, iss := range fc.OIDCIssuers {
 		ctx, cancel := context.WithTimeout(context.Background(), defaultOIDCDiscoveryTimeout)
 		defer cancel()
@@ -197,7 +231,8 @@ func (fc *FulcioConfig) prepare() error {
 		if err != nil {
 			return fmt.Errorf("provider %s: %w", iss.IssuerURL, err)
 		}
-		fc.verifiers[iss.IssuerURL] = provider.Verifier(&oidc.Config{ClientID: iss.ClientID})
+		cfg := &oidc.Config{ClientID: iss.ClientID}
+		fc.verifiers[iss.IssuerURL] = []*verifierWithConfig{{provider.Verifier(cfg), cfg}}
 	}
 
 	cache, err := lru.New2Q(100 /* size */)
diff --git a/pkg/identity/authorize.go b/pkg/identity/authorize.go
index 8bfbaeb..80da72f 100644
--- a/pkg/identity/authorize.go
+++ b/pkg/identity/authorize.go
@@ -25,13 +25,13 @@ import (
 // We do this to bypass needing actual OIDC tokens for unit testing.
 var Authorize = actualAuthorize
 
-func actualAuthorize(ctx context.Context, token string) (*oidc.IDToken, error) {
+func actualAuthorize(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 	issuer, err := extractIssuerURL(token)
 	if err != nil {
 		return nil, err
 	}
 
-	verifier, ok := config.FromContext(ctx).GetVerifier(issuer)
+	verifier, ok := config.FromContext(ctx).GetVerifier(issuer, opts...)
 	if !ok {
 		return nil, fmt.Errorf("unsupported issuer: %s", issuer)
 	}
diff --git a/pkg/identity/base/issuer.go b/pkg/identity/base/issuer.go
index 2616ead..86eb020 100644
--- a/pkg/identity/base/issuer.go
+++ b/pkg/identity/base/issuer.go
@@ -21,6 +21,7 @@ import (
 	"strings"
 
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
@@ -38,7 +39,7 @@ func Issuer(issuerURL string) identity.Issuer {
 }
 
 // This is unimplemented for the base issuer, and should be implemented unique to each issuer
-func (e *baseIssuer) Authenticate(_ context.Context, token string) (identity.Principal, error) { //nolint: revive
+func (e *baseIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) { //nolint: revive
 	return nil, fmt.Errorf("unimplemented")
 }
 
diff --git a/pkg/identity/buildkite/issuer.go b/pkg/identity/buildkite/issuer.go
index 720268e..afa87df 100644
--- a/pkg/identity/buildkite/issuer.go
+++ b/pkg/identity/buildkite/issuer.go
@@ -17,6 +17,7 @@ package buildkite
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &buildkiteIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *buildkiteIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *buildkiteIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/identity/email/issuer.go b/pkg/identity/email/issuer.go
index 38c44d7..cc9c08f 100644
--- a/pkg/identity/email/issuer.go
+++ b/pkg/identity/email/issuer.go
@@ -17,6 +17,7 @@ package email
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &emailIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *emailIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *emailIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/identity/github/issuer.go b/pkg/identity/github/issuer.go
index bfa3fc6..1e3d416 100644
--- a/pkg/identity/github/issuer.go
+++ b/pkg/identity/github/issuer.go
@@ -16,7 +16,9 @@ package github
 
 import (
 	"context"
+	"fmt"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,10 +31,10 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &githubIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *githubIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *githubIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("authorizing github issuer: %w", err)
 	}
 	return WorkflowPrincipalFromIDToken(ctx, idtoken)
 }
diff --git a/pkg/identity/gitlabcom/issuer.go b/pkg/identity/gitlabcom/issuer.go
index 6da98a3..01d2985 100644
--- a/pkg/identity/gitlabcom/issuer.go
+++ b/pkg/identity/gitlabcom/issuer.go
@@ -17,6 +17,7 @@ package gitlabcom
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &gitlabIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *gitlabIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *gitlabIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/identity/issuer.go b/pkg/identity/issuer.go
index 1392c9f..5c631ba 100644
--- a/pkg/identity/issuer.go
+++ b/pkg/identity/issuer.go
@@ -14,7 +14,11 @@
 
 package identity
 
-import "context"
+import (
+	"context"
+
+	"github.com/sigstore/fulcio/pkg/config"
+)
 
 type Issuer interface {
 	// Match checks if this issuer can authenticate tokens from a given issuer URL
@@ -22,5 +26,5 @@ type Issuer interface {
 
 	// Authenticate ID token and return Principal on success. The ID token's signature
 	// is verified in the call -- invalid signature must result in an error.
-	Authenticate(ctx context.Context, token string) (Principal, error)
+	Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (Principal, error)
 }
diff --git a/pkg/identity/issuerpool.go b/pkg/identity/issuerpool.go
index fcaa136..609256a 100644
--- a/pkg/identity/issuerpool.go
+++ b/pkg/identity/issuerpool.go
@@ -20,11 +20,13 @@ import (
 	"encoding/json"
 	"fmt"
 	"strings"
+
+	"github.com/sigstore/fulcio/pkg/config"
 )
 
 type IssuerPool []Issuer
 
-func (p IssuerPool) Authenticate(ctx context.Context, token string) (Principal, error) {
+func (p IssuerPool) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (Principal, error) {
 	url, err := extractIssuerURL(token)
 	if err != nil {
 		return nil, err
@@ -32,7 +34,7 @@ func (p IssuerPool) Authenticate(ctx context.Context, token string) (Principal,
 
 	for _, issuer := range p {
 		if issuer.Match(ctx, url) {
-			return issuer.Authenticate(ctx, token)
+			return issuer.Authenticate(ctx, token, opts...)
 		}
 	}
 	return nil, fmt.Errorf("failed to match issuer URL %s from token with any configured providers", url)
diff --git a/pkg/identity/kubernetes/issuer.go b/pkg/identity/kubernetes/issuer.go
index 968a1f4..4c27a75 100644
--- a/pkg/identity/kubernetes/issuer.go
+++ b/pkg/identity/kubernetes/issuer.go
@@ -17,6 +17,7 @@ package kubernetes
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &kubernetesIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *kubernetesIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *kubernetesIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/identity/spiffe/issuer.go b/pkg/identity/spiffe/issuer.go
index e824759..f8ca0ab 100644
--- a/pkg/identity/spiffe/issuer.go
+++ b/pkg/identity/spiffe/issuer.go
@@ -17,6 +17,7 @@ package spiffe
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &spiffeIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *spiffeIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *spiffeIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/identity/uri/issuer.go b/pkg/identity/uri/issuer.go
index bccd08f..86a1ac2 100644
--- a/pkg/identity/uri/issuer.go
+++ b/pkg/identity/uri/issuer.go
@@ -17,6 +17,7 @@ package uri
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &uriIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *uriIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *uriIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/identity/username/issuer.go b/pkg/identity/username/issuer.go
index 58f2926..2ace0fb 100644
--- a/pkg/identity/username/issuer.go
+++ b/pkg/identity/username/issuer.go
@@ -17,6 +17,7 @@ package username
 import (
 	"context"
 
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/base"
 )
@@ -29,8 +30,8 @@ func Issuer(issuerURL string) identity.Issuer {
 	return &usernameIssuer{base.Issuer(issuerURL)}
 }
 
-func (e *usernameIssuer) Authenticate(ctx context.Context, token string) (identity.Principal, error) {
-	idtoken, err := identity.Authorize(ctx, token)
+func (e *usernameIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
 	if err != nil {
 		return nil, err
 	}


Test patch:
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 2039f82..2778479 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -16,11 +16,14 @@
 package config
 
 import (
+	"context"
 	"fmt"
 	"net/url"
 	"reflect"
 	"testing"
 
+	"github.com/coreos/go-oidc/v3/oidc"
+	lru "github.com/hashicorp/golang-lru"
 	"github.com/sigstore/fulcio/pkg/generated/protobuf"
 )
 
@@ -548,3 +551,78 @@ func TestToIssuers(t *testing.T) {
 		t.Fatalf("expected issuer %v, got %v", iss, issuers[1])
 	}
 }
+
+func TestVerifierCache(t *testing.T) {
+	cache, err := lru.New2Q(100 /* size */)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fc := &FulcioConfig{
+		OIDCIssuers: map[string]OIDCIssuer{
+			"issuer.dev": {
+				IssuerURL: "issuer.dev",
+				ClientID:  "sigstore",
+			},
+		},
+		verifiers: map[string][]*verifierWithConfig{},
+		lru:       cache,
+	}
+
+	// create a cache hit
+	cfg := &oidc.Config{ClientID: "sigstore"}
+	verifier := oidc.NewVerifier("issuer.dev", &mockKeySet{}, cfg)
+	fc.verifiers = map[string][]*verifierWithConfig{
+		"issuer.dev": {
+			{
+				Config:          cfg,
+				IDTokenVerifier: verifier,
+			},
+		},
+	}
+
+	// make sure we get a hit
+	v, ok := fc.GetVerifier("issuer.dev")
+	if !ok {
+		t.Fatal("unable to verifier")
+	}
+	if !reflect.DeepEqual(v, verifier) {
+		t.Fatal("got unexpected verifier")
+	}
+
+	// get verifier with SkipExpiryCheck set, should fail on cache miss
+	_, ok = fc.GetVerifier("issuer.dev", WithSkipExpiryCheck())
+	if ok {
+		t.Fatal("expected cache miss")
+	}
+
+	// create a cache hit with SkipExpiryCheck set
+	withExpiryCfg := &oidc.Config{ClientID: "sigstore", SkipExpiryCheck: true}
+	expiryVerifier := oidc.NewVerifier("issuer.dev", &mockKeySet{}, cfg)
+	fc.verifiers = map[string][]*verifierWithConfig{
+		"issuer.dev": {
+			{
+				Config:          cfg,
+				IDTokenVerifier: verifier,
+			}, {
+				Config:          withExpiryCfg,
+				IDTokenVerifier: expiryVerifier,
+			},
+		},
+	}
+	// make sure we get a hit and the correct verifier is returned
+	v, ok = fc.GetVerifier("issuer.dev", WithSkipExpiryCheck())
+	if !ok {
+		t.Fatal("unable to verifier")
+	}
+	if !reflect.DeepEqual(v, expiryVerifier) {
+		t.Fatal("got unexpected verifier")
+	}
+}
+
+type mockKeySet struct {
+}
+
+func (m *mockKeySet) VerifySignature(_ context.Context, _ string) (payload []byte, err error) {
+	return nil, nil
+}
diff --git a/pkg/identity/buildkite/issuer_test.go b/pkg/identity/buildkite/issuer_test.go
index fec3d9f..4253ba1 100644
--- a/pkg/identity/buildkite/issuer_test.go
+++ b/pkg/identity/buildkite/issuer_test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
@@ -56,7 +57,7 @@ func TestIssuer(t *testing.T) {
 		}
 		withClaims(token, claims)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/email/issuer_test.go b/pkg/identity/email/issuer_test.go
index 4d6f0ea..f2df9f8 100644
--- a/pkg/identity/email/issuer_test.go
+++ b/pkg/identity/email/issuer_test.go
@@ -66,7 +66,7 @@ func TestIssuer(t *testing.T) {
 			},
 		})
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/github/issuer_test.go b/pkg/identity/github/issuer_test.go
index 8d952fa..6307313 100644
--- a/pkg/identity/github/issuer_test.go
+++ b/pkg/identity/github/issuer_test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
@@ -69,7 +70,7 @@ func TestIssuer(t *testing.T) {
 		}
 		withClaims(token, claims)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/gitlabcom/issuer_test.go b/pkg/identity/gitlabcom/issuer_test.go
index 5e2c970..43fea19 100644
--- a/pkg/identity/gitlabcom/issuer_test.go
+++ b/pkg/identity/gitlabcom/issuer_test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
@@ -74,7 +75,7 @@ func TestIssuer(t *testing.T) {
 		}
 		withClaims(token, claims)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/issuerpool_test.go b/pkg/identity/issuerpool_test.go
index 7ffef3d..aae6d0b 100644
--- a/pkg/identity/issuerpool_test.go
+++ b/pkg/identity/issuerpool_test.go
@@ -19,6 +19,8 @@ import (
 	"crypto/x509"
 	"errors"
 	"testing"
+
+	"github.com/sigstore/fulcio/pkg/config"
 )
 
 type testPrincipal struct {
@@ -42,7 +44,7 @@ func (i testIssuer) Match(ctx context.Context, url string) bool {
 	return i.match(ctx, url)
 }
 
-func (i testIssuer) Authenticate(ctx context.Context, token string) (Principal, error) {
+func (i testIssuer) Authenticate(ctx context.Context, token string, _ ...config.InsecureOIDCConfigOption) (Principal, error) {
 	return i.auth(ctx, token)
 }
 
diff --git a/pkg/identity/kubernetes/issuer_test.go b/pkg/identity/kubernetes/issuer_test.go
index 967d5c1..c274707 100644
--- a/pkg/identity/kubernetes/issuer_test.go
+++ b/pkg/identity/kubernetes/issuer_test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
@@ -64,7 +65,7 @@ func TestIssuer(t *testing.T) {
 		}
 		withClaims(token, claims)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/spiffe/issuer_test.go b/pkg/identity/spiffe/issuer_test.go
index 1c5c728..57af66a 100644
--- a/pkg/identity/spiffe/issuer_test.go
+++ b/pkg/identity/spiffe/issuer_test.go
@@ -56,7 +56,7 @@ func TestIssuer(t *testing.T) {
 		}
 		ctx := config.With(context.Background(), cfg)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/uri/issuer_test.go b/pkg/identity/uri/issuer_test.go
index c90f1cf..053a8a3 100644
--- a/pkg/identity/uri/issuer_test.go
+++ b/pkg/identity/uri/issuer_test.go
@@ -56,7 +56,7 @@ func TestIssuer(t *testing.T) {
 		}
 		ctx := config.With(context.Background(), cfg)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")
diff --git a/pkg/identity/username/issuer_test.go b/pkg/identity/username/issuer_test.go
index 18df768..a88070f 100644
--- a/pkg/identity/username/issuer_test.go
+++ b/pkg/identity/username/issuer_test.go
@@ -56,7 +56,7 @@ func TestIssuer(t *testing.T) {
 		}
 		ctx := config.With(context.Background(), cfg)
 
-		identity.Authorize = func(_ context.Context, _ string) (*oidc.IDToken, error) {
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
 			return token, nil
 		}
 		principal, err := issuer.Authenticate(ctx, "token")