Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Trusted publishing: prevent OIDC credential re-use #16254

Merged
merged 24 commits into from
Aug 12, 2024
Merged

Trusted publishing: prevent OIDC credential re-use #16254

merged 24 commits into from
Aug 12, 2024

Conversation

DarkaMaul
Copy link
Contributor

@DarkaMaul DarkaMaul commented Jul 10, 2024 •
edited
Loading

Fixes #16194

This PR uses a Redis cache to keep JWT token identifiers in memory until their expiration.
It then prevents reusing an already used JWT to mint a new OIDC token.

woodruffw
woodruffw reviewed Jul 10, 2024
View reviewed changes
DarkaMaul
DarkaMaul commented Jul 11, 2024
View reviewed changes
@DarkaMaul DarkaMaul marked this pull request as ready for review July 11, 2024 08:23
@DarkaMaul DarkaMaul requested a review from a team as a code owner July 11, 2024 08:23
woodruffw
woodruffw reviewed Jul 12, 2024
View reviewed changes
Copy link
Member

@woodruffw woodruffw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM overall, one last comment on deduping.

woodruffw
woodruffw reviewed Jul 15, 2024
View reviewed changes
woodruffw
woodruffw reviewed Jul 15, 2024
View reviewed changes
Copy link
Member

@woodruffw woodruffw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small suggestion, but otherwise this LGTM, thanks @DarkaMaul!

@woodruffw woodruffw requested a review from di July 15, 2024 14:21
woodruffw
woodruffw approved these changes Jul 22, 2024
View reviewed changes
Copy link
Member

@woodruffw woodruffw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you @DarkaMaul!

di
di reviewed Aug 7, 2024
View reviewed changes
di
di reviewed Aug 9, 2024
View reviewed changes
@DarkaMaul DarkaMaul mentioned this pull request Aug 12, 2024
Merged
@woodruffw woodruffw reopened this Aug 12, 2024
@woodruffw
Copy link
Member

(Premature close caused by GitHub being too clever with pattern matching on fix #XXX)

@di di enabled auto-merge (squash) August 12, 2024 15:04
@di di merged commit af9e88a into pypi:main Aug 12, 2024
17 checks passed
@di di deleted the dm/jti branch August 12, 2024 15:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@woodruffw woodruffw woodruffw approved these changes

@di di di approved these changes

Assignees

@DarkaMaul DarkaMaul

Labels
trusted-publishing
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Trusted publishing: prevent OIDC credential re-use
4 participants
@DarkaMaul @woodruffw @di @miketheman