Create "Trusted Publishing" database tables #11062
+158
−13
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| drop table trustpub_configs_github; | ||
| drop table trustpub_tokens; | ||
| drop table trustpub_used_jtis; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| create table trustpub_configs_github | ||
| ( | ||
| id serial primary key, | ||
| created_at timestamptz not null default now(), | ||
| crate_id int not null references crates on delete cascade, | ||
| repository_owner varchar not null, | ||
| repository_owner_id int not null, | ||
| repository_name varchar not null, | ||
|
There was a problem hiding this comment. Should we also be tracking repository ID? There was a problem hiding this comment. we use the owner ID to protect against resurrection attacks, but I'm not sure if the same would apply for the repository ID. if the user recreates the repository with the same name, do we really want to break the publishing workflow because of it? aside from that, we might not be able to get the repository ID for private repositories, unless we use the auth token of a repository owner. that might work right now with GitHub being our only auth provider, but would cause some issues if that were to change eventually. |
||
| workflow_filename varchar not null, | ||
| environment varchar | ||
| ); | ||
|
|
||
| comment on table trustpub_configs_github is 'Trusted Publisher configuration for GitHub Actions'; | ||
| comment on column trustpub_configs_github.id is 'Unique identifier of the `trustpub_configs_github` row'; | ||
| comment on column trustpub_configs_github.created_at is 'Date and time when the configuration was created'; | ||
| comment on column trustpub_configs_github.crate_id is 'Unique identifier of the crate that this configuration is for'; | ||
| comment on column trustpub_configs_github.repository_owner is 'GitHub name of the user or organization that owns the repository'; | ||
| comment on column trustpub_configs_github.repository_owner_id is 'GitHub ID of the user or organization that owns the repository'; | ||
| comment on column trustpub_configs_github.repository_name is 'Name of the repository that this configuration is for'; | ||
| comment on column trustpub_configs_github.workflow_filename is 'Name of the workflow file inside the repository that will be used to publish the crate'; | ||
| comment on column trustpub_configs_github.environment is 'GitHub Actions environment that will be used to publish the crate (if `NULL` the environment is unrestricted)'; | ||
|
|
||
| ------------------------------------------------------------------------------- | ||
|
|
||
| create table trustpub_tokens | ||
| ( | ||
| id bigserial primary key, | ||
| created_at timestamptz not null default now(), | ||
| expires_at timestamptz not null, | ||
| hashed_token bytea not null, | ||
| crate_ids int[] not null | ||
| ); | ||
|
|
||
| comment on table trustpub_tokens is 'Temporary access tokens for Trusted Publishing'; | ||
| comment on column trustpub_tokens.id is 'Unique identifier of the `trustpub_tokens` row'; | ||
| comment on column trustpub_tokens.created_at is 'Date and time when the token was created'; | ||
| comment on column trustpub_tokens.expires_at is 'Date and time when the token will expire'; | ||
| comment on column trustpub_tokens.hashed_token is 'SHA256 hash of the token that can be used to publish the crate'; | ||
| comment on column trustpub_tokens.crate_ids is 'Unique identifiers of the crates that can be published using this token'; | ||
|
|
||
| create unique index trustpub_tokens_hashed_token_uindex | ||
| on trustpub_tokens (hashed_token); | ||
|
|
||
| ------------------------------------------------------------------------------- | ||
|
|
||
| create table trustpub_used_jtis | ||
| ( | ||
| id bigserial primary key, | ||
| jti varchar not null, | ||
| used_at timestamptz not null default now(), | ||
| expires_at timestamptz not null | ||
|
There was a problem hiding this comment. Do we need to track this? There was a problem hiding this comment. otherwise we wouldn't be able to clean up this table and it would grow forever. I was planning on having a background job that regularly deletes expired tokens and jtis. |
||
| ); | ||
|
|
||
| comment on table trustpub_used_jtis is 'Used JWT IDs to prevent token reuse in the Trusted Publishing flow'; | ||
| comment on column trustpub_used_jtis.id is 'Unique identifier of the `trustpub_used_jtis` row'; | ||
| comment on column trustpub_used_jtis.jti is 'JWT ID from the OIDC token'; | ||
| comment on column trustpub_used_jtis.used_at is 'Date and time when the JWT was used'; | ||
| comment on column trustpub_used_jtis.expires_at is 'Date and time when the JWT would expire'; | ||
|
|
||
| create unique index trustpub_used_jtis_jti_uindex | ||
| on trustpub_used_jtis (jti); | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is fine on a database level, but we will have to ensure that there's a reasonable path for multi-crate workspaces to be configured without necessarily having to do each one with many clicks in the UI.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
from what I can tell, PyPI requires you to set it up for each individual project too. let's start simple, this is what was agreed upon in the RFC.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we could open up the configuration creation for API tokens in the future and not just cookie auth, then those that want to automate it can do so without us having to make the web UI more complex for the simple use cases.