forked from mirrors/forgejo
feat: expose immutable identifiers in Forgejo Actions JWTs (#12355)
Protect OIDC tokens generated by Forgejo Actions from threats arising when users or repositories are renamed or deleted, freeing their names up for reuse by another user. In this threat environment, relying on the name of users and repositories in validating JWT claims is unsafe because they can change. Adds three new claims to Actions' OIDC tokens: - `actor_id` -- the immutable identifier of the actor who triggered an Action run - `repository_id` -- the immutable identifier of the repository on which the Action is running - `repository_owner_id` -- the immutable identifier of the owner of the repository on which the Action is running Repositories will change their subject (`sub`) OIDC claims to include these immutable identifiers. Existing repositories will not change, in order to maintain compatibility with existing JWT usage. The new format will be applied to new repositories, or can be applied by disabling and enabling the Actions unit. The new format embeds the identifiers: - **Existing repos:** `repo:my-org/my-repo:ref:refs/heads/main` - **New repos:** `repo:my-org-123456/my-repo-456789:ref:refs/heads/main` Fixes #12244. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - New fields will be added to documentation soon. - [ ] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12355 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
This commit is contained in:
Mathieu Fenniak
Mathieu Fenniak
parent
d63724ceab
commit
9b88e77c19
14 changed files with 394 additions and 105 deletions
|
|
@ -0,0 +1,68 @@
|
|||
// Copyright 2026 The Forgejo Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
package forgejo_migrations
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"forgejo.org/models/db"
|
||||
"forgejo.org/modules/json"
|
||||
"forgejo.org/modules/optional"
|
||||
|
||||
"xorm.io/builder"
|
||||
"xorm.io/xorm"
|
||||
)
|
||||
|
||||
func init() {
|
||||
registerMigration(&Migration{
|
||||
Description: "add OIDCSubjectFormat=legacy-forgejo-v15 to all existing repositories with actions enabled",
|
||||
Upgrade: setOIDCSubjectFormatLegacy15,
|
||||
})
|
||||
}
|
||||
|
||||
func setOIDCSubjectFormatLegacy15(x *xorm.Engine) error {
|
||||
type Type int
|
||||
const TypeActions Type = 10 // 10 Actions
|
||||
type ActionsConfig struct {
|
||||
DisabledWorkflows []string `json:",omitempty"`
|
||||
OIDCSubjectFormat string
|
||||
}
|
||||
type RepoUnit struct { //revive:disable-line:exported
|
||||
ID int64 `xorm:"pk"`
|
||||
Type Type `xorm:"INDEX(s)"`
|
||||
Config optional.Option[string] `xorm:"TEXT"`
|
||||
}
|
||||
|
||||
return db.Iterate(
|
||||
db.DefaultContext,
|
||||
builder.Eq{"type": TypeActions},
|
||||
func(ctx context.Context, unit *RepoUnit) error {
|
||||
has, config := unit.Config.Get()
|
||||
if !has {
|
||||
config = "{}"
|
||||
}
|
||||
var actionsConfig ActionsConfig
|
||||
if err := json.Unmarshal([]byte(config), &actionsConfig); err != nil {
|
||||
return fmt.Errorf("failed to parse Actions config %q: %w", config, err)
|
||||
}
|
||||
|
||||
actionsConfig.OIDCSubjectFormat = "legacy-forgejo-v15"
|
||||
|
||||
configBytes, err := json.Marshal(actionsConfig)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to convert Actions config to JSON: %w", err)
|
||||
}
|
||||
r, err := db.GetEngine(ctx).
|
||||
ID(unit.ID).
|
||||
Cols("config").
|
||||
Update(&RepoUnit{Config: optional.Some(string(configBytes))})
|
||||
if err != nil {
|
||||
return err
|
||||
} else if r != 1 {
|
||||
return fmt.Errorf("UPDATE expected to affect 1 row, but was %d", r)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
// Copyright 2026 The Forgejo Authors.
|
||||
// SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
package forgejo_migrations
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"forgejo.org/models/db"
|
||||
migration_tests "forgejo.org/models/gitea_migrations/test"
|
||||
"forgejo.org/modules/timeutil"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"xorm.io/xorm/convert"
|
||||
)
|
||||
|
||||
func Test_setOIDCSubjectFormatLegacy15(t *testing.T) {
|
||||
type Type int
|
||||
type UnitAccessMode int
|
||||
type RepoUnit struct { //revive:disable-line:exported
|
||||
ID int64
|
||||
RepoID int64 `xorm:"INDEX(s)"`
|
||||
Type Type `xorm:"INDEX(s)"`
|
||||
Config convert.Conversion `xorm:"TEXT"`
|
||||
CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED"`
|
||||
DefaultPermissions UnitAccessMode `xorm:"NOT NULL DEFAULT 0"`
|
||||
}
|
||||
x, deferable := migration_tests.PrepareTestEnv(t, 0, new(RepoUnit))
|
||||
defer deferable()
|
||||
if x == nil || t.Failed() {
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(t, setOIDCSubjectFormatLegacy15(x))
|
||||
|
||||
var records []map[string]string
|
||||
require.NoError(t,
|
||||
db.GetEngine(t.Context()).
|
||||
Table("repo_unit").
|
||||
Select("`id`, `repo_id`, `config`").
|
||||
OrderBy("`id`").
|
||||
Find(&records))
|
||||
assert.Equal(t, []map[string]string{
|
||||
{
|
||||
"config": "{\"OIDCSubjectFormat\":\"legacy-forgejo-v15\"}",
|
||||
"id": "1",
|
||||
"repo_id": "4",
|
||||
},
|
||||
{
|
||||
"config": "{\"DisabledWorkflows\":[\"renovate.yml\"],\"OIDCSubjectFormat\":\"legacy-forgejo-v15\"}",
|
||||
"id": "2",
|
||||
"repo_id": "5",
|
||||
},
|
||||
{
|
||||
"config": "",
|
||||
"id": "3",
|
||||
"repo_id": "6",
|
||||
},
|
||||
}, records)
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
- id: 1
|
||||
repo_id: 4
|
||||
type: 10 # actions
|
||||
# config - null
|
||||
created_unix: 1773518296
|
||||
- id: 2
|
||||
repo_id: 5
|
||||
type: 10 # actions
|
||||
config: '{"DisabledWorkflows":["renovate.yml"]}'
|
||||
created_unix: 1773518296
|
||||
- id: 3
|
||||
repo_id: 6
|
||||
type: 1 # code
|
||||
created_unix: 1773518296
|
||||
|
|
@ -220,8 +220,42 @@ func (cfg *PullRequestsConfig) GetDefaultUpdateStyle() UpdateStyle {
|
|||
return UpdateStyleMerge
|
||||
}
|
||||
|
||||
// Represents the current format for `sub` claim generation when using `enable-openid-connect: true` on an Action.
|
||||
//
|
||||
// We try to follow GitHub's format for the `sub` claim because it should allow third-party integrations, which may have
|
||||
// existing knowledge and code that works with GitHub's OIDC tokens, to reuse that knowledge and code in the future to
|
||||
// implement Forgejo support. As GitHub's format changes, we may implement those format changes to maintain that
|
||||
// familarity. Forgejo isn't required to do so, though -- if future changes from GitHub don't make sense for Forgejo,
|
||||
// or vice-versa, this format matching effort may be discarded.
|
||||
type OIDCSubjectFormat string
|
||||
|
||||
var (
|
||||
// Default is the current, most preferred method of generating an `sub` JWT claim for an Actions JWT token. It is
|
||||
// an empty string which allows [ActionsConfig] to always default to the current preferred default value for new
|
||||
// repositories. At present, it is a `sub` claim that contains information about the repository owner and
|
||||
// repository where the action occurred, their immutable identifiers (ID numbers), and the event that triggered the
|
||||
// Action.
|
||||
//
|
||||
// Immutable identifiers have been added since OIDCSubjectFormatLegacyForgejo15. The intent of adding them is to
|
||||
// protect resource servers which may be requiring a specific subject claim from having that claim be impersonated
|
||||
// when a user or repository are renamed or deleted. For example, if a JWT from my-org/my-repo is trusted, but then
|
||||
// my-org is deleted and a new user takes ownership of the name my-org, they should not be granted the same trust.
|
||||
//
|
||||
// Example: repo:my-org-123456/my-repo-456789:ref:refs/heads/main
|
||||
OIDCSubjectFormatDefault OIDCSubjectFormat // defaults to ""
|
||||
|
||||
// The `sub` JWT claim generation that was shipped in Forgejo 15. Contains information about the repository owner
|
||||
// and repository where the action occurred and the event that triggered the Action.
|
||||
//
|
||||
// Example: repo:my-org/my-repo:ref:refs/heads/main
|
||||
OIDCSubjectFormatLegacyForgejo15 OIDCSubjectFormat = "legacy-forgejo-v15"
|
||||
)
|
||||
|
||||
type ActionsConfig struct {
|
||||
DisabledWorkflows []string
|
||||
|
||||
// Format of the OIDC 'sub' claim that will be used when `enable-openid-connect` is true in an Action.
|
||||
OIDCSubjectFormat OIDCSubjectFormat `json:",omitempty"`
|
||||
}
|
||||
|
||||
func (cfg *ActionsConfig) EnableWorkflow(file string) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue