Add support for Buddy Works CI

[MateuszJakobscheBDY]

Description

Buddy is a CI/CD platform that can provide OIDC tokens to pipeline executions. We would like to add Buddy as a supported identity provider in Fulcio, enabling keyless signing of docker images in Buddy pipelines.

Buddy provides workload identity tokens with CI/CD-specific claims (workspace, project, pipeline, execution context, git metadata).

OIDC Configuration

Discovery URLs:
https://oidc.buddyusercontent.com/.well-known/openid-configuration
https://eu-oidc.buddyusercontent.com/.well-known/openid-configuration
https://asia-oidc.buddyusercontent.com/.well-known/openid-configuration

JWKS URLs:
https://oidc.buddyusercontent.com/.well-known/jwks
https://eu-oidc.buddyusercontent.com/.well-known/jwks
https://asia-oidc.buddyusercontent.com/.well-known/jwks

Algorithm: RS256

Example Token Claims

{
  "jti": "bc875c8c-9538-4737-bc12-8a0ab615e517",
  "iat": 1781007859,
  "nbf": 1781007859,
  "exp": 1781013259,
  "invoker_id": 18056,
  "invoker_name": "Mateusz Jakobsche",
  "iss": "https://eu-oidc.buddyusercontent.com",
  "sub": "https://eu.buddy.works/mywork/53w5/pipelines/pipeline/210153",
  "aud": ["sigstore"],
  "workspace_domain": "mywork",
  "workspace_display_name": "My",
  "project_name": "53w5",
  "project_display_name": "53w5",
  "pipeline_id": 210153,
  "pipeline_name": "trial",
  "execution_id": "RELEASE-6a2929aaa98591845c7d75ca",
  "triggered_on": "MANUAL",
  "revision": "39ba5c4d3b384f7f62852c6740dc6c30695f7656",
  "ref": "refs/heads/main",
  "runner_environment": "platform-hosted",
  "base_url": "https://eu.buddy.works"
}

Contact

raphael@buddy.works

[Hayden-IO]

Hey, thanks for reaching out. To be added, you'll need to provide a mapping between Buddy token claims and the certificate extensions, updating https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md and https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml. We'll then update our staging environment, ask that you verify certificates contain the expected values, and then we'll push the configuration to the production environment.

We also ask that you review https://github.com/sigstore/fulcio/blob/main/docs/new-idp-requirements.md#technical-and-security-requirements and verify the technical and security requirements.