Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

oidc-exchange: fix padding #177

Merged
merged 1 commit into from Aug 10, 2023
Merged

Conversation

woodruffw
Copy link
Member

JWT payloads aren't padded; this recomputes the padding.

Fixes the crash in #173 (comment).

Signed-off-by: William Woodruff <william@trailofbits.com>
@webknjaz webknjaz merged commit b7f401d into pypa:unstable/v1 Aug 10, 2023
2 checks passed
renovate bot added a commit to allenporter/pyrainbird that referenced this pull request Aug 12, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.8` -> `v1.8.10` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.8.10`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.10)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.9...v1.8.10)

#### 🐛 What's Fixed

[@&#8203;woodruffw](https://togithub.com/woodruffw) fixed decoding OIDC
claims in debug output on failure by applying correct padding to the
encoded payload via
[pypa/gh-action-pypi-publish#177.

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.9...v1.8.10

###
[`v1.8.9`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.9)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.8...v1.8.9)

#### 💅 Cosmetic output improvements

- [@&#8203;woodruffw](https://togithub.com/woodruffw) added debug output
to the trusted publishing OIDC exchange on failures in
[pypa/gh-action-pypi-publish#174
- [@&#8203;woodruffw](https://togithub.com/woodruffw) implemented
Markdown semantic callouts in README via
[pypa/gh-action-pypi-publish#175

#### 🛠️ Internal dependencies

- Certifi was bumped from 2023.5.7 to 2023.7.22
@&#[pypa/gh-action-pypi-publish#171
- Cryptography was bumped from 41.0.2 to 41.0.3
@&#[pypa/gh-action-pypi-publish#172

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.8...v1.8.9

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/allenporter/pyrainbird).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40MC4zIiwidXBkYXRlZEluVmVyIjoiMzYuNDAuMyIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate bot added a commit to allenporter/flux-local that referenced this pull request Aug 12, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.8` -> `v1.8.10` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.8.10`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.10)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.9...v1.8.10)

#### 🐛 What's Fixed

[@&#8203;woodruffw](https://togithub.com/woodruffw) fixed decoding OIDC
claims in debug output on failure by applying correct padding to the
encoded payload via
[pypa/gh-action-pypi-publish#177.

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.9...v1.8.10

###
[`v1.8.9`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.9)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.8...v1.8.9)

#### 💅 Cosmetic output improvements

- [@&#8203;woodruffw](https://togithub.com/woodruffw) added debug output
to the trusted publishing OIDC exchange on failures in
[pypa/gh-action-pypi-publish#174
- [@&#8203;woodruffw](https://togithub.com/woodruffw) implemented
Markdown semantic callouts in README via
[pypa/gh-action-pypi-publish#175

#### 🛠️ Internal dependencies

- Certifi was bumped from 2023.5.7 to 2023.7.22
@&#[pypa/gh-action-pypi-publish#171
- Cryptography was bumped from 41.0.2 to 41.0.3
@&#[pypa/gh-action-pypi-publish#172

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.8...v1.8.9

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/allenporter/flux-local).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40MC4zIiwidXBkYXRlZEluVmVyIjoiMzYuNDAuMyIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
michaelkedar pushed a commit to google/osv.dev that referenced this pull request Sep 11, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://togithub.com/actions/checkout) | action |
minor | `v3.5.3` -> `v3.6.0` |
|
[actions/upload-artifact](https://togithub.com/actions/upload-artifact)
| action | patch | `v3.1.2` -> `v3.1.3` |
| gaurav-nelson/github-action-markdown-link-check | action | digest |
`46e4421` -> `a996638` |
| [github/codeql-action](https://togithub.com/github/codeql-action) |
action | minor | `v2.20.1` -> `v2.21.5` |
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.8` -> `v1.8.10` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

###
[`v3.6.0`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v360)

[Compare
Source](https://togithub.com/actions/checkout/compare/v3.5.3...v3.6.0)

- [Fix: Mark test scripts with Bash'isms to be run via
Bash](https://togithub.com/actions/checkout/pull/1377)
- [Add option to fetch tags even if fetch-depth >
0](https://togithub.com/actions/checkout/pull/579)

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v3.1.3`](https://togithub.com/actions/upload-artifact/releases/tag/v3.1.3)

[Compare
Source](https://togithub.com/actions/upload-artifact/compare/v3.1.2...v3.1.3)

#### What's Changed

- chore(github): remove trailing whitespaces by
[@&#8203;ljmf00](https://togithub.com/ljmf00) in
[actions/upload-artifact#313
- Bump [@&#8203;actions/artifact](https://togithub.com/actions/artifact)
version to v1.1.2 by
[@&#8203;bethanyj28](https://togithub.com/bethanyj28) in
[actions/upload-artifact#436

**Full Changelog**:
actions/upload-artifact@v3...v3.1.3

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v2.21.5`](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5)

###
[`v2.21.4`](https://togithub.com/github/codeql-action/compare/v2.21.3...v2.21.4)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.21.3...v2.21.4)

###
[`v2.21.3`](https://togithub.com/github/codeql-action/compare/v2.21.2...v2.21.3)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.21.2...v2.21.3)

###
[`v2.21.2`](https://togithub.com/github/codeql-action/compare/v2.21.1...v2.21.2)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.21.1...v2.21.2)

###
[`v2.21.1`](https://togithub.com/github/codeql-action/compare/v2.21.0...v2.21.1)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.21.0...v2.21.1)

###
[`v2.21.0`](https://togithub.com/github/codeql-action/compare/v2.20.4...v2.21.0)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.20.4...v2.21.0)

###
[`v2.20.4`](https://togithub.com/github/codeql-action/compare/v2.20.3...v2.20.4)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.20.3...v2.20.4)

###
[`v2.20.3`](https://togithub.com/github/codeql-action/compare/v2.20.2...v2.20.3)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.20.2...v2.20.3)

###
[`v2.20.2`](https://togithub.com/github/codeql-action/compare/v2.20.1...v2.20.2)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.20.1...v2.20.2)

</details>

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.8.10`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.10)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.9...v1.8.10)

#### 🐛 What's Fixed

[@&#8203;woodruffw](https://togithub.com/woodruffw) fixed decoding OIDC
claims in debug output on failure by applying correct padding to the
encoded payload via
[pypa/gh-action-pypi-publish#177.

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.9...v1.8.10

###
[`v1.8.9`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.9)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.8...v1.8.9)

#### 💅 Cosmetic output improvements

- [@&#8203;woodruffw](https://togithub.com/woodruffw) added debug output
to the trusted publishing OIDC exchange on failures in
[pypa/gh-action-pypi-publish#174
- [@&#8203;woodruffw](https://togithub.com/woodruffw) implemented
Markdown semantic callouts in README via
[pypa/gh-action-pypi-publish#175

#### 🛠️ Internal dependencies

- Certifi was bumped from 2023.5.7 to 2023.7.22
@&#[pypa/gh-action-pypi-publish#171
- Cryptography was bumped from 41.0.2 to 41.0.3
@&#[pypa/gh-action-pypi-publish#172

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.8...v1.8.9

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on wednesday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi42OC4xIiwidXBkYXRlZEluVmVyIjoiMzYuODMuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants