Skip to content

Commit

Permalink
adding checks for gitpod tokens
Browse files Browse the repository at this point in the history
Signed-off-by: Edward Brough <[email protected]>
  • Loading branch information
ChevronTango committed Mar 15, 2024
1 parent 69d0c37 commit f46de86
Showing 1 changed file with 28 additions and 2 deletions.
30 changes: 28 additions & 2 deletions pkg/providers/gitpod/gitpod.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@
package gitpod

import (
"bytes"
"context"
"encoding/json"
"os/exec"

"github.com/sigstore/cosign/v2/pkg/cosign/env"
Expand All @@ -33,12 +35,36 @@ var _ providers.Interface = (*gitpod)(nil)

// Enabled implements providers.Interface
func (ga *gitpod) Enabled(_ context.Context) bool {
return env.Getenv(env.VariableGitpodWorkspaceId) != ""
// Check we are in a Gitpod Workspace
if env.Getenv(env.VariableGitpodWorkspaceId) != "" {

//Check we are able to generate tokens with a verified email address
output, err := exec.Command("gp", "idp", "token", "--audience", "example.org", "--decode").Output()
if err != nil {
return false
}

var token struct {
Payload *struct {
Email *string `json:"email"`
EmailVerified bool `json:"email_verified"`
} `json:"Payload"`
}
dec := json.NewDecoder(bytes.NewBuffer(output))
if err := dec.Decode(&token); err != nil {
return false
}

if token.Payload != nil {
return token.Payload.Email != nil && token.Payload.EmailVerified
}
}
return false
}

// Provide implements providers.Interface
func (ga *gitpod) Provide(ctx context.Context, audience string) (string, error) {
token, err := exec.Command("gp idp token --audience " + audience).Output()
token, err := exec.Command("gp", "idp", "token", "--audience", audience).Output()
if err != nil {
return "", err
}
Expand Down

0 comments on commit f46de86

Please sign in to comment.