Add commit sha and trigger to github workflow

pkg/ca/googlecabeta/googleca.go

@@ -146,6 +146,28 @@ func githubWorkflowSubject(id string) *privatecapb.CertificateConfig_SubjectConf
 	}
 }
 
+func GithubWorkflowExtension(info challenges.WorkflowResult) []*privatecapb.X509Extension {
+	res := []*privatecapb.X509Extension{}
+	if info.Sha != "" {
+		res = append(res, &privatecapb.X509Extension{
+			ObjectId: &privatecapb.ObjectId{
+				ObjectIdPath: []int32{1, 3, 6, 1, 4, 1, 57264, 1, 2},
+			},
+			Value: []byte(info.Sha),
+		})
+	}
+
+	if info.Trigger != "" {
+		res = append(res, &privatecapb.X509Extension{
+			ObjectId: &privatecapb.ObjectId{
+				ObjectIdPath: []int32{1, 3, 6, 1, 4, 1, 57264, 1, 3},
+			},
+			Value: []byte(info.Trigger),
+		})
+	}
+	return res
+}
+
 func KubernetesSubject(id string) *privatecapb.CertificateConfig_SubjectConfig {
 	return &privatecapb.CertificateConfig_SubjectConfig{
 		SubjectAltName: &privatecapb.SubjectAltNames{
@@ -184,7 +206,7 @@ func (c *CertAuthorityService) CreateCertificate(ctx context.Context, subj *chal
 		return nil, ca.ValidationError(err)
 	}
 
-	extensions := IssuerExtension(subj.Issuer)
+	extensions := append(IssuerExtension(subj.Issuer), GithubWorkflowExtension(subj.WorkflowInfo)...)
 
 	req, err := Req(c.parent, privca, pubKeyBytes, extensions)
 	if err != nil {

pkg/ca/x509ca/x509ca.go

@@ -124,7 +124,7 @@ func (x *X509CA) CreateCertificateWithCA(certauth *X509CA, subject *challenges.C
 		}
 		cert.URIs = []*url.URL{k8sURI}
 	}
-	cert.ExtraExtensions = IssuerExtension(subject.Issuer)
+	cert.ExtraExtensions = append(IssuerExtension(subject.Issuer), GithubWorkflowExtension(subject.WorkflowInfo)...)
 
 	finalCertBytes, err := x509.CreateCertificate(rand.Reader, cert, certauth.RootCA, subject.PublicKey, certauth.PrivKey)
 	if err != nil {
@@ -134,6 +134,24 @@ func (x *X509CA) CreateCertificateWithCA(certauth *X509CA, subject *challenges.C
 	return ca.CreateCSCFromDER(subject, finalCertBytes, nil)
 }
 
+func GithubWorkflowExtension(info challenges.WorkflowResult) []pkix.Extension {
+	res := []pkix.Extension{}
+	if info.Sha != "" {
+		res = append(res, pkix.Extension{
+			Id:    asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 2},
+			Value: []byte(info.Sha),
+		})
+	}
+
+	if info.Trigger != "" {
+		res = append(res, pkix.Extension{
+			Id:    asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 3},
+			Value: []byte(info.Trigger),
+		})
+	}
+	return res
+}
+
 func IssuerExtension(issuer string) []pkix.Extension {
 	if issuer == "" {
 		return nil

pkg/challenges/challenges.go

@@ -40,11 +40,19 @@ const (
 	KubernetesValue
 )
 
+type WorkflowResult struct {
+	// Additional information associated with a Github Workflow
+	Trigger string
+	Sha     string
+}
+
 type ChallengeResult struct {
 	Issuer    string
 	TypeVal   ChallengeType
 	PublicKey crypto.PublicKey
 	Value     string
+	// Extra information, non-empty for a Github workflow
+	WorkflowInfo WorkflowResult
 }
 
 func CheckSignature(pub crypto.PublicKey, proof []byte, email string) error {
@@ -165,6 +173,11 @@ func GithubWorkflow(ctx context.Context, principal *oidc.IDToken, pubKey crypto.
 	if err != nil {
 		return nil, err
 	}
+	// Additional info
+	workflowInfo, err := workflowInfoFromIDToken(principal)
+	if err != nil {
+		return nil, err
+	}
 
 	// Check the proof
 	if err := CheckSignature(pubKey, challenge, principal.Subject); err != nil {
@@ -184,10 +197,11 @@ func GithubWorkflow(ctx context.Context, principal *oidc.IDToken, pubKey crypto.
 
 	// Now issue cert!
 	return &ChallengeResult{
-		Issuer:    issuer,
-		PublicKey: pubKey,
-		TypeVal:   GithubWorkflowValue,
-		Value:     workflowRef,
+		Issuer:       issuer,
+		PublicKey:    pubKey,
+		TypeVal:      GithubWorkflowValue,
+		Value:        workflowRef,
+		WorkflowInfo: workflowInfo,
 	}, nil
 }
 
@@ -240,6 +254,25 @@ func workflowFromIDToken(token *oidc.IDToken) (string, error) {
 	return "https://github.com/" + claims.JobWorkflowRef, nil
 }
 
+func workflowInfoFromIDToken(token *oidc.IDToken) (WorkflowResult, error) {
+	// Extract custom claims
+	var claims struct {
+		Sha     string `json:"sha"`
+		Trigger string `json:"event_name"`
+		// The other fields that are present here seem to depend on the type
+		// of workflow trigger that initiated the action.
+	}
+	if err := token.Claims(&claims); err != nil {
+		return WorkflowResult{}, err
+	}
+
+	// We use this in URIs, so it has to be a URI.
+	return WorkflowResult{
+		Trigger: claims.Trigger,
+		Sha:     claims.Sha,
+	}, nil
+}
+
 func isSpiffeIDAllowed(host, spiffeID string) bool {
 	// Strip spiffe://
 	name := strings.TrimPrefix(spiffeID, "spiffe://")
@@ -251,5 +284,4 @@ func isSpiffeIDAllowed(host, spiffeID string) bool {
 		return true
 	}
 	return strings.Contains(spiffeDomain, "."+host)
-
 }