Chainguard OIDC provider support about fulcio HOT 8 CLOSED

I like the idea of registering our own OID. Let’s say that’s the tentative plan, and we can iterate on expanding our cert stuff once we have got that registered.

If we find there is appetite for a standard set of OIDs for service principals later, then we can cross that bridge. 😁

from fulcio.

Just an update, waiting on two open PRs to be merged, then I'll cut a new Fulcio release and get this rolled out.

from fulcio.

👨‍🍳 💋 Works!

Thanks 🙏

I'll close this for now, and we can tackle custom OIDs incrementally once we're ready for those. Thanks again for your support here @haydentherapper

from fulcio.

I'll get the release out to prod momentarily!

from fulcio.

For adding more Sigstore OIDs, we'd want them to be generalizable and reused across providers, eg the OIDs added for CI providers. OIDs should be parsed and verifiable by all Sigstore clients, and from what you've described, these claims seem specific to your use case and so I'd assume only a Chainguard client would implement support for those OIDs.

I would rather have them encoded in the SAN, like what's done with the Kubernetes issuer, and parsed by your client. Another option would be specifying the claim values in OIDs under your control, as in not under 1.3.6.1.4.1.57264.

from fulcio.

@mattmoor the bug fix has been rolled out in staging, please give a test

from fulcio.

Prod release is out.

from fulcio.

Oops, forgot to include the new provider config..

from fulcio.