Skip to content

Commit dc2efe5

Browse files
woodruffwwoodruffw
authored
Prep for 0.3.0 (#40)
* README: prep 0.3.0 Signed-off-by: William Woodruff <[email protected]> * requirements: sigstore==0.10.0 Signed-off-by: William Woodruff <[email protected]> * action: upgrade `sigstore` CLI usage Signed-off-by: William Woodruff <[email protected]> * README: tweak descriptions Signed-off-by: William Woodruff <[email protected]> * action: lintage Signed-off-by: William Woodruff <[email protected]> Signed-off-by: William Woodruff <[email protected]>
1 parent d161077 commit dc2efe5

File tree

3 files changed

+47
-42
lines changed

3 files changed

+47
-42
lines changed

‎README.md‎

Lines changed: 28 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ gh-action-sigstore-python
55
[![Self-test](https://github.com/sigstore/gh-action-sigstore-python/actions/workflows/selftest.yml/badge.svg)](https://github.com/sigstore/gh-action-sigstore-python/actions/workflows/selftest.yml)
66

77
A GitHub Action that uses [`sigstore-python`](https://github.com/sigstore/sigstore-python)
8-
to sign Python packages.
8+
to generate Sigstore signatures.
99

1010
## Index
1111

@@ -23,24 +23,22 @@ Simply add `sigstore/gh-action-sigstore-python` to one of your workflows:
2323
jobs:
2424
selftest:
2525
runs-on: ubuntu-latest
26+
permissions:
27+
id-token: write
2628
steps:
2729
- uses: actions/checkout@v3
2830
- name: install
2931
run: python -m pip install .
30-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
32+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
3133
with:
3234
inputs: file.txt
3335
```
3436
35-
Your workflow must have permission to request the OIDC token to authenticate with. This can be done
36-
by having a top-level `permission` setting for your workflow.
37+
Note: Your workflow **must** have permission to request the OIDC token to authenticate with.
38+
This can be done by setting `id-token: write` on your job (as above) or workflow.
3739

38-
```yaml
39-
permissions:
40-
id-token: write
41-
```
42-
43-
More information about permission settings can be found [here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings).
40+
More information about permission settings can be found
41+
[here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings).
4442

4543
## Configuration
4644

@@ -55,15 +53,15 @@ provided.
5553
To sign one or more files:
5654

5755
```yaml
58-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
56+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
5957
with:
6058
inputs: file0.txt file1.txt file2.txt
6159
```
6260

6361
The `inputs` argument also supports file globbing:
6462

6563
```yaml
66-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
64+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
6765
with:
6866
inputs: ./path/to/inputs/*.txt
6967
```
@@ -76,7 +74,7 @@ The `identity-token` setting controls the OpenID Connect token provided to Fulci
7674
workflow will use the credentials found in the GitHub Actions environment.
7775

7876
```yaml
79-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
77+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
8078
with:
8179
inputs: file.txt
8280
identity-token: ${{ IDENTITY_TOKEN }} # assigned elsewhere
@@ -92,7 +90,7 @@ Server during OAuth2.
9290
Example:
9391

9492
```yaml
95-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
93+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
9694
with:
9795
inputs: file.txt
9896
oidc-client-id: alternative-sigstore-id
@@ -108,7 +106,7 @@ Connect Server during OAuth2.
108106
Example:
109107

110108
```yaml
111-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
109+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
112110
with:
113111
inputs: file.txt
114112
oidc-client-secret: alternative-sigstore-secret
@@ -124,7 +122,7 @@ when signing multiple input files.
124122
Example:
125123

126124
```yaml
127-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
125+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
128126
with:
129127
inputs: file.txt
130128
signature: custom-signature-filename.sig
@@ -133,7 +131,7 @@ Example:
133131
However, this example is invalid:
134132

135133
```yaml
136-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
134+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
137135
with:
138136
inputs: file0.txt file1.txt file2.txt
139137
signature: custom-signature-filename.sig
@@ -149,7 +147,7 @@ work when signing multiple input files.
149147
Example:
150148

151149
```yaml
152-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
150+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
153151
with:
154152
inputs: file.txt
155153
certificate: custom-certificate-filename.crt
@@ -158,7 +156,7 @@ Example:
158156
However, this example is invalid:
159157

160158
```yaml
161-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
159+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
162160
with:
163161
inputs: file0.txt file1.txt file2.txt
164162
certificate: custom-certificate-filename.crt
@@ -174,7 +172,7 @@ from. This setting cannot be used in combination with the `staging` setting.
174172
Example:
175173

176174
```yaml
177-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
175+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
178176
with:
179177
inputs: file.txt
180178
fulcio-url: https://fulcio.sigstage.dev
@@ -190,7 +188,7 @@ cannot be used in combination with the `staging` setting.
190188
Example:
191189

192190
```yaml
193-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
191+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
194192
with:
195193
inputs: file.txt
196194
rekor-url: https://rekor.sigstage.dev
@@ -206,7 +204,7 @@ in combination with the `staging` setting.
206204
Example:
207205

208206
```yaml
209-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
207+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
210208
with:
211209
inputs: file.txt
212210
ctfe: ./path/to/ctfe.pub
@@ -222,7 +220,7 @@ be used in combination with `staging` setting.
222220
Example:
223221

224222
```yaml
225-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
223+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
226224
with:
227225
inputs: file.txt
228226
ctfe: ./path/to/rekor.pub
@@ -238,7 +236,7 @@ instead of the default production instances.
238236
Example:
239237

240238
```yaml
241-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
239+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
242240
with:
243241
inputs: file.txt
244242
staging: true
@@ -261,7 +259,7 @@ and `verify-oidc-issuer` settings. Failing to pass these will produce an error.
261259
Example:
262260

263261
```yaml
264-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
262+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
265263
with:
266264
inputs: file.txt
267265
verify: true
@@ -284,7 +282,7 @@ This setting may only be used in conjunction with `verify-oidc-issuer`.
284282
Supplying it without `verify-oidc-issuer` will produce an error.
285283

286284
```yaml
287-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
285+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
288286
with:
289287
inputs: file.txt
290288
verify: true
@@ -309,7 +307,7 @@ Supplying it without `verify-cert-identity` will produce an error.
309307
Example:
310308

311309
```yaml
312-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
310+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
313311
with:
314312
inputs: file.txt
315313
verify: true
@@ -331,7 +329,7 @@ workflow artifact retention period is used.
331329
Example:
332330

333331
```yaml
334-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
332+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
335333
with:
336334
inputs: file.txt
337335
upload-signing-artifacts: true
@@ -356,7 +354,7 @@ permissions:
356354
357355
# ...
358356
359-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
357+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
360358
with:
361359
inputs: file.txt
362360
release-signing-artifacts: true
@@ -383,7 +381,7 @@ permissions:
383381
Example:
384382

385383
```yaml
386-
- uses: sigstore/gh-action-sigstore-python@v0.2.0
384+
- uses: sigstore/gh-action-sigstore-python@v0.3.0
387385
with:
388386
inputs: file.txt
389387
internal-be-careful-debug: true

‎action.py‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -53,12 +53,20 @@ def _log(msg):
5353
print(msg, file=sys.stderr)
5454

5555

56-
def _sigstore_sign(*args):
57-
return ["python", "-m", "sigstore", "sign", *args]
56+
def _sigstore_sign(global_args, sign_args):
57+
return ["python", "-m", "sigstore", *global_args, "sign", *sign_args]
5858

5959

60-
def _sigstore_verify(*args):
61-
return ["python", "-m", "sigstore", "verify", *args]
60+
def _sigstore_verify(global_args, verify_args):
61+
return [
62+
"python",
63+
"-m",
64+
"sigstore",
65+
*global_args,
66+
"verify",
67+
"identity",
68+
*verify_args,
69+
]
6270

6371

6472
def _warning(msg):
@@ -73,6 +81,7 @@ def _fatal_help(msg):
7381
inputs = sys.argv[1].split()
7482

7583
# The arguments we pass into `sigstore-python` get built up in these lists.
84+
sigstore_global_args = []
7685
sigstore_sign_args = []
7786
sigstore_verify_args = []
7887

@@ -127,20 +136,18 @@ def _fatal_help(msg):
127136

128137
rekor_url = os.getenv("GHA_SIGSTORE_PYTHON_REKOR_URL")
129138
if rekor_url != "":
130-
sigstore_sign_args.extend(["--rekor-url", rekor_url])
131-
sigstore_verify_args.extend(["--rekor-url", rekor_url])
139+
sigstore_global_args.extend(["--rekor-url", rekor_url])
132140

133141
ctfe = os.getenv("GHA_SIGSTORE_PYTHON_CTFE")
134142
if ctfe != "":
135143
sigstore_sign_args.extend(["--ctfe", ctfe])
136144

137145
rekor_root_pubkey = os.getenv("GHA_SIGSTORE_PYTHON_REKOR_ROOT_PUBKEY")
138146
if rekor_root_pubkey != "":
139-
sigstore_sign_args.extend(["--rekor-root-pubkey", rekor_root_pubkey])
147+
sigstore_global_args.extend(["--rekor-root-pubkey", rekor_root_pubkey])
140148

141149
if os.getenv("GHA_SIGSTORE_PYTHON_STAGING", "false") != "false":
142-
sigstore_sign_args.append("--staging")
143-
sigstore_verify_args.append("--staging")
150+
sigstore_global_args.append("--staging")
144151

145152
verify_cert_identity = os.getenv("GHA_SIGSTORE_PYTHON_VERIFY_CERT_IDENTITY")
146153
if enable_verify and not verify_cert_identity:
@@ -180,7 +187,7 @@ def _fatal_help(msg):
180187
_debug(f"signing: sigstore-python {[str(a) for a in sigstore_sign_args]}")
181188

182189
sign_status = subprocess.run(
183-
_sigstore_sign(*sigstore_sign_args),
190+
_sigstore_sign(sigstore_global_args, sigstore_sign_args),
184191
text=True,
185192
stdout=subprocess.PIPE,
186193
stderr=subprocess.STDOUT,
@@ -199,7 +206,7 @@ def _fatal_help(msg):
199206
_debug(f"verifying: sigstore-python {[str(a) for a in sigstore_verify_args]}")
200207

201208
verify_status = subprocess.run(
202-
_sigstore_verify(*sigstore_verify_args),
209+
_sigstore_verify(sigstore_global_args, sigstore_verify_args),
203210
text=True,
204211
stdout=subprocess.PIPE,
205212
stderr=subprocess.STDOUT,

‎requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
sigstore==0.9.0
1+
sigstore==0.10.0

0 commit comments

Comments
 (0)