Repository: sigstore/fulcio
Pull request #1753 (2024-08-05 02:09:00)

Bump google.golang.org/api from 0.189.0 to 0.190.0
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.189.0 to 0.190.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p>
<blockquote>
<h2>v0.190.0</h2>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.189.0...v0.190.0">0.190.0</a> (2024-08-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2693">#2693</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/cbc19e75465de8084d9e34b2b3ccc0ba8d905e3d">cbc19e7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2698">#2698</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ddc4e0b0adb8c4fe22edb4a821e4f2c716d5a327">ddc4e0b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2699">#2699</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d07fd26bf7d8b4a5848207b35d4214976bceeac0">d07fd26</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2700">#2700</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a8b0821bdcc9a5e76db236bfce38823ab36002de">a8b0821</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2703">#2703</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7b03cff8f79b0bb0d82f6f0b2e16120e10019852">7b03cff</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2706">#2706</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/05a4fc520d64a219002772f36377929b010ff53b">05a4fc5</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2715">#2715</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/164a8d6aedb86f34a366d792a213fed754197e8a">164a8d6</a>)</li>
<li>Move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2695">#2695</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/66ace6c95689fd06cb467069d8ec0f5ddb8ac695">66ace6c</a>)</li>
</ul>
<h3>Reverts</h3>
<ul>
<li>Move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2695">#2695</a>)&quot; (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2704">#2704</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/aa62c85a8c8cce5d0ed963b7d9b74e6a739fd072">aa62c85</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.189.0...v0.190.0">0.190.0</a> (2024-08-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2693">#2693</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/cbc19e75465de8084d9e34b2b3ccc0ba8d905e3d">cbc19e7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2698">#2698</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ddc4e0b0adb8c4fe22edb4a821e4f2c716d5a327">ddc4e0b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2699">#2699</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d07fd26bf7d8b4a5848207b35d4214976bceeac0">d07fd26</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2700">#2700</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a8b0821bdcc9a5e76db236bfce38823ab36002de">a8b0821</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2703">#2703</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7b03cff8f79b0bb0d82f6f0b2e16120e10019852">7b03cff</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2706">#2706</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/05a4fc520d64a219002772f36377929b010ff53b">05a4fc5</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2715">#2715</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/164a8d6aedb86f34a366d792a213fed754197e8a">164a8d6</a>)</li>
<li>Move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2695">#2695</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/66ace6c95689fd06cb467069d8ec0f5ddb8ac695">66ace6c</a>)</li>
</ul>
<h3>Reverts</h3>
<ul>
<li>Move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2695">#2695</a>)&quot; (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2704">#2704</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/aa62c85a8c8cce5d0ed963b7d9b74e6a739fd072">aa62c85</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/88dca19518980ee6eb52da31c0460ea16674222e"><code>88dca19</code></a> chore(main): release 0.190.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2694">#2694</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/1f2d6d3d2eff4c38ca67895c7da5fec7d57d4726"><code>1f2d6d3</code></a> chore: bump cloud.google.com/go/auth@v0.7.3 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2716">#2716</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/164a8d6aedb86f34a366d792a213fed754197e8a"><code>164a8d6</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2715">#2715</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/05a4fc520d64a219002772f36377929b010ff53b"><code>05a4fc5</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2706">#2706</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/c8041b0bbc04ccd852bdb437badd4c0ef29ed4ee"><code>c8041b0</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2702">#2702</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/aa62c85a8c8cce5d0ed963b7d9b74e6a739fd072"><code>aa62c85</code></a> revert: move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2695">#2695</a>)&quot; (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2704">#2704</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/7b03cff8f79b0bb0d82f6f0b2e16120e10019852"><code>7b03cff</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2703">#2703</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/a8b0821bdcc9a5e76db236bfce38823ab36002de"><code>a8b0821</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2700">#2700</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/1e4c0244c48527bd75637c7a2776234b9519f484"><code>1e4c024</code></a> chore(all): update module github.com/google/s2a-go to v0.1.8 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2697">#2697</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/d07fd26bf7d8b4a5848207b35d4214976bceeac0"><code>d07fd26</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2699">#2699</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.189.0...v0.190.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.189.0&new-version=0.190.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/config/identity/config.yaml b/config/identity/config.yaml
index d9fb56f..1c7685c 100644
--- a/config/identity/config.yaml
+++ b/config/identity/config.yaml
@@ -15,6 +15,8 @@
 define:
   - &github-type "github-workflow"
   - &gitlab-type "gitlab-pipeline"
+  - &codefresh-type "codefresh-workflow"
+  - &buildkite-type "buildkite-job"
 oidc-issuers:
   https://accounts.google.com:
     issuer-url: https://accounts.google.com
@@ -25,7 +27,8 @@ oidc-issuers:
   https://agent.buildkite.com:
     issuer-url: https://agent.buildkite.com
     client-id: sigstore
-    type: buildkite-job
+    type: ci-provider
+    ci-provider: *buildkite-type
     contact: support@buildkite.com
     description: "Buildkite Agent OIDC tokens for job identity"
   https://allow.pub:
@@ -84,7 +87,8 @@ oidc-issuers:
   https://oidc.codefresh.io:
     issuer-url: https://oidc.codefresh.io
     client-id: sigstore
-    type: codefresh-workflow
+    type: ci-provider
+    ci-provider: *codefresh-type
     contact: support@codefresh.io
     description: "Codefresh OIDC tokens for job identity"
   https://ops.gitlab.net:
@@ -120,45 +124,114 @@ meta-issuers:
     ci-provider: *github-type
 ci-issuer-metadata:
   *github-type:
-      default-template-values:
-          url: "https://github.com"
-      extension-templates:
-          github-workflow-trigger: "event_name"
-          github-workflow-sha: "sha"
-          github-workflow-name: "workflow"
-          github-workflow-repository: "repository"
-          github-workflow-ref: "ref"
-          build-signer-uri: "{{ .url }}/{{ .job_workflow_ref }}"
-          build-signer-digest: "job_workflow_sha"
-          runner-environment: "runner_environment"
-          source-repository-uri: "{{ .url }}/{{ .repository }}"
-          source-repository-digest: "sha"
-          source-repository-ref: "ref"
-          source-repository-identifier: "repository_id"
-          source-repository-owner-uri: "{{ .url }}/{{ .repository_owner }}"
-          source-repository-owner-identifier: "repository_owner_id"
-          build-config-uri: "{{ .url }}/{{ .workflow_ref }}"
-          build-config-digest: "workflow_sha"
-          build-trigger: "event_name"
-          run-invocation-uri: "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}"
-          source-repository-visibility-at-signing: "repository_visibility"
-      subject-alternative-name-template: "{{ .url }}/{{ .job_workflow_ref }}"
+    default-template-values:
+      # url: URL of issuer, https://github.com
+      url: "https://github.com"
+    extension-templates:
+      # event_name: Event that triggered this workflow run. E.g "push", "tag"
+      github-workflow-trigger: "event_name"
+      # sha: Commit SHA being built
+      github-workflow-sha: "sha"
+      # workflow (Deprecated): Name of workflow that is running (mutable)
+      github-workflow-name: "workflow"
+      # repository: Name of repository being built
+      github-workflow-repository: "repository"
+      # ref: Git ref being built
+      github-workflow-ref: "ref"
+      # job_workflow_ref: Specific build instructions (i.e. reusable workflow)
+      build-signer-uri: "{{ .url }}/{{ .job_workflow_ref }}"
+      # job_workflow_sha: Commit SHA to specific build instructions
+      build-signer-digest: "job_workflow_sha"
+      # runner_environment: Whether the build took place in cloud or self-hosted infrastructure
+      runner-environment: "runner_environment"
+      # repository: Name of repository being built
+      source-repository-uri: "{{ .url }}/{{ .repository }}"
+      source-repository-digest: "sha"
+      source-repository-ref: "ref"
+      # repository_id: ID to the source repo
+      source-repository-identifier: "repository_id"
+      # repository_owner: Owner of the source repo (mutable)
+      source-repository-owner-uri: "{{ .url }}/{{ .repository_owner }}"
+      # repository_owner_id: ID of the source repo
+      source-repository-owner-identifier: "repository_owner_id"
+      # workflow_ref: Ref of top-level workflow that is running
+      build-config-uri: "{{ .url }}/{{ .workflow_ref }}"
+      # workflow_sha: Commit SHA of top-level workflow that is running
+      build-config-digest: "workflow_sha"
+      build-trigger: "event_name"
+      # run_id: ID of workflow run
+      # run_attempt: Attempt number of workflow run
+      run-invocation-uri: "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}"
+      # repository_visibility: Visibility of the source repo
+      source-repository-visibility-at-signing: "repository_visibility"
+    subject-alternative-name-template: "{{ .url }}/{{ .job_workflow_ref }}"
   *gitlab-type:
     default-template-values:
-        url: "https://gitlab.com"
+      url: "https://gitlab.com"
     extension-templates:
-        build-signer-uri: "https://{{ .ci_config_ref_uri }}"
-        build-signer-digest: "ci_config_sha"
-        runner-environment: "runner_environment"
-        source-repository-uri: "{{ .url }}/{{ .repository }}"
-        source-repository-digest: "sha"
-        source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}/{{ .ref }}
-        source-repository-identifier: "project_id"
-        source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
-        source-repository-owner-identifier: "namespace_id"
-        build-config-uri: "https://{{ .ci_config_ref_uri }}"
-        build-config-digest: "ci_config_sha"
-        build-trigger: "pipeline_source"
-        run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
-        source-repository-visibility-at-signing: "repository_visibility"
+      # url: The URL of the GitLab instance. https://gitlab.com
+      # ci_config_ref_uri: Ref of top-level pipeline definition.
+      # E.g. gitlab.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main
+      build-signer-uri: "https://{{ .ci_config_ref_uri }}"
+      # ci_config_sha: Commit sha of top-level pipeline definition, and is
+      # only populated when `ciConfigRefURI` is local to the GitLab instance
+      build-signer-digest: "ci_config_sha"
+      # runner_environment: The type of runner used by the job. May be one of gitlab-hosted or self-hosted.
+      runner-environment: "runner_environment"
+      # repository: Repository building built
+      source-repository-uri: "{{ .url }}/{{ .repository }}"
+      # sha: Commit SHA being built
+      source-repository-digest: "sha"
+      # ref_type: The type of the ref
+      # E.g. "branch", "tag"
+      # ref: Git ref being built
+      source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}/{{ .ref }}
+      # project_id: ID to the source repo
+      source-repository-identifier: "project_id"
+      # namespace_path: Owner of the source repo (mutable)
+      source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
+      # namespace_id: ID of the source repo
+      source-repository-owner-identifier: "namespace_id"
+      build-config-uri: "https://{{ .ci_config_ref_uri }}"
+      build-config-digest: "ci_config_sha"
+      # pipeline_source: Event that triggered this workflow run. E.g "push", "tag" etc
+      build-trigger: "pipeline_source"
+      # project_path: Repository building built
+      # job_id: job ID
+      run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
+      # project_visibility: Visibility of the source project
+      source-repository-visibility-at-signing: "project_visibility"
     subject-alternative-name-template: "https://{{ .ci_config_ref_uri }}"
+  *codefresh-type:
+    default-template-values:
+      # We are setting the default value for "platform_url" as the ci-provider
+      # principal gives priority to the claimed value over the default
+      # when they have the same name. Then it will use the default "platform_url" value
+      # for cases that the claimed data doesn't exist.
+      # platform_url: Codefresh platform url
+      platform_url: "https://g.codefresh.io"
+    extension-templates:
+      # workflow_id: The ID of the specific workflow authorized in the claim.
+      # For example, 64f447c02199f903000gh20.
+      build-signer-uri: "{{.platform_url}}/build/{{ .workflow_id }}"
+      # runner_environment: Whether the build took place in cloud or self-hosted infrastructure
+      runner-environment: "runner_environment"
+      # scm_repo_url: Applies to Git push, PR, and manual Git trigger types.
+      # The SCM URL specifying the Git repository’s location.
+      # For example, https://github.com/codefresh-user/oidc-test
+      source-repository-uri: "scm_repo_url"
+      # scm_ref: Applies to Git push, PR, and manual Git trigger types.
+      # The SCM name of the branch or tag within the Git repository
+      # for which the workflow should execute. For example, main or v1.0.0.
+      source-repository-ref: "scm_ref"
+      # pipeline_id: Codefresh Pipeline id
+      build-config-uri: "{{.platform_url}}/api/pipelines/{{ .pipeline_id }}"
+      # account_name: Codefresh account name
+      # pipeline_name: Codefresh pipline name (project/pipeline)
+      # account_id: Codefresh account id
+      run-invocation-uri: "{{.platform_url}}/build/{{ .workflow_id }}"
+    subject-alternative-name-template: "{{.platform_url}}/{{.account_name}}/{{.pipeline_name}}:{{.account_id}}/{{.pipeline_id}}"
+  *buildkite-type:
+    default-template-values:
+      url: "https://buildkite.com"
+    subject-alternative-name-template: "{{.url}}/{{.organization_slug}}/{{.pipeline_slug}}"
diff --git a/docs/oidc.md b/docs/oidc.md
index 653644e..61b354e 100644
--- a/docs/oidc.md
+++ b/docs/oidc.md
@@ -12,7 +12,7 @@ To add a new OIDC issuer:
 
 * Add the new issuer to the [configuration](https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml).
   * Attention: If your issuer is for a CI provider, you should set the `type` as `ci-provider` and set the field `ci-provider` with the name of your provider. You should also fill the `ci-issuer-metadata` with the `default-template-values`, `extension-templates` and `subject-alternative-name-template`, following the pattern defined on the example ([example](tbd after migrating the github to ci-provider)).
-  * Important notes: The `extension-templates` and the `subject-alternative-name-template` follows the templates [pattern](https://pkg.go.dev/text/template). The name used to fill the `ci-provider` field has to be the same used as key for `ci-issuer-metadata`, we suggest to use a variable for this.
+  * Important notes: The `extension-templates` and the `subject-alternative-name-template` follows the templates [pattern](https://pkg.go.dev/text/template). The name used to fill the `ci-provider` field has to be the same used as key for `ci-issuer-metadata`, we suggest to use a variable for this. If you set a `default-template-value` with the same name of a claim key, the claimed value will have priority over the default one.
 * If your issuer is not for a CI provider, you need to follow the next steps:
   * Add the new issuer to the [`identity` folder](https://github.com/sigstore/fulcio/tree/main/pkg/identity) ([example](https://github.com/sigstore/fulcio/tree/main/pkg/identity/email)). You will define an `Issuer` type and a way to map the token to the certificate extensions.
   * Define a constant with the issuer type name in the [configuration](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config.go#L213-L221), add update the [tests](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config_test.go#L473-L503)
diff --git a/go.mod b/go.mod
index ef0216e..a59b034 100644
--- a/go.mod
+++ b/go.mod
@@ -37,8 +37,8 @@ require (
 	github.com/spiffe/go-spiffe/v2 v2.3.0
 	go.step.sm/crypto v0.51.1
 	go.uber.org/zap v1.27.0
-	google.golang.org/api v0.189.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a
+	google.golang.org/api v0.190.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
@@ -47,12 +47,12 @@ require (
 
 require (
 	cloud.google.com/go v0.115.0 // indirect
-	cloud.google.com/go/auth v0.7.2 // indirect
+	cloud.google.com/go/auth v0.7.3 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.3 // indirect
 	cloud.google.com/go/compute/metadata v0.5.0 // indirect
-	cloud.google.com/go/iam v1.1.10 // indirect
-	cloud.google.com/go/kms v1.18.3 // indirect
-	cloud.google.com/go/longrunning v0.5.9 // indirect
+	cloud.google.com/go/iam v1.1.12 // indirect
+	cloud.google.com/go/kms v1.18.4 // indirect
+	cloud.google.com/go/longrunning v0.5.11 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
@@ -89,7 +89,7 @@ require (
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/go-containerregistry v0.20.0 // indirect
-	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
@@ -150,8 +150,8 @@ require (
 	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/genproto v0.0.0-20240722135656-d784300faade // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a // indirect
+	google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 3c60921..a6ce3f2 100644
--- a/go.sum
+++ b/go.sum
@@ -5,18 +5,18 @@ chainguard.dev/sdk v0.1.22/go.mod h1:N2m/Jg2mj2Qi9EupzTuwUQQQbp76WbbwSbxaB8V4YDo
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
 cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.7.2 h1:uiha352VrCDMXg+yoBtaD0tUF4Kv9vrtrWPYXwutnDE=
-cloud.google.com/go/auth v0.7.2/go.mod h1:VEc4p5NNxycWQTMQEDQF0bd6aTMb6VgYDXEwiJJQAbs=
+cloud.google.com/go/auth v0.7.3 h1:98Vr+5jMaCZ5NZk6e/uBgf60phTk/XN84r8QEWB9yjY=
+cloud.google.com/go/auth v0.7.3/go.mod h1:HJtWUx1P5eqjy/f6Iq5KeytNpbAcGolPhOgyop2LlzA=
 cloud.google.com/go/auth/oauth2adapt v0.2.3 h1:MlxF+Pd3OmSudg/b1yZ5lJwoXCEaeedAguodky1PcKI=
 cloud.google.com/go/auth/oauth2adapt v0.2.3/go.mod h1:tMQXOfZzFuNuUxOypHlQEXgdfX5cuhwU+ffUuXRJE8I=
 cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY=
 cloud.google.com/go/compute/metadata v0.5.0/go.mod h1:aHnloV2TPI38yx4s9+wAZhHykWvVCfu7hQbF+9CWoiY=
-cloud.google.com/go/iam v1.1.10 h1:ZSAr64oEhQSClwBL670MsJAW5/RLiC6kfw3Bqmd5ZDI=
-cloud.google.com/go/iam v1.1.10/go.mod h1:iEgMq62sg8zx446GCaijmA2Miwg5o3UbO+nI47WHJps=
-cloud.google.com/go/kms v1.18.3 h1:8+Z2S4bQDSCdghB5ZA5dVDDJTLmnkRlowtFiXqMFd74=
-cloud.google.com/go/kms v1.18.3/go.mod h1:y/Lcf6fyhbdn7MrG1VaDqXxM8rhOBc5rWcWAhcvZjQU=
-cloud.google.com/go/longrunning v0.5.9 h1:haH9pAuXdPAMqHvzX0zlWQigXT7B0+CL4/2nXXdBo5k=
-cloud.google.com/go/longrunning v0.5.9/go.mod h1:HD+0l9/OOW0za6UWdKJtXoFAX/BGg/3Wj8p10NeWF7c=
+cloud.google.com/go/iam v1.1.12 h1:JixGLimRrNGcxvJEQ8+clfLxPlbeZA6MuRJ+qJNQ5Xw=
+cloud.google.com/go/iam v1.1.12/go.mod h1:9LDX8J7dN5YRyzVHxwQzrQs9opFFqn0Mxs9nAeB+Hhg=
+cloud.google.com/go/kms v1.18.4 h1:dYN3OCsQ6wJLLtOnI8DGUwQ5shMusXsWCCC+s09ATsk=
+cloud.google.com/go/kms v1.18.4/go.mod h1:SG1bgQ3UWW6/KdPo9uuJnzELXY5YTTMJtDYvajiQ22g=
+cloud.google.com/go/longrunning v0.5.11 h1:Havn1kGjz3whCfoD8dxMLP73Ph5w+ODyZB9RUsDxtGk=
+cloud.google.com/go/longrunning v0.5.11/go.mod h1:rDn7//lmlfWV1Dx6IB4RatCPenTwwmqXuiP0/RgoEO4=
 cloud.google.com/go/security v1.17.4 h1:ERhxAa02mnMEIIAXvzje+qJ+yWniP6l5uOX+k9ELCaA=
 cloud.google.com/go/security v1.17.4/go.mod h1:KMuDJH+sEB3KTODd/tLJ7kZK+u2PQt+Cfu0oAxzIhgo=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
@@ -164,8 +164,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-containerregistry v0.20.0 h1:wRqHpOeVh3DnenOrPy9xDOLdnLatiGuuNRVelR2gSbg=
 github.com/google/go-containerregistry v0.20.0/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
-github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -490,20 +490,20 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.189.0 h1:equMo30LypAkdkLMBqfeIqtyAnlyig1JSZArl4XPwdI=
-google.golang.org/api v0.189.0/go.mod h1:FLWGJKb0hb+pU2j+rJqwbnsF+ym+fQs73rbJ+KAUgy8=
+google.golang.org/api v0.190.0 h1:ASM+IhLY1zljNdLu19W1jTmU6A+gMk6M46Wlur61s+Q=
+google.golang.org/api v0.190.0/go.mod h1:QIr6I9iedBLnfqoD6L6Vze1UvS5Hzj5r2aUBOaZnLHo=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240722135656-d784300faade h1:lKFsS7wpngDgSCeFn7MoLy+wBDQZ1UQIJD4UNM1Qvkg=
-google.golang.org/genproto v0.0.0-20240722135656-d784300faade/go.mod h1:FfBgJBJg9GcpPvKIuHSZ/aE1g2ecGL74upMzGZjiGEY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a h1:YIa/rzVqMEokBkPtydCkx1VLmv3An1Uw7w1P1m6EhOY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a h1:hqK4+jJZXCU4pW7jsAdGOVFIfLHQeV7LaizZKnZ84HI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf h1:OqdXDEakZCVtDiZTjcxfwbHPCT11ycCEsTKesBVKvyY=
+google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:mCr1K1c8kX+1iSBREvU3Juo11CB+QOEWxbRS01wWl5M=
+google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f h1:b1Ln/PG8orm0SsBbHZWke8dDp2lrCD4jSmfglFpTZbk=
+google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf h1:liao9UHurZLtiEwBgT9LMOnKYsHze6eA6w1KQCMVN2Q=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
index fb94df3..dce9227 100644
--- a/pkg/identity/ciprovider/principal.go
+++ b/pkg/identity/ciprovider/principal.go
@@ -53,12 +53,12 @@ func applyTemplateOrReplace(extValueTemplate string, tokenClaims map[string]stri
 	// default data provided by the yaml file.
 	// The order here matter because we want to override the claimed data
 	// with the default data.
-	// The default data will have priority over the claimed data.
+	// The claimed data will have priority over the default data.
 	mergedData := make(map[string]string)
-	for k, v := range tokenClaims {
+	for k, v := range issuerMetadata {
 		mergedData[k] = v
 	}
-	for k, v := range issuerMetadata {
+	for k, v := range tokenClaims {
 		mergedData[k] = v
 	}
 


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index e60b216..4e51d06 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -233,9 +233,12 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"ref_gitlab":            "main",
 		"ref_type_tag":          "tag",
 		"ref_tag":               "1.0.0",
+		"claim_foo":             "bar",
 	}
 	issuerMetadata := map[string]string{
-		"url": "https://github.com",
+		"url":         "https://github.com",
+		"claim_foo":   "default",
+		"default_foo": "default_bar",
 	}
 
 	tests := map[string]struct {
@@ -283,6 +286,21 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "refs/tags/1.0.0",
 			ExpectErr:      false,
 		},
+		`Raise error for empty key in comparison`: {
+			Template:       `{{if eq . ""}}foo{{else}}bar{{end}}`,
+			ExpectedResult: "",
+			ExpectErr:      true,
+		},
+		`Should use default when claim doesn't exist`: {
+			Template:       "default_foo",
+			ExpectedResult: "default_bar",
+			ExpectErr:      false,
+		},
+		`Should prior claims over defaults when they has the same name`: {
+			Template:       "claim_foo",
+			ExpectedResult: "bar",
+			ExpectErr:      false,
+		},
 	}
 
 	for name, test := range tests {