From c580dc05ad8090a1fe773e0d22d120bc9c36868f Mon Sep 17 00:00:00 2001
From: Edward Brough <1690260+ChevronTango@users.noreply.github.com>
Date: Fri, 19 May 2023 20:20:28 +0000
Subject: [PATCH] Adding Gitpod Provider

Signed-off-by: Edward Brough <1690260+ChevronTango@users.noreply.github.com>
---
 pkg/cosign/env/env.go          |  7 ++++++
 pkg/providers/gitpod/doc.go    | 18 +++++++++++++
 pkg/providers/gitpod/gitpod.go | 46 ++++++++++++++++++++++++++++++++++
 3 files changed, 71 insertions(+)
 create mode 100644 pkg/providers/gitpod/doc.go
 create mode 100644 pkg/providers/gitpod/gitpod.go

diff --git a/pkg/cosign/env/env.go b/pkg/cosign/env/env.go
index 599df2e0f4a..cfb6318f92f 100644
--- a/pkg/cosign/env/env.go
+++ b/pkg/cosign/env/env.go
@@ -62,6 +62,7 @@ const (
 	VariableGitHubToken               Variable = "GITHUB_TOKEN" //nolint:gosec
 	VariableGitHubRequestToken        Variable = "ACTIONS_ID_TOKEN_REQUEST_TOKEN"
 	VariableGitHubRequestURL          Variable = "ACTIONS_ID_TOKEN_REQUEST_URL"
+	VariableGitpodWorkspaceId         Variable = "GITPOD_WORKSPACE_ID"
 	VariableSPIFFEEndpointSocket      Variable = "SPIFFE_ENDPOINT_SOCKET"
 	VariableGoogleServiceAccountName  Variable = "GOOGLE_SERVICE_ACCOUNT_NAME"
 	VariableGitLabHost                Variable = "GITLAB_HOST"
@@ -151,6 +152,12 @@ var (
 			Sensitive:   false,
 			External:    true,
 		},
+		VariableGitpodWorkspaceId: {
+			Description: "is the ID of the workspace in Gitpod",
+			Expects:     "string with the ID of the Gitpod workspace",
+			Sensitive:   false,
+			External:    true,
+		},
 		VariableSPIFFEEndpointSocket: {
 			Description: "allows you to specify non-default SPIFFE socket to use.",
 			Expects:     "string with SPIFFE socket path",
diff --git a/pkg/providers/gitpod/doc.go b/pkg/providers/gitpod/doc.go
new file mode 100644
index 00000000000..ba42559e434
--- /dev/null
+++ b/pkg/providers/gitpod/doc.go
@@ -0,0 +1,18 @@
+//
+// Copyright 2021 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package gitpod defines an implementation of the providers.Interface
+// that reads identity tokens from the gitpod API within a workspace.
+package gitpod
diff --git a/pkg/providers/gitpod/gitpod.go b/pkg/providers/gitpod/gitpod.go
new file mode 100644
index 00000000000..9cc8e6e3f51
--- /dev/null
+++ b/pkg/providers/gitpod/gitpod.go
@@ -0,0 +1,46 @@
+//
+// Copyright 2021 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gitpod
+
+import (
+	"context"
+	"os/exec"
+
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/providers"
+)
+
+func init() {
+	providers.Register("filesystem", &gitpod{})
+}
+
+type gitpod struct{}
+
+var _ providers.Interface = (*gitpod)(nil)
+
+// Enabled implements providers.Interface
+func (ga *gitpod) Enabled(_ context.Context) bool {
+	return env.Getenv(env.VariableGitpodWorkspaceId) != ""
+}
+
+// Provide implements providers.Interface
+func (ga *gitpod) Provide(ctx context.Context, audience string) (string, error) {
+	token, err := exec.Command("gp idp token --audience " + audience).Output()
+	if err != nil {
+		return "", err
+	}
+	return string(token), nil
+}