Add --oidc-provider flag to specify which provider to use for ambient credentials

cmd/cosign/cli/attest.go

@@ -76,6 +76,7 @@ func Attest() *cobra.Command {
 				OIDCClientID:             o.OIDC.ClientID,
 				OIDCClientSecret:         oidcClientSecret,
 				OIDCRedirectURL:          o.OIDC.RedirectURL,
+				OIDCProvider:             o.OIDC.Provider,
 			}
 			for _, img := range args {
 				if err := attest.AttestCmd(cmd.Context(), ko, o.Registry, img, o.Cert, o.CertChain, o.NoUpload,

cmd/cosign/cli/fulcio/fulcio.go

@@ -124,9 +124,18 @@ func NewSigner(ctx context.Context, ko options.KeyOpts) (*Signer, error) {
 	}
 
 	idToken := ko.IDToken
+	var provider providers.Interface
 	// If token is not set in the options, get one from the provders
 	if idToken == "" && providers.Enabled(ctx) && !ko.OIDCDisableProviders {
-		idToken, err = providers.Provide(ctx, "sigstore")
+		if ko.OIDCProvider != "" {
+			provider, err = providers.ProvideFrom(ctx, ko.OIDCProvider)
+			if err != nil {
+				return nil, fmt.Errorf("getting provider: %w", err)
+			}
+			idToken, err = provider.Provide(ctx, "sigstore")
+		} else {
+			idToken, err = providers.Provide(ctx, "sigstore")
+		}
 		if err != nil {
 			return nil, fmt.Errorf("fetching ambient OIDC credentials: %w", err)
 		}

cmd/cosign/cli/options/key.go

@@ -29,7 +29,8 @@ type KeyOpts struct {
 	OIDCClientID         string
 	OIDCClientSecret     string
 	OIDCRedirectURL      string
-	OIDCDisableProviders bool // Disable OIDC credential providers in keyless signer
+	OIDCDisableProviders bool   // Disable OIDC credential providers in keyless signer
+	OIDCProvider         string // Specify which OIDC credential provider to use for keyless signer
 	BundlePath           string
 	// FulcioAuthFlow is the auth flow to use when authenticating against
 	// Fulcio. See https://pkg.go.dev/github.com/sigstore/cosign/cmd/cosign/cli/fulcio#pkg-constants

cmd/cosign/cli/options/oidc.go

@@ -32,6 +32,7 @@ type OIDCOptions struct {
 	ClientID                string
 	clientSecretFile        string
 	RedirectURL             string
+	Provider                string
 	DisableAmbientProviders bool
 }
 
@@ -67,6 +68,9 @@ func (o *OIDCOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.RedirectURL, "oidc-redirect-url", "",
 		"[EXPERIMENTAL] OIDC redirect URL (Optional). The default oidc-redirect-url is 'http://localhost:0/auth/callback'.")
 
+	cmd.Flags().StringVar(&o.Provider, "oidc-provider", "",
+		"[EXPERIMENTAL] Specify the provider to get the OIDC token from (Optional). If unset, all options will be tried. Options include: [spiffe, google, github, filesystem]")
+
 	cmd.Flags().BoolVar(&o.DisableAmbientProviders, "oidc-disable-ambient-providers", false,
 		"[EXPERIMENTAL] Disable ambient OIDC providers. When true, ambient credentials will not be read")
 }

cmd/cosign/cli/policy_init.go

@@ -188,6 +188,7 @@ func signPolicy() *cobra.Command {
 				OIDCClientID:             o.OIDC.ClientID,
 				OIDCClientSecret:         oidcClientSecret,
 				OIDCRedirectURL:          o.OIDC.RedirectURL,
+				OIDCProvider:             o.OIDC.Provider,
 			})
 			if err != nil {
 				return err

cmd/cosign/cli/sign.go

@@ -96,6 +96,7 @@ func Sign() *cobra.Command {
 				OIDCClientSecret:         oidcClientSecret,
 				OIDCRedirectURL:          o.OIDC.RedirectURL,
 				OIDCDisableProviders:     o.OIDC.DisableAmbientProviders,
+				OIDCProvider:             o.OIDC.Provider,
 			}
 			annotationsMap, err := o.AnnotationsMap()
 			if err != nil {