@actions/attest 1.3.0 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/oidc.js +18 -40
- package/lib/oidc.js.map +1 -1
- package/package.json +2 -4
package/lib/oidc.js
CHANGED
|
@@ -31,15 +31,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
|
|
31
31
|
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
32
32
|
});
|
|
33
33
|
};
|
|
34
|
-
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
35
|
-
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
36
|
-
};
|
|
37
34
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
38
35
|
exports.getIDTokenClaims = void 0;
|
|
39
36
|
const core_1 = require("@actions/core");
|
|
40
37
|
const http_client_1 = require("@actions/http-client");
|
|
41
|
-
const
|
|
42
|
-
const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
|
|
38
|
+
const jose = __importStar(require("jose"));
|
|
43
39
|
const OIDC_AUDIENCE = 'nobody';
|
|
44
40
|
const REQUIRED_CLAIMS = [
|
|
45
41
|
'iss',
|
|
@@ -69,43 +65,25 @@ const getIDTokenClaims = (issuer) => __awaiter(void 0, void 0, void 0, function*
|
|
|
69
65
|
exports.getIDTokenClaims = getIDTokenClaims;
|
|
70
66
|
const decodeOIDCToken = (token, issuer) => __awaiter(void 0, void 0, void 0, function* () {
|
|
71
67
|
// Verify and decode token
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
}
|
|
77
|
-
else if (!decoded || typeof decoded === 'string') {
|
|
78
|
-
reject(new Error('No decoded token'));
|
|
79
|
-
}
|
|
80
|
-
else {
|
|
81
|
-
resolve(decoded);
|
|
82
|
-
}
|
|
83
|
-
});
|
|
68
|
+
const jwks = jose.createLocalJWKSet(yield getJWKS(issuer));
|
|
69
|
+
const { payload } = yield jose.jwtVerify(token, jwks, {
|
|
70
|
+
audience: OIDC_AUDIENCE,
|
|
71
|
+
issuer
|
|
84
72
|
});
|
|
73
|
+
return payload;
|
|
74
|
+
});
|
|
75
|
+
const getJWKS = (issuer) => __awaiter(void 0, void 0, void 0, function* () {
|
|
76
|
+
const client = new http_client_1.HttpClient('@actions/attest');
|
|
77
|
+
const config = yield client.getJson(`${issuer}/.well-known/openid-configuration`);
|
|
78
|
+
if (!config.result) {
|
|
79
|
+
throw new Error('No OpenID configuration found');
|
|
80
|
+
}
|
|
81
|
+
const jwks = yield client.getJson(config.result.jwks_uri);
|
|
82
|
+
if (!jwks.result) {
|
|
83
|
+
throw new Error('No JWKS found for issuer');
|
|
84
|
+
}
|
|
85
|
+
return jwks.result;
|
|
85
86
|
});
|
|
86
|
-
// Returns a callback to locate the public key for the given JWT header. This
|
|
87
|
-
// involves two calls:
|
|
88
|
-
// 1. Fetch the OpenID configuration to get the JWKS URI.
|
|
89
|
-
// 2. Fetch the public key from the JWKS URI.
|
|
90
|
-
const getPublicKey = (issuer) => (header, callback) => {
|
|
91
|
-
// Look up the JWKS URI from the issuer's OpenID configuration
|
|
92
|
-
new http_client_1.HttpClient('actions/attest')
|
|
93
|
-
.getJson(`${issuer}/.well-known/openid-configuration`)
|
|
94
|
-
.then(data => {
|
|
95
|
-
if (!data.result) {
|
|
96
|
-
callback(new Error('No OpenID configuration found'));
|
|
97
|
-
}
|
|
98
|
-
else {
|
|
99
|
-
// Fetch the public key from the JWKS URI
|
|
100
|
-
(0, jwks_rsa_1.default)({ jwksUri: data.result.jwks_uri }).getSigningKey(header.kid, (err, key) => {
|
|
101
|
-
callback(err, key === null || key === void 0 ? void 0 : key.getPublicKey());
|
|
102
|
-
});
|
|
103
|
-
}
|
|
104
|
-
})
|
|
105
|
-
.catch(err => {
|
|
106
|
-
callback(err);
|
|
107
|
-
});
|
|
108
|
-
};
|
|
109
87
|
function assertClaimSet(claims) {
|
|
110
88
|
const missingClaims = [];
|
|
111
89
|
for (const claim of REQUIRED_CLAIMS) {
|
package/lib/oidc.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAwC;AACxC,sDAA+C;AAC/C,2CAA4B;AAE5B,MAAM,aAAa,GAAG,QAAQ,CAAA;AAE9B,MAAM,eAAe,GAAG;IACtB,KAAK;IACL,KAAK;IACL,KAAK;IACL,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,oBAAoB;IACpB,QAAQ;IACR,aAAa;CACL,CAAA;AAQH,MAAM,gBAAgB,GAAG,CAAO,MAAc,EAAqB,EAAE;IAC1E,IAAI;QACF,MAAM,KAAK,GAAG,MAAM,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACnD,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,OAAO,MAAM,CAAA;KACd;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;KAC5D;AACH,CAAC,CAAA,CAAA;AATY,QAAA,gBAAgB,oBAS5B;AAED,MAAM,eAAe,GAAG,CACtB,KAAa,EACb,MAAc,EACY,EAAE;IAC5B,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1D,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,QAAQ,EAAE,aAAa;QACvB,MAAM;KACP,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA,CAAA;AAED,MAAM,OAAO,GAAG,CAAO,MAAc,EAA+B,EAAE;IACpE,MAAM,MAAM,GAAG,IAAI,wBAAU,CAAC,iBAAiB,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CACjC,GAAG,MAAM,mCAAmC,CAC7C,CAAA;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;KACjD;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAqB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE7E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;KAC5C;IAED,OAAO,IAAI,CAAC,MAAM,CAAA;AACpB,CAAC,CAAA,CAAA;AAED,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,aAAa,GAAa,EAAE,CAAA;IAElC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE;YACtB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;SAC1B;KACF;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAC/D;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@actions/attest",
|
|
3
|
-
"version": "1.3.
|
|
3
|
+
"version": "1.3.1",
|
|
4
4
|
"description": "Actions attestation lib",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"github",
|
|
@@ -38,7 +38,6 @@
|
|
|
38
38
|
"@sigstore/mock": "^0.7.4",
|
|
39
39
|
"@sigstore/rekor-types": "^2.0.0",
|
|
40
40
|
"@types/jsonwebtoken": "^9.0.6",
|
|
41
|
-
"jose": "^5.2.3",
|
|
42
41
|
"nock": "^13.5.1",
|
|
43
42
|
"undici": "^5.28.4"
|
|
44
43
|
},
|
|
@@ -49,8 +48,7 @@
|
|
|
49
48
|
"@octokit/plugin-retry": "^6.0.1",
|
|
50
49
|
"@sigstore/bundle": "^2.3.2",
|
|
51
50
|
"@sigstore/sign": "^2.3.2",
|
|
52
|
-
"
|
|
53
|
-
"jwks-rsa": "^3.1.0"
|
|
51
|
+
"jose": "^5.2.3"
|
|
54
52
|
},
|
|
55
53
|
"overrides": {
|
|
56
54
|
"@octokit/plugin-retry": {
|