Attestation error

[davidbrochart]

I'm not sure what's going on, but I have an error using this GitHub action here:

  Traceback (most recent call last):
    File "/root/.local/lib/python3.13/site-packages/pypi_attestations/_impl.py", line 207, in sign
      bundle = signer.sign_dsse(stmt)
    File "/root/.local/lib/python3.13/site-packages/sigstore/sign.py", line 208, in sign_dsse
      cert = self._signing_cert()
    File "/root/.local/lib/python3.13/site-packages/sigstore/sign.py", line 125, in _signing_cert
      raise ExpiredIdentity
  sigstore.oidc.ExpiredIdentity
  During handling of the above exception, another exception occurred:
  Traceback (most recent call last):
    File "/app/attestations.py", line 152, in <module>
      main()
      ~~~~^^
    File "/app/attestations.py", line 148, in main
      attest_dist(dist_path, attestation_path, signer)
      ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/app/attestations.py", line 115, in attest_dist
      attestation = Attestation.sign(signer, dist)
    File "/root/.local/lib/python3.13/site-packages/pypi_attestations/_impl.py", line 209, in sign
      raise AttestationError(str(e))
  pypi_attestations._impl.AttestationError

Do you have any ideas?

[davidbrochart]

It seems that my OIDC token expired before I actually used it to request a signing certificate (see sigstore/sigstore-python#1729 (comment)), probably because the publish step took more than 15 minutes (there are a lot of wheels). Is there anything we can do to prevent that?

[webknjaz]

cc @woodruffw @facutuesca could you check this?

Also, cc @miketheman I don't see any suspicious recent commits in warehouse but tagging you just in case.

[webknjaz]

Wonder whether #360 would be helpful..

[webknjaz]

Looks like this is a duplicate of #307?

[davidbrochart]

Looks like this is a duplicate of #307?

It could be. What's strange is that last release was Jun 17, and it's the same publish workflow.

[facutuesca]

I think what's happening is that the GitHub OIDC token (which lasts 5 minutes) expired while the workflow was still signing artifacts using Sigstore:

What I'm not sure is why this started happening today, and didn't happen before

[webknjaz]

this started happening today

I think my co-maintainers noticed this in aiohttp two days ago, FTR.

[facutuesca]

This should fix it in sigstore-python: sigstore/sigstore-python#1838

Once a new release is cut, we can update pypi-attestations, make a new release of that, and then update this action.

[Dreamsorcerer]

What I'm not sure is why this started happening today, and didn't happen before

Tokens used to be atleast 10 mins, evidently sometime in the last few weeks GH has reduced them to 5 mins.

[miketheman]

What I'm not sure is why this started happening today, and didn't happen before

Tokens used to be atleast 10 mins, evidently sometime in the last few weeks GH has reduced them to 5 mins.

I found older references, do you have other evidence that this is recent?

[Dreamsorcerer]

I found older references, do you have other evidence that this is recent?

You just linked to my comment, if that was supposed to link to other references... Our release workflow typically takes 5-7 mins. The workflow still worked on Jun 7th with a 7 min run. Last week we made another release, but it succeeded in about 5 mins, so the change may have already taken effect and we got lucky with about 10 seconds to spare. Then the release we made 2 days ago failed, we had to keep retrying and managed to get under the 5 min cutoff on the 12th attempt.

[miketheman]

Whoops, my bad! I updated the link to reflect the actual links I found.