Repository navigation
refactor(oidc)!: explicit identity provider configuration - #243
Merged
Merged
Conversation
Callers should see which identity provider they authenticate against, and configuration types should be able to grow. - `OAuthConfig` fields are private. Build it with `OAuthConfig::new(auth_url, token_url)` and `with_client_id` / `with_scopes`, and read it with getters. - Rename `OAuthConfig::from_oidc_url` to `OAuthConfig::dex`: it appends Dex's `/auth` and `/token` paths and performs no OIDC discovery. - Remove `OAuthConfig::sigstore`, `OAuthClient::sigstore`, the built-in default OIDC URL and the `issuers` constants (`MICROSOFT` was not a valid issuer). - `get_identity_token` takes the issuer URL instead of an `Option` that silently defaulted to public-good. `get_identity_token_with_callback` and `get_identity_token_with_options` are removed in favour of `OAuthClient::new(config).auth(..)` / `auth_with_options(..)`. - `DefaultAuthCallback` derives `Debug`, `Clone`, `Copy` and `Default`, and documents that it uses stdin and stdout. BREAKING CHANGE: `OAuthConfig` fields are private and `from_oidc_url` is now `dex`; `OAuthConfig::sigstore`, `OAuthClient::sigstore`, `sigstore_oidc::issuers`, `get_identity_token_with_callback` and `get_identity_token_with_options` are removed; `get_identity_token` takes `&str`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Wolf Vollprecht <w.vollprecht@gmail.com>
baszalmstra
approved these changes
Sep 24, 2026
This was referenced Sep 24, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
1.0 API work, PR O-b in the plan (follows #239). Callers see which identity provider they authenticate against, and the config type can grow.
OAuthConfigfields are private. Build it withOAuthConfig::new(auth_url, token_url)pluswith_client_id/with_scopes, and read it with gettersOAuthConfig::from_oidc_url→OAuthConfig::dex: the old name implied OIDC discovery, but it appends Dex's/authand/tokenpaths (the layout ofoauth2.sigstore.dev/auth)OAuthConfig::sigstoreandOAuthClient::sigstoreissuers::*constants (MICROSOFTwasn't even a valid issuer)get_identity_tokentakes the issuer URL (&str) instead of anOptionthat silently fell back to public-good.get_identity_token_with_callback/_with_optionsare removed; useOAuthClient::new(config).auth(..)/auth_with_options(..)DefaultAuthCallbackderivesDebug,Clone,CopyandDefault, and documents that it reads stdin and writes stdoutThe
SigningContext::authenticate()flow from the #206 review builds on this in the sign PR (S-a).Validation
cargo clippy --workspace --all-targets --all-features -- -D warningscargo test -p sigstore-oidc -p sigstore-sign -p sigstore-fulcio --all-features(including doctests)cargo check -p sigstore-oidc --no-default-featuresSigned-off-by: Wolf Vollprecht w.vollprecht@gmail.com
🤖 Generated with Claude Code