Skip to content

Commit 1f1e295

Browse files
committed
bundle: Just use email OID regardless of actual value
Apparently Fulcio does not care about the CSR subject: just claim everything is an email. https://github.com/sigstore/fulcio/blob/main/fulcio.proto#L106 Signed-off-by: Jussi Kukkonen <[email protected]>
1 parent 912186f commit 1f1e295

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

src/bundle/sign.rs

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,12 +85,10 @@ impl<'ctx> SigningSession<'ctx> {
8585
fulcio: &FulcioClient,
8686
token: &IdentityToken,
8787
) -> SigstoreResult<(ecdsa::SigningKey<NistP256>, fulcio::CertificateResponse)> {
88+
// NOTE: Currently both email and machine identities get wrapped in a "email" OID.
89+
// Fulcio does not care about the content.
8890
let identity = match &token.identity {
89-
Identity::Sub(_) => {
90-
return Err(SigstoreError::IdentityTokenError(
91-
"Non-email identities are not yet supported".to_string(),
92-
))
93-
}
91+
Identity::Sub(identity) |
9492
Identity::Email(identity) => identity.as_str(),
9593
};
9694

0 commit comments

Comments
 (0)