Print signing identity and issuer to stderr after signing#821
Print signing identity and issuer to stderr after signing#821arpitjain099 wants to merge 2 commits into
Conversation
wlynch
left a comment
wlynch
left a comment
There was a problem hiding this comment.
Thanks for the commit! One small comment.
| // String formats the signing identity as guidance for the verify command, | ||
| // pointing the user at the exact flag values to pass. | ||
| func (s SigningIdentity) String() string { | ||
| return fmt.Sprintf("gitsign: signed with identity %q (issuer %q)\ngitsign: to verify, run: gitsign verify --certificate-identity %q --certificate-oidc-issuer %q", |
There was a problem hiding this comment.
First line looks good, but the second feels somewhat verbose. I'd drop this or put it behind a flag so it's not shown by default.
There was a problem hiding this comment.
Bumping this gently since it's been a while. I dropped the second line back in June (4755721), so the output is now just the identity and issuer, which I think is what you were after.
No rush at all, but let me know if you'd like anything else changed here. Happy to rebase onto main too if that helps, the branch is a few commits behind now.
There was a problem hiding this comment.
Rebased onto main just now (98340df), so it's up to date and conflict-free. go build ./... and go test ./internal/... are both green on the rebased branch, including with the sigstore-go 1.2.0 bump that landed in the meantime.
Ready whenever you or another maintainer has a chance to take a look.
|
Dropped the second line (the full |
After a successful sign, gitsign now reports the certificate-identity and certificate-oidc-issuer recorded in the Fulcio certificate, along with a ready-to-run gitsign verify command. This addresses the common confusion where a user does not know which values to pass to the verify flags (for example that the GitHub issuer is https://github.com/login/oauth, and that the identity is the private email, not the privacy-sparing address). The message is written to TTYOut (a TTY, or stderr when no TTY is present) and never to stdout, so tools that parse gitsign's stdout signature output are unaffected. The identity is taken from the certificate subject alternative names and the issuer from the Fulcio OIDC issuer extension, the same sources the verify command reads back. Extraction is factored into internal. NewSigningIdentity with unit tests. Fixes sigstore#693 Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Per review, the second line (the full 'gitsign verify --certificate-identity ...' command) is verbose to show on every signing. Keep just the identity and issuer line; users who want the verify command can derive it from those values. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
4755721 to
98340df
Compare
2 participants
Summary
After a successful sign, gitsign now prints the
certificate-identityandcertificate-oidc-issuerthat were actually used, plus a ready-to-rungitsign verifycommand. This makes it obvious which values to pass to the verify flags.This is the narrower half of #693 (report-after-signing). It does not add a separate "inspect a commit" subcommand.
Fixes #693
Why
In v2,
gitsign verifyrequires--certificate-identityand--certificate-oidc-issuer, but it is not obvious which values to use. As the issue notes, the GitHub issuer ishttps://github.com/login/oauth(nothttps://github.com), and the identity is the user's private email rather than the privacy-sparing address. Surfacing both right after signing removes that guesswork.Output goes to stderr, not stdout
@adityasaky raised the concern about tools that parse gitsign's stdout after signing. To avoid breaking those, the new message is written to
TTYOut, which is a TTY when one is available and falls back to stderr otherwise, and never tos.Out.s.Out(stdout) still carries only the signature bytes, so machine parsers consuming gitsign's stdout are unaffected. This is the same stream the existing "tlog entry created with index" status line already uses.Example (stderr):
How identity and issuer are extracted
A small helper,
internal.NewSigningIdentity(cert), reads:cryptoutils.GetSubjectAlternateNames(joining multiple SANs so nothing is silently dropped), andcosign.CertExtensions{Cert: cert}.GetIssuer().These are the same sources
gitsign verifyalready reads back when it prints "Good signature from ...", so what is reported at sign time matches what verify expects.Tests
internal/utils_test.goadds table-driven unit tests for the extraction (email SAN, URI SAN, multiple SANs joined, and the empty cert) and for the formatted guidance string.go test ./internal/...passes;go vetandgofmtare clean.