cosign icon indicating copy to clipboard operation
cosign copied to clipboard

Published 20 hours ago • verified publisher icon sigstore

Add OIDC token verification to GitHub provider.

Open ianlewis opened this issue 3 years ago • 0 comments
trafficstars

The GitHub provider somewhat blindly requests tokens from the GitHub provider and returns them to the application. The provider should probably do some verification on the token to make sure it contains what is expected.

Some data that could be verified:

  • audience
  • issuer
  • expiry
  • signature

ianlewis avatar Jul 04 '22 03:07 ianlewis