fix(sign): use stub ASCII value in CSR subject to handle non-ASCII identities - #1714
Open
xovishnukosuri wants to merge 1 commit into
Open
xovishnukosuri wants to merge 1 commit into
xovishnukosuri wants to merge 1 commit into
Conversation
…entities Fulcio ignores the CSR subject field entirely and derives the certificate identity from the OIDC token directly. Embedding the actual identity claim in the CSR's EMAIL_ADDRESS attribute causes failures when the claim contains non-ASCII characters (e.g. emojis in GitHub Actions environment names), since the field is encoded as IA5String which only allows ASCII. Replace the identity value with a fixed stub "user@example.com" so that CSR construction succeeds regardless of the claim content. Fixes sigstore#1507 Signed-off-by: Vishnu Kosuri <xovishnukosuri@gmail.com>
woodruffw
requested changes
Mar 14, 2026
woodruffw
left a comment
woodruffw
left a comment
Member
There was a problem hiding this comment.
If the CSR subject is entirely ignored (I think you're right that it is), we should probably just send a CSR with a completely empty subject or with something very obviously ignored, like THIS_VALUE_IS_IGNORED, rather than a plausible looking email identity like user@example.com.
But separately: the fact that we're able to encode an invalid IA5String here strongly suggests a bug in PyCA Cryptography; PyCA Cryptography should either reject the CSR generation or switch to a UTF8String when the given value isn't representable as an IA5String. The latter probably wouldn't be standard though, so rejecting seems right.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1507.
When a GitHub Actions OIDC token has a
subclaim containing non-ASCII characters (e.g. an environment name with an emoji), the CSR built inSigner._signing_certembeds that value as theEMAIL_ADDRESSsubject attribute. Since that attribute is encoded as an IA5String (ASCII-only), this produces an invalid DER structure and Fulcio returns a 400.Per sigstore/fulcio#863, Fulcio ignores the CSR subject field entirely and derives the certificate identity from the OIDC token. So the subject value in the CSR has no effect on what Fulcio issues.
This PR replaces the identity claim in the CSR subject with the fixed stub
"user@example.com", which is always valid ASCII, making signing work regardless of what the identity claim contains.Changes
sigstore/sign.py: use"user@example.com"as the CSREMAIL_ADDRESSsubject instead ofself._identity_token._identitytest/unit/test_sign.py: add a regression test that constructs a signer with a non-ASCII emoji in the identity and verifies the CSR subject is the stub valueRelease Note
Fixed signing failure when the OIDC identity claim contains non-ASCII characters (e.g. emojis in GitHub Actions environment names). The CSR subject is now a fixed stub value since Fulcio does not use it.