You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@reqsign.apache.org by "lpravda (via GitHub)" <gi...@apache.org> on 2026/10/07 14:56:20 UTC
[I] reqsign-google: `external_account` configs without `credential_source.format` fail to parse (Google defaults it to `text`) [reqsign]
lpravda opened a new issue, #909:
URL: https://github.com/apache/reqsign/issues/909
**Description**
`reqsign-google` won't parse workload identity federation (`external_account`) credential files whose `credential_source` has no `format` field. [AIP-4117](https://google.aip.dev/auth/4117) marks `format.type` as optional ("The default should be "text"") and says "If the format is not available, assume the external credential … is provided in plain text format." `gcloud iam workload-identity-pools create-cred-config` leaves the field out by default, so the most common way of generating these files produces configs reqsign rejects. Google's own client libraries (e.g. Python `google-auth`) accept them.
**Versions:** reqsign-google 3.1.1 (bundled in uv 0.12.23, where we hit it); the latest release 3.2.0 and `main` (`4708ecb`) have the same required `format: Format` in `FileSource` and `UrlSource`.
**Reproduce**
```sh
gcloud iam workload-identity-pools create-cred-config \
projects/1/locations/global/workloadIdentityPools/p/providers/q \
--service-account=sa@x.iam.gserviceaccount.com \
--credential-source-file=/path/to/oidc_token \
--output-file=cred.json
```
This writes:
```json
"credential_source": {
"file": "/path/to/oidc_token"
}
```
Then load it via `GOOGLE_APPLICATION_CREDENTIALS=cred.json` with the default signer.
**Actual**
```
WARN Error loading credential from provider EnvCredentialProvider { scope: None }: Error { kind: Unexpected, message: "failed to parse credential file", source: data did not match any variant of untagged enum Source, retryable: false }
```
**Expected:** the config parses, and the token file is read as plain text.
**Why it matters:** `ProvideCredentialChain` logs this error as a warning and moves on to the next provider. On GCE/GKE that's `VmMetadataCredentialProvider`, so requests get signed silently as the node's default service account instead of the configured identity. In our case (Docker builds on CI runners) the result was a `403 Forbidden` from Artifact Registry, and nothing in the default output pointed to the credential file.
**Suggested fix:** make `format` optional in `FileSource` and `UrlSource` and default it to `Format::Text`, either with `#[serde(default)]` plus a `Default` impl or with `Option<Format>`. Adding `"format": {"type": "text"}` to the config by hand works around it, and we've confirmed that workaround fixes our case.
You might also consider failing, rather than falling back, when `GOOGLE_APPLICATION_CREDENTIALS` is set but can't be parsed. That's what Google's client libraries do: an explicitly configured credential that's broken is almost certainly a misconfiguration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org
Re: [I] reqsign-google: `external_account` configs without `credential_source.format` fail to parse (Google defaults it to `text`) [reqsign]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo closed issue #909: reqsign-google: `external_account` configs without `credential_source.format` fail to parse (Google defaults it to `text`)
URL: https://github.com/apache/reqsign/issues/909
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org
Re: [I] reqsign-google: `external_account` configs without `credential_source.format` fail to parse (Google defaults it to `text`) [reqsign]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo commented on issue #909:
URL: https://github.com/apache/reqsign/issues/909#issuecomment-6042199890
fixing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org