andrewmusselman opened a new issue, #1358: URL: https://github.com/apache/tooling-trusted-releases/issues/1358
### Summary The GitHub OIDC `jti` (JWT ID) claim is type-validated in `TrustedPublisherPayload` but never recorded as consumed. Within the JWT's validity window, the same token can be presented multiple times, each time minting a fresh project-scoped workflow SSH key. ### Details This component consumes GitHub-issued OIDC tokens. ASVS 6.7.2's uniqueness/anti-reuse intent maps onto the token's `jti` claim. Although `jti` is present and type-validated in `TrustedPublisherPayload`, no code path persists consumed `jti` values or otherwise enforces single-use semantics. **Data flow:** GitHub OIDC token (`jti` claim) → `verify_github_oidc` → `TrustedPublisherPayload` → `trusted_jwt` / `trusted_jwt_for_dist` → workflow SSH key minting (`add_workflow_key`) **Missing control:** No persisted set of consumed `jti` values (or equivalent single-use enforcement) exists between validation and expiry. An actor who obtains a still-valid GitHub OIDC token for an `apache/` repository with a registered trusted workflow can present it more than once within its validity window, each time minting a fresh project-scoped workflow SSH key. Impact is bounded because minted keys are project-scoped, carry a 20-minute TTL, and are administratively revocable. **Affected files:** - `atr/models/github.py` - `atr/db/interaction.py` **ASVS:** 6.7.2 (L3) ### Remediation Record consumed token identifiers until their expiry and reject reuse. For example: - Add a `ConsumedJti` table checked and inserted atomically in `validate_trusted_jwt`, pruning expired records periodically. - Alternatively, bind the exchange to a server-issued single-use nonce echoed in the token audience/subject where the OIDC provider supports it. ### Acceptance Criteria - [ ] Fixed - [ ] Test added — assert that a previously-consumed token is rejected on second presentation ### References - ASVS 6.7.2 - Source report: `6.7.2.md` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
