Support oidc-client-id within signingConfig to avoid CLI flag redundancy

[SequeI]

Description

Currently, even when a signingConfig file is provided, the user is still required to pass the --oidc-client-id flag via the CLI (or ENV var) for signing. This creates a disjointed configuration experience. Ideally, the oidc-client-id (and related OIDC parameters) should be defined within the signingConfig under the OIDC-specific section, allowing the CLI to remain lean.

[Hayden-IO]

I had thought about this when we designed the signing config format. I do agree it's a bit of a weird UX to have part of the OIDC workflow defined via the config, and part defined via the CLI. However this means that we have to treat the OIDC service as a special case in the config with additional OIDC-only fields.

I wonder if this would be better as a dedicated config file rather than bundled with the signing configuration.

[SequeI]

I wonder if this would be better as a dedicated config file rather than bundled with the signing configuration.

Agreed, or even instead of passing in trusted_root + signing_config, pass in one unified config manifest containing both + additional OIDC config block wrapped around the ClientTrustConfig format.

Similar to how Python client deals with it. It would also at the same time truly complete the state asserted in the comment above the type

// ClientTrustConfig describes the complete state needed by a client
// to perform both signing and verification operations against a particular
// instance of Sigstore.

[Hayden-IO]

We should see what other Sigstore clients support. Configuration definitions under the protobuf-specs repo are expected to be a part of the client spec and implemented by all clients. If supporting custom OIDC providers is only supported by Cosign, I'd suggest starting with a config file just implemented for Cosign, and then working towards standardizing across clients.

[SequeI]

Sounds good, I'll do some digging and raise it up at some TSC/Community meeting to kickstart the convo and see if there is interest.

Python for sure supports it, I remember having to fix/tweak the aud claim validation as it was hardcoded. Anyhow, thanks for the prompt replies on this 👍

[Hayden-IO]

I'd post on https://github.com/sigstore/sig-clients/issues or #clients for other clients to weigh in.