adding checks for gitpod tokens

Signed-off-by: Edward Brough <[email protected]>

pkg/providers/gitpod/gitpod.go

@@ -16,7 +16,9 @@
 package gitpod
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"os/exec"
 
 	"github.com/sigstore/cosign/v2/pkg/cosign/env"
@@ -33,12 +35,36 @@ var _ providers.Interface = (*gitpod)(nil)
 
 // Enabled implements providers.Interface
 func (ga *gitpod) Enabled(_ context.Context) bool {
-	return env.Getenv(env.VariableGitpodWorkspaceId) != ""
+	// Check we are in a Gitpod Workspace
+	if env.Getenv(env.VariableGitpodWorkspaceId) != "" {
+
+		//Check we are able to generate tokens with a verified email address
+		output, err := exec.Command("gp", "idp", "token", "--audience", "example.org", "--decode").Output()
+		if err != nil {
+			return false
+		}
+
+		var token struct {
+			Payload *struct {
+				Email         *string `json:"email"`
+				EmailVerified bool    `json:"email_verified"`
+			} `json:"Payload"`
+		}
+		dec := json.NewDecoder(bytes.NewBuffer(output))
+		if err := dec.Decode(&token); err != nil {
+			return false
+		}
+
+		if token.Payload != nil {
+			return token.Payload.Email != nil && token.Payload.EmailVerified
+		}
+	}
+	return false
 }
 
 // Provide implements providers.Interface
 func (ga *gitpod) Provide(ctx context.Context, audience string) (string, error) {
-	token, err := exec.Command("gp idp token --audience " + audience).Output()
+	token, err := exec.Command("gp", "idp", "token", "--audience", audience).Output()
 	if err != nil {
 		return "", err
 	}