A job's identity: identity blocks name an audience and a mount path 720eb8191059

- **A job's identity (oxygenhub#103).** `identity "AUDIENCE" { mount-path "/run/secrets/…" }` asks the hub for an OIDC token for that audience, mounted as a file like a secret.

    // Identities as [audience, mount path] sorted by audience; absent when none.

    if !j.identities.is_empty() {

        fields.push((9, Value::Array(j.identities.iter().map(|i| Value::Array(vec![text(&i.audience), text(&i.mount_path)])).collect())));

    }

pub use pipeline::{Identity, Job, Mount, MountSource, Network, Pipeline, Problem, Problems, Runtime, Sandbox, Secret, PIPELINE_PATH};

    /// Identities the job asks the hub for (oxygenhub#103): an OIDC token

    /// for an audience, mounted as a file like a secret.

    #[serde(default, skip_serializing_if = "Vec::is_empty")]

    pub identities: Vec<Identity>,

/// An OIDC token the hub mints for the job (oxygenhub#103), naming the

/// repository, bookmark, run and job, for `audience`; read as a file.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

pub struct Identity {

    /// Who the token is for (`sts.amazonaws.com`, a Vault role's audience, …).

    pub audience: String,

    /// A clean absolute path under `/run/secrets/`, unique among the

    /// job's secrets and identities.

    pub mount_path: String,

}

/// The most identities a job may ask for.

pub const MAX_IDENTITIES: usize = 4;

    } else if job.secrets.iter().any(|s| s.mount_path == mount_path) || job.identities.iter().any(|i| i.mount_path == mount_path) {

        ctx.err(node.span(), format!("two files mount at {mount_path:?}"));

    }

}

/// `identity "sts.amazonaws.com" { mount-path "/run/secrets/aws-token" }`:

/// the hub mints an OIDC token for that audience and the runner mounts it

/// as a file (oxygenhub#103).

fn parse_identity(ctx: &mut Ctx, node: &KdlNode, job: &mut Job) {

    let Some(audience) = ctx.one_string(node) else {

        ctx.err(node.span(), "`identity` takes an audience and a block with mount-path");

        return;

    };

    let aud_ok = !audience.is_empty() && audience.len() <= 255 && !audience.chars().any(|c| c.is_whitespace() || c.is_control());

    if !aud_ok {

        ctx.err(node.span(), format!("identity audience {audience:?} must be 1 to 255 characters without spaces"));

        return;

    }

    let mut path = None;

    for c in block(ctx, node) {

        ctx.no_children(c);

        match c.name().value() {

            "mount-path" => match ctx.one_string(c) {

                Some(p) if secret_path_ok(&p) => path = Some(p),

                Some(p) => {

                    ctx.err(c.span(), format!("identity mount-path {p:?} must be an absolute path under /run/secrets/, without . or .."))

                }

                None => {}

            },

            other => ctx.err(c.span(), format!("unknown identity setting `{other}`")),

        }

    }

    let Some(mount_path) = path else {

        ctx.err(node.span(), format!("identity {audience:?} needs a mount-path"));

        return;

    };

    if job.identities.iter().any(|i| i.audience == audience) {

        ctx.err(node.span(), format!("identity {audience:?} is given twice"));

    } else if job.identities.iter().any(|i| i.mount_path == mount_path) || job.secrets.iter().any(|s| s.mount_path == mount_path) {

        ctx.err(node.span(), format!("two files mount at {mount_path:?}"));

    } else if job.identities.len() == MAX_IDENTITIES {

        ctx.err(node.span(), format!("a job has at most {MAX_IDENTITIES} identities"));

    } else {

        job.identities.push(Identity { audience, mount_path });

        identities: vec![],

        if key != "scope"

            && key != "depends-on"

            && key != "mount"

            && key != "secret"

            && key != "identity"

            && key != "runs-on"

            && !seen.insert(key.to_string())

        {

            "identity" => parse_identity(ctx, c, &mut job),

    job.identities.sort_by(|a, b| a.audience.cmp(&b.audience));

            "two files mount at",

fn identities_are_asked_for_by_audience_and_mount_like_secrets() {

    let plain = Pipeline::parse(&doc("job \"d\" {\n    sandbox \"alpine\"\n    exec \"deploy\"\n}\n")).unwrap();

    let p = Pipeline::parse(&doc(r#"job "d" {

    sandbox "alpine"

    identity "sts.amazonaws.com" {

        mount-path "/run/secrets/aws-token"

    }

    identity "https://vault.example" {

        mount-path "/run/secrets/vault-token"

    }

    secret "key" {

        mount-path "/run/secrets/key"

    }

    exec "deploy"

}"#))

    .unwrap();

    let d = &p.jobs["d"];

    assert_eq!(

        d.identities.iter().map(|i| i.audience.as_str()).collect::<Vec<_>>(),

        ["https://vault.example", "sts.amazonaws.com"],

        "sorted"

    );

    assert_ne!(p.hash(), plain.hash(), "identities are part of the job");

    for (bad, why) in [

        ("identity \"a b\" {\n    mount-path \"/run/secrets/x\"\n}", "without spaces"),

        ("identity \"a\" {\n    mount-path \"/tmp/x\"\n}", "under /run/secrets/"),

        ("identity \"a\" {\n}", "needs a mount-path"),

        ("identity \"a\" {\n    mount-path \"/run/secrets/x\"\n}\nidentity \"a\" {\n    mount-path \"/run/secrets/y\"\n}", "given twice"),

        (

            "identity \"a\" {\n    mount-path \"/run/secrets/x\"\n}\nsecret \"s\" {\n    mount-path \"/run/secrets/x\"\n}",

            "two files mount at",

        ),

    ] {

        let e = Pipeline::parse(&doc(&format!("job \"d\" {{\n    sandbox \"alpine\"\n    {bad}\n    exec \"deploy\"\n}}\n"))).unwrap_err();

        assert!(e.to_string().contains(why), "{bad}: {e}");

    }

}

#[test]

        // Identities come from a hub: a local run has none.

        for i in &job.identities {

            println!("── {}: identity {:?} is not available locally; {} will be missing", job.name, i.audience, i.mount_path);

        }

            identities: vec![],

- `identity "sts.amazonaws.com" { mount-path "/run/secrets/aws-token" }` on

  a job (up to 4) asks the hub for an OIDC token for that audience, naming

  the repository, bookmark, run and job (OxygenHub spec §13.5,

  oxygenhub#103); it comes with the claim and is mounted exactly as a

  secret is. A local run has no hub, so `flow run` says the file will be

  missing.