user-agent regression

[jku]

I'm trying to collect basic user-agent data from requests to the TUF repository. I expected cosign to advertize itself as cosign/2.6.0 but I see a generic user-agent: Go-http-client/2.0 instead

Quick check shows that user-agents are:

• TUF: Go-http-client/2.0
• rekor v2: Go-http-client/2.0
• timestamp: sigstore-go/v1.1.2
• oauth2: Go-http-client/2.0
• fulcio: sigstore-go/v1.1.2

I'm not 100% sure what the values were on earlier releases but at least partly this is definitely a regression and cosign used to have a specific user-agent.

[haydentherapper]

Thanks for filing, will chase this down and patch cosign.

[haydentherapper]

@steiza What are your thoughts on this? We don't expose a way to set user agent in sigstore-go for most clients currently.

I'm thinking of updating the rekor v2, TUF and oauth2 clients to specify the sigstore-go versions for now. - Edit: Not OAuth2, that's initiated by Cosign.

[haydentherapper]

Looks like we never set a specific user agent for the OAuth2 client. It's a bit of a pain to plumb it through and I'm not certain the OAuth2 and oidc libraries expose this functionality anyways.

For the other calls - would you rather a cosign or sigstore-go user agent?

[jku]

For the other calls - would you rather a cosign or sigstore-go user agent?

I'd definitely rather see "cosign/x.y.z" but a sigstore-go user-agent is a big improvement already

[steiza]

@steiza What are your thoughts on this?

sigstore-go should definitely identify itself for outbound network requests, which @haydentherapper fixed in sigstore/sigstore-go#525.

I'm not opposed to sigstore-go supporting custom user agents, but that seems like medium-low priority to me. If we do so, maybe we can allow people to extend (rather than replace) the sigstore-go user agent, so it'd be something like sigstore-go/a.b.c cosign/x.y.z.

[jku]

sigstore-go/a.b.c cosign/x.y.z

IIRC the other way would be the expected order (browsers have just messed this up)

ref rfc9110: "By convention, the product identifiers are listed in decreasing order of their significance for identifying the user agent software"

[haydentherapper]

Going to leave this open to track adding user agent configuration here and in sigstore-go.