github.com/yogeshkumararora/slsa-github-generator@v1.10.1-0.20240520161934-11278bd5afb4/github/oidc.go

// Copyright 2022 SLSA Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package github

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"os"
	"sort"
	"time"

	"github.com/coreos/go-oidc/v3/oidc"
)

var defaultActionsProviderURL = "https://token.actions.githubusercontent.com"

const (
	requestTokenEnvKey = "ACTIONS_ID_TOKEN_REQUEST_TOKEN"
	requestURLEnvKey   = "ACTIONS_ID_TOKEN_REQUEST_URL"
)

// OIDCToken represents the contents of a GitHub OIDC JWT token.
type OIDCToken struct {
	// Issuer is the token issuer.
	Issuer string

	// JobWorkflowRef is a reference to the current job workflow.
	JobWorkflowRef string `json:"job_workflow_ref"`

	// RepositoryID is the unique repository ID.
	RepositoryID string `json:"repository_id"`

	// RepositoryOwnerID is the unique ID of the owner of the repository.
	RepositoryOwnerID string `json:"repository_owner_id"`

	// ActorID is the unique ID of the actor who triggered the build.
	ActorID string `json:"actor_id"`

	// Expiry is the expiration date of the token.
	Expiry time.Time

	// Audience is the audience for which the token was granted.
	Audience []string
}

var (
	// errURLError indicates the OIDC server URL is invalid.
	errURLError = errors.New("url")

	// errRequestError indicates an error requesting the token from the issuer.
	errRequestError = errors.New("http request")

	// errToken indicates an error in the format of the token.
	errToken = errors.New("token")

	// errClaims indicates an error in the claims of the token.
	errClaims = errors.New("claims")

	// errVerify indicates an error in the token verification process.
	errVerify = errors.New("verify")
)

// OIDCClient is a client for the GitHub OIDC provider.
type OIDCClient struct {
	// requestURL is the GitHub URL to request a OIDC token.
	requestURL *url.URL

	// verifierFunc is a factory to generate an oidc.IDTokenVerifier for token verification.
	// This is used for tests.
	verifierFunc func(context.Context) (*oidc.IDTokenVerifier, error)

	// bearerToken is used to request an ID token.
	bearerToken string
}

// NewOIDCClient returns new GitHub OIDC provider client.
func NewOIDCClient() (*OIDCClient, error) {
	requestURL := os.Getenv(requestURLEnvKey)
	parsedURL, err := url.ParseRequestURI(requestURL)
	if err != nil {
		return nil, fmt.Errorf(
			"%w: invalid request URL %q: %w; does your workflow have `id-token: write` scope?",
			errURLError,
			requestURL, err,
		)
	}

	c := OIDCClient{
		requestURL:  parsedURL,
		bearerToken: os.Getenv(requestTokenEnvKey),
	}
	c.verifierFunc = func(ctx context.Context) (*oidc.IDTokenVerifier, error) {
		provider, err := oidc.NewProvider(ctx, defaultActionsProviderURL)
		if err != nil {
			return nil, err
		}
		return provider.Verifier(&oidc.Config{
			// NOTE: Disable ClientID check.
			// ClientID is normally checked to be part of the audience but we
			// don't use a ClientID when requesting a token.
			SkipClientIDCheck: true,
		}), nil
	}
	return &c, nil
}

func (c *OIDCClient) newRequestURL(audience []string) string {
	requestURL := *c.requestURL
	q := requestURL.Query()
	for _, a := range audience {
		q.Add("audience", a)
	}
	requestURL.RawQuery = q.Encode()
	return requestURL.String()
}

func (c *OIDCClient) requestToken(ctx context.Context, audience []string) ([]byte, error) {
	// Request the token.
	req, err := http.NewRequest("GET", c.newRequestURL(audience), nil)
	if err != nil {
		return nil, fmt.Errorf("%w: creating request: %w", errRequestError, err)
	}
	req.Header.Add("Authorization", "bearer "+c.bearerToken)
	req = req.WithContext(ctx)
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("%w: %w", errRequestError, err)
	}
	defer resp.Body.Close()

	// Read the response.
	b, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("%w: reading response: %w", errRequestError, err)
	}
	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		return nil, fmt.Errorf("%w: response: %s: %s", errRequestError, resp.Status, string(b))
	}
	return b, nil
}

func (c *OIDCClient) decodePayload(b []byte) (string, error) {
	// Extract the raw token from JSON payload.
	var payload struct {
		Value string `json:"value"`
	}
	decoder := json.NewDecoder(bytes.NewReader(b))
	if err := decoder.Decode(&payload); err != nil {
		return "", fmt.Errorf("%w: parsing JSON: %w", errToken, err)
	}
	return payload.Value, nil
}

// verifyToken verifies the token contents and signature.
func (c *OIDCClient) verifyToken(ctx context.Context, audience []string, payload string) (*oidc.IDToken, error) {
	// Verify the token.
	verifier, err := c.verifierFunc(ctx)
	if err != nil {
		return nil, fmt.Errorf("%w: creating verifier: %w", errVerify, err)
	}

	t, err := verifier.Verify(ctx, payload)
	if err != nil {
		return nil, fmt.Errorf("%w: could not verify token: %w", errVerify, err)
	}

	// Verify the audience received is the one we requested.
	if !compareStringSlice(audience, t.Audience) {
		return nil, fmt.Errorf("%w: audience not equal %q != %q", errVerify, audience, t.Audience)
	}

	return t, nil
}

func (c *OIDCClient) decodeToken(token *oidc.IDToken) (*OIDCToken, error) {
	var t OIDCToken
	t.Issuer = token.Issuer
	t.Audience = token.Audience
	t.Expiry = token.Expiry

	if err := token.Claims(&t); err != nil {
		return nil, fmt.Errorf("%w: getting claims: %w", errToken, err)
	}

	return &t, nil
}

func (c *OIDCClient) verifyClaims(token *OIDCToken) error {
	// Verify some of the fields we expect to populate the provenance.
	if token.RepositoryID == "" {
		return fmt.Errorf("%w: repository ID is empty", errClaims)
	}
	if token.RepositoryOwnerID == "" {
		return fmt.Errorf("%w: repository owner ID is empty", errClaims)
	}
	if token.ActorID == "" {
		return fmt.Errorf("%w: actor ID is empty", errClaims)
	}
	if token.JobWorkflowRef == "" {
		return fmt.Errorf("%w: job workflow ref is empty", errClaims)
	}
	return nil
}

// Token requests an OIDC token from GitHub's provider, verifies it, and
// returns the token.
func (c *OIDCClient) Token(ctx context.Context, audience []string) (*OIDCToken, error) {
	tokenBytes, err := c.requestToken(ctx, audience)
	if err != nil {
		return nil, err
	}

	tokenPayload, err := c.decodePayload(tokenBytes)
	if err != nil {
		return nil, err
	}

	t, err := c.verifyToken(ctx, audience, tokenPayload)
	if err != nil {
		return nil, err
	}

	token, err := c.decodeToken(t)
	if err != nil {
		return nil, err
	}

	if err := c.verifyClaims(token); err != nil {
		return nil, err
	}

	return token, nil
}

func compareStringSlice(s1, s2 []string) bool {
	// Verify the audience received is the one we requested.
	if len(s1) != len(s2) {
		return false
	}

	c1 := append([]string{}, s1...)
	sort.Strings(c1)

	c2 := append([]string{}, s2...)
	sort.Strings(c2)

	for i := range c1 {
		if c1[i] != c2[i] {
			return false
		}
	}

	return true
}