From 57dda6b31a95db71a25d35de1cecc1197e34509c Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Wed, 25 Jan 2023 11:27:11 -0500
Subject: [PATCH] accept comments, newlines; crawl CG token keys

---
 crawl.sh                           |  7 ++++++-
 issuer.enforce.dev/keys            | 32 ++++++++++++++++++++++++++++++
 urls.txt                           |  4 ++++
 www.googleapis.com/oauth2/v2/certs | 18 ++++++++---------
 www.googleapis.com/oauth2/v3/certs | 14 ++++++-------
 5 files changed, 58 insertions(+), 17 deletions(-)
 create mode 100644 issuer.enforce.dev/keys

diff --git a/crawl.sh b/crawl.sh
index d67c36dc..d086a874 100755
--- a/crawl.sh
+++ b/crawl.sh
@@ -1,8 +1,13 @@
 #! /usr/bin/env bash
 
+set -euo pipefail
+
 while read l; do
+  [[ -z $l ]] && continue
+  [[ $l =~ ^#.* ]] && continue
+
   fn=${l#"https://"}
   echo $fn
   mkdir -p $(dirname $fn)
-  curl -o $fn $l
+  curl $l | jq > $fn
 done < urls.txt
diff --git a/issuer.enforce.dev/keys b/issuer.enforce.dev/keys
new file mode 100644
index 00000000..8aa4a082
--- /dev/null
+++ b/issuer.enforce.dev/keys
@@ -0,0 +1,32 @@
+{
+  "keys": [
+    {
+      "kty": "RSA",
+      "kid": "85530bd35f00ddceb39cb128e74a284b999e632ff8fff04155dc48ca8ddd2b4a",
+      "alg": "RS256",
+      "n": "4zaSe854ee098LdkJNF6VwMbHcTyjqsZbOGILljs58Wz856htCEPY7y7vO9yR9ht2P6fRPWg_VgUDujHVUHfFn6zWVGYHeVYrE_anYT6uEj0LvbLrwupZQ01ioeopVnFogxMEIvA-u172sniIzF1LGyt4ZNlNW8S5LexzSgyILd3gLj6hIMXOntpz240idZw4ICWa0b6tvS8DUBkNi3YS9S75KRBB7gRWyNMKGvDCYkZtjGSlCXKz3kbdBX09koimxHAW8e-zf0oyvCptv-Pgid-I--cke9cLZ0JlYncSH-VN1PnFSuUHRXnv1FR-iKiGuxF8PFrv0nTyYGs6hz8YNlozjolhS56yFstXgBvWZgy4NGJpFdx3G_Hji_I7dRWlJDiOgHce5Ap3Pm0I9FrOYj35NCBO3vnorZXTM0KeMfbAdenGvJgYPPamBH1LnlMNinQ0W0sxfTnXnexC01x9m-MWDKLgb5kv8SKB2L-HCaTtE2_lME4B2GyQIC08rQ3Tpzi0fnxc_hv-NLw5bEsEegTyinO2s6wujKhTroDNTUFY6gpapZ56LA5hr71OlY3Yb4O9_pgol7c4ySb6KkqNvH9nOrVIMaGYtIYgJUbPPy26P20G5QsJduM__gybHWaPP6HZzip-ssuNlLkOZ7jzrlcCoh8zZamskNGXLM3Oe0",
+      "e": "AQAB"
+    },
+    {
+      "kty": "RSA",
+      "kid": "92ad74547e32f58c266e2f4304ce2625bf7031923d0f1e5532752b0cfda5798b",
+      "alg": "RS256",
+      "n": "pTqZ4qw5S8Any7BDaGV6Bx9aMHWEwgUFS3ht5W5f44nc8bIqAGnvq-OvmuHqcscQQa7WOJmkn9F2ZJSn0y0BW63Nb6gntHqSQ-rzlsbkGV01lovhnLcTBsl_xQhGIp6zI7drK50tRqNfeKsZx77xAOecvlVBllRBUD9po-Z9OV197oqAuy3h4qBKyLuSke_FI4PQsB1b3bbi8ZmJ8ZQ3xqtA8PIncSdvzJxMD_OLTh6aJmkwQ-htzd5i9cYt3sftz0Mh8NR9U-ZYSKaS2ctMS7x3OvguwQ_dfamRt9Zg-ht3XAoiopZX8lo-sRbyi7h56hHddZuYkXLRxjhNuTrQbYmyecS-PeweKMMy7Y3AvT1Rt7GNvaDcllPI_b4dzAllWN_egZbIujgtLZwo6G0RZvQPjQ2A7n-tZbpaC79zZ08bT6mITkxgxJ1Zdbu9qRG3sdD2vp6RNJh8Jr3rWD7AqWded8bkxYq-6ABaiPOIcfdGXoWobEXN5VnpCKJM8fKgxyUfoodZyE7HgAdnTkHnLujGmGsQEW8cxt88AWPe4cjAEKsBgzBHVt3xNAkQ1P9KyjLeK5QK6PcZnVNroPMqmPKhD4B6C2yqpr2PCwCdBxlX8iFf7YDLTvjxRbmA3EGgrSBJXyaD3x8QpUOnC3lrrkzrFmjHR5Uz0vLNA1UoQr8",
+      "e": "AQAB"
+    },
+    {
+      "kty": "RSA",
+      "kid": "0a2dd75eb790552b04ca01c4c6bc515491d2851b37a5b28f49ece2018d2f26ac",
+      "alg": "RS256",
+      "n": "3ghX3cVzNfvDgC8dUBbof-RTAGP5-xW5NY0gHO_rgnHmG0Bov_eonrwQnGZ5FLf2F9gwk3lAyfIiLAXkj_-j8plj1HKydzRxsVTgpNhnfKYLV2oHOAs0uNwvni_H7Y4Y8vFOvJZAs1vN5kmqyOag4bFSwTaHtpm_aSkad2sBTbQC88lM9GRm8CZh3KVWN4PFDHmzuxbGHZ-lcmH8q8MLY0t-namIrQZ8PyYAqFQTY6su9Un7RWP5j78whIGlfrQO471UPdNPv7ltFU3lyHwi1cN2hhKDqFAfcXvJVV9BRNKiTf1hbixhMCYn8sRVuZxmiSi04BV1LfUsuarpbfJ8L67Le7o_gc-IuUJFzr_CguqsqwtdciAmTFRZW9nvwxjl0sOTg_fFF-q3dLIV7keBfdzwRovfMBVn3AcjRXVUOZqOnvlyHIMdUDDGqvXI9UZy2-XPsCoU7vrwIpsrRtDyhB9hyPVKv2VRt4COiIPKMJi_ajDUFEMix7fDlzmaJMdtWA6X2uI8yWp4Ea-M72hXDqI1VpQFbHFqBpmDQTUV5OC74FtQGzOb9AbqSxW7pjynE4t7RsvDwLCI1CgiYjRO7usYMWE4tl-LEUtbZqtueZyt-zNKu4LS25a_HMwTmPAvu1E72FU4gnupTmvZUNWJ8H6XIakC7rKa_lRbQ16gTg8",
+      "e": "AQAB"
+    },
+    {
+      "kty": "RSA",
+      "kid": "021b0da02c0fc9408d8336534c20f84a6838ef021376b2ea27c7a8a6907a6949",
+      "alg": "RS256",
+      "n": "ucnm1FQ_F9a30b7P8W-9JQ7Jj4N2UjPCIB4k2Gf5za6-h3zS4agvX3GDDTeHNrrzKYAcpsqwHjFw-W_5cmjBfP5Rsm7mpXmlEpOnBlTZAyJSohjQmMTwxna-4rf3InxTwujyYavg7Z46v3TtLXGUxEylcnpN5h12lysW7QwKWotW0KEhUubs-T-qA-4bkHYOMKms6jxiDDVu4k86FGjo-Su7DqFnQtkfcqXKlR8ie96tU3uD3gap-qRE6ecVv99RJKgQrnmuzmD2biYNApXYt6NR7t1mbFPpwaPoR6UtP1NfwhhRdFfTxOciywl9ip72jFXZJBOhPi9pCjS6GVq-SCLDE1f_DMdH9XGizSDoAOVhNjmyKB9uAg910EwUEFVIMwvdhZ7fqMefwCznKjxGfCpLxI8nSnS-o-d5dVthqX6eicQbIAF3rBTwleMbojg5BpbpxjgzrFagfmVcsOK1q3NrZuuJDqeU0eo6FMCFxpU9nLXZrPhrFnmx-CPlEpx5ElRR_O6zPFUMuyOe7-r-VNLuRK7Nhx9zpv56tfp7nu1glpkzXln8oG2SIr9XVAe6HWtPd3gUkbSXRE4BiuRrTDvXhtW6uzT3UtccJqKSbIqyH0n2pqyqhCbrxi0hcnCpn4C-X2PXInb2rxOIwSnhPgkNatO615jgjde-Ea88Lk8",
+      "e": "AQAB"
+    }
+  ]
+}
diff --git a/urls.txt b/urls.txt
index c8bb5ef3..9c95c908 100644
--- a/urls.txt
+++ b/urls.txt
@@ -1,3 +1,7 @@
+# Google OIDC token keys
 https://www.googleapis.com/oauth2/v3/certs
 https://www.googleapis.com/oauth2/v2/certs
 https://www.googleapis.com/oauth2/v1/certs
+
+# Chainguard OIDC token keys
+https://issuer.enforce.dev/keys
diff --git a/www.googleapis.com/oauth2/v2/certs b/www.googleapis.com/oauth2/v2/certs
index 312bedfd..78c5b512 100644
--- a/www.googleapis.com/oauth2/v2/certs
+++ b/www.googleapis.com/oauth2/v2/certs
@@ -2,19 +2,19 @@
   "keys": [
     {
       "e": "AQAB",
-      "kty": "RSA",
-      "n": "mMEQiikxH1XhmL_Jg6T9B0S_wjGFFSZhXSA4CjcVbcOFpxhJ6oozzQReIT_Sq4klqhMVuIC3JEr0xEKyhY4kLFPn5F8h_UQpGvWGXDyi7JPr-gLDugvFduosuQ3ceKvv9U921tWWZWtEtZ45R_VfF-X-7-pMXPFXekFMgTQpZNR9JsMraZ_RdRLrMSwmhBkLV23GrslTfT4Gy5h8vZ-2bccoRvdpr9YADePa7NrptHDv57UynxErtOWvcCf5Rsj0oqMlDp_5vqq5damQeYOoIN0jkyg_ejgewNxZ9wZlBS42_qNFcWOmsrJBN7eb8N7igqFynMFD8AIhX3-VteL7fQ==",
-      "kid": "d37aa5043812937fe43960ca3cf0e2284b6fc34d",
       "alg": "RS256",
-      "use": "sig"
+      "kid": "d37aa5043812937fe43960ca3cf0e2284b6fc34d",
+      "use": "sig",
+      "n": "mMEQiikxH1XhmL_Jg6T9B0S_wjGFFSZhXSA4CjcVbcOFpxhJ6oozzQReIT_Sq4klqhMVuIC3JEr0xEKyhY4kLFPn5F8h_UQpGvWGXDyi7JPr-gLDugvFduosuQ3ceKvv9U921tWWZWtEtZ45R_VfF-X-7-pMXPFXekFMgTQpZNR9JsMraZ_RdRLrMSwmhBkLV23GrslTfT4Gy5h8vZ-2bccoRvdpr9YADePa7NrptHDv57UynxErtOWvcCf5Rsj0oqMlDp_5vqq5damQeYOoIN0jkyg_ejgewNxZ9wZlBS42_qNFcWOmsrJBN7eb8N7igqFynMFD8AIhX3-VteL7fQ==",
+      "kty": "RSA"
     },
     {
-      "kty": "RSA",
-      "n": "or83anRxFNTbjOy47m4SRDZQ7WpX_yjJdqN_LgNUBfbb_VnBwIUv_k4E1tXOE1yQC704YAT6JQ4AJtvLw598NxSuyXSvo-JCQ4pNugjVZ0w2MErJtARcxCu4LI6gsA_xSfSfuNVVSdrHqg8G-wsog0BS6N4M5IJtUlRR6UtjLaJxgqFGzV5sHWAfmpBekqCC5l19OXtE9J00r_Wjo4kfleonpVlEHszx5KUzShfGTGwgoeryNcp4yBULh8El8vt50a4SP_D74gCL5YINUl4E8hfQoqbPoxLj33oXYEvMKL34xYErEF5Tw39oAEfky3OgTXsCQvAp5il7HQjRY1JGow==",
-      "kid": "afc4fba6599ff5f63b72dc522428278682f3a7f1",
-      "use": "sig",
       "alg": "RS256",
-      "e": "AQAB"
+      "use": "sig",
+      "e": "AQAB",
+      "kid": "afc4fba6599ff5f63b72dc522428278682f3a7f1",
+      "kty": "RSA",
+      "n": "or83anRxFNTbjOy47m4SRDZQ7WpX_yjJdqN_LgNUBfbb_VnBwIUv_k4E1tXOE1yQC704YAT6JQ4AJtvLw598NxSuyXSvo-JCQ4pNugjVZ0w2MErJtARcxCu4LI6gsA_xSfSfuNVVSdrHqg8G-wsog0BS6N4M5IJtUlRR6UtjLaJxgqFGzV5sHWAfmpBekqCC5l19OXtE9J00r_Wjo4kfleonpVlEHszx5KUzShfGTGwgoeryNcp4yBULh8El8vt50a4SP_D74gCL5YINUl4E8hfQoqbPoxLj33oXYEvMKL34xYErEF5Tw39oAEfky3OgTXsCQvAp5il7HQjRY1JGow=="
     }
   ]
 }
diff --git a/www.googleapis.com/oauth2/v3/certs b/www.googleapis.com/oauth2/v3/certs
index 492f4c0f..337d1e1c 100644
--- a/www.googleapis.com/oauth2/v3/certs
+++ b/www.googleapis.com/oauth2/v3/certs
@@ -1,20 +1,20 @@
 {
   "keys": [
     {
-      "e": "AQAB",
-      "alg": "RS256",
-      "kty": "RSA",
       "n": "mMEQiikxH1XhmL_Jg6T9B0S_wjGFFSZhXSA4CjcVbcOFpxhJ6oozzQReIT_Sq4klqhMVuIC3JEr0xEKyhY4kLFPn5F8h_UQpGvWGXDyi7JPr-gLDugvFduosuQ3ceKvv9U921tWWZWtEtZ45R_VfF-X-7-pMXPFXekFMgTQpZNR9JsMraZ_RdRLrMSwmhBkLV23GrslTfT4Gy5h8vZ-2bccoRvdpr9YADePa7NrptHDv57UynxErtOWvcCf5Rsj0oqMlDp_5vqq5damQeYOoIN0jkyg_ejgewNxZ9wZlBS42_qNFcWOmsrJBN7eb8N7igqFynMFD8AIhX3-VteL7fQ",
       "kid": "d37aa5043812937fe43960ca3cf0e2284b6fc34d",
-      "use": "sig"
+      "e": "AQAB",
+      "use": "sig",
+      "alg": "RS256",
+      "kty": "RSA"
     },
     {
-      "kid": "afc4fba6599ff5f63b72dc522428278682f3a7f1",
+      "use": "sig",
       "e": "AQAB",
-      "alg": "RS256",
       "n": "or83anRxFNTbjOy47m4SRDZQ7WpX_yjJdqN_LgNUBfbb_VnBwIUv_k4E1tXOE1yQC704YAT6JQ4AJtvLw598NxSuyXSvo-JCQ4pNugjVZ0w2MErJtARcxCu4LI6gsA_xSfSfuNVVSdrHqg8G-wsog0BS6N4M5IJtUlRR6UtjLaJxgqFGzV5sHWAfmpBekqCC5l19OXtE9J00r_Wjo4kfleonpVlEHszx5KUzShfGTGwgoeryNcp4yBULh8El8vt50a4SP_D74gCL5YINUl4E8hfQoqbPoxLj33oXYEvMKL34xYErEF5Tw39oAEfky3OgTXsCQvAp5il7HQjRY1JGow",
       "kty": "RSA",
-      "use": "sig"
+      "alg": "RS256",
+      "kid": "afc4fba6599ff5f63b72dc522428278682f3a7f1"
     }
   ]
 }