Add bounded request timeouts to Fulcio client (#1917)

* Add bounded timeouts to Fulcio client

Signed-off-by: ECD5A <111098024+ECD5A@users.noreply.github.com>

* Keep Fulcio timeout handling narrowly scoped

Signed-off-by: ECD5A <111098024+ECD5A@users.noreply.github.com>

---------

Signed-off-by: ECD5A <111098024+ECD5A@users.noreply.github.com>

Author: ECD5A

CHANGELOG.md

@@ -26,6 +26,8 @@ All versions prior to 0.9.0 are untracked.
 
 ### Fixed
 
+* Fulcio certificate and trust-bundle requests now use finite connection and
+  read inactivity timeouts.
 * Parsing a malformed in-toto statement now includes the underlying validation
   error, instead of discarding it. `StatementBuilder.build()` already did this;
   `Statement(contents=...)` did not, so a rejected digest algorithm, a missing

sigstore/_internal/fulcio/client.py

@@ -42,6 +42,11 @@
 SIGNING_CERT_ENDPOINT = "/api/v2/signingCert"
 TRUST_BUNDLE_ENDPOINT = "/api/v2/trustBundle"
 
+# Use a short connect timeout and a finite read timeout for Fulcio requests.
+# Certificate issuance and trust-bundle retrieval should not block the caller
+# indefinitely when the configured endpoint accepts a connection but stalls.
+DEFAULT_FULCIO_TIMEOUT: tuple[int, int] = (5, 30)
+
 
 class ExpiredCertificate(Exception):
     """An error raised when the Certificate is expired."""
@@ -101,7 +106,10 @@ def post(
             "Accept": "application/pem-certificate-chain",
         }
         resp: requests.Response = self.session.post(
-            url=self.url, data=_serialize_cert_request(req), headers=headers
+            url=self.url,
+            data=_serialize_cert_request(req),
+            headers=headers,
+            timeout=DEFAULT_FULCIO_TIMEOUT,
         )
         try:
             resp.raise_for_status()
@@ -139,7 +147,9 @@ class FulcioTrustBundle(_Endpoint):
 
     def get(self) -> FulcioTrustBundleResponse:
         """Get the certificate chains from Fulcio"""
-        resp: requests.Response = self.session.get(self.url)
+        resp: requests.Response = self.session.get(
+            self.url, timeout=DEFAULT_FULCIO_TIMEOUT
+        )
         try:
             resp.raise_for_status()
         except requests.HTTPError as http_error:

test/unit/internal/fulcio/test_client.py

@@ -12,3 +12,43 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import unittest.mock
+
+import pytest
+import requests
+
+from sigstore._internal.fulcio.client import (
+    DEFAULT_FULCIO_TIMEOUT,
+    FulcioClient,
+    FulcioClientError,
+)
+
+
+def _client_with_mock_session():
+    client = FulcioClient("http://fake")
+    session = unittest.mock.MagicMock()
+    client.session = session
+    return client, session
+
+
+def test_signing_cert_post_passes_timeout():
+    client, session = _client_with_mock_session()
+
+    request = unittest.mock.MagicMock()
+    request.public_bytes.return_value = b"csr"
+    response = session.post.return_value
+    response.raise_for_status.side_effect = requests.HTTPError
+
+    with pytest.raises(FulcioClientError):
+        client.signing_cert.post(request, "token")
+
+    assert session.post.call_args.kwargs["timeout"] == DEFAULT_FULCIO_TIMEOUT
+
+
+def test_trust_bundle_get_passes_timeout():
+    client, session = _client_with_mock_session()
+    session.get.return_value.json.return_value = {"chains": []}
+
+    client.trust_bundle.get()
+
+    assert session.get.call_args.kwargs["timeout"] == DEFAULT_FULCIO_TIMEOUT