3 ms·
>GitHub now supports OIDC in their workflows. Each time a workflow is run, a runner can mint a unique JWT token from GitHub’s OIDC provider. The token contains
by aftbit 5y ago
>GitHub now supports OIDC in their workflows. Each time a workflow is run, a runner can mint a unique JWT token from GitHub’s OIDC provider. The token contains verifiable information of the workflow identity, including the caller repository, commit hash, trigger, and the current (reuseable) workflow path and reference.
Cool, so just emit that token along with your build artifacts. Anyone who trusts Github can then verify that it was signed by them, and there is no need for any of the CA nonsense.
- woodruffw 5y ago> Cool, so just emit that token along with your build artifacts. Anyone who trusts Github can then verify that it was signed by them, and there is no need for any of the CA nonsense. This works if you need to verify JWTs from relatively recent packages, but packaging has a long tail. There's no guarantee that GitHub is still publishing their expired JWK sets a decade after the last valid signature for them has gone out.