Expand description
The sign-time half of the keyless CI exchange: validate the runner’s
OIDC token and turn it into a signature-covered OidcBinding.
The runner never holds an org key. It presents the token its CI platform
minted for the job; we validate it — signature against the issuer’s JWKS,
issuer, audience, expiry — and embed the verified, platform-normalized
claims in the attestation’s signed envelope. The org’s side of the
exchange happens at verify time: artifact verify --oidc-policy joins
these claims against the OIDC-subject policy the org pinned.
Constants§
- DEFAULT_
OIDC_ ISSUER - The default OIDC issuer when none is given: GitHub Actions, the platform the zero-secret CI story ships on first.
Functions§
- resolve_
oidc_ binding - Validate an OIDC token and return the verified binding to embed.