# A workload identity token on one laptop

Four small scripts that play the four stops of a sandbox request: an issuer that serves an OpenID discovery document and a JSON Web Key Set, a mint that signs a JWT-SVID with the issuer key, a verifier that fetches the key set and checks the token, and a printer for the AWS STS exchange request. Nothing leaves your machine and no cloud account is used.

Companion to https://rohitghumare.com/blog/the-sandbox-signs-its-requests/

## Run it

```
pip install "pyjwt[crypto]"
python3 issuer.py
```

In a second terminal, in the same folder:

```
python3 mint.py sts.amazonaws.com > token.txt
python3 verify.py token.txt sts.amazonaws.com
python3 verify.py token.txt reports
python3 sts.py token.txt
```

`issuer.py` writes `issuer-key.pem` and `issuer.pid` into the current folder. Stop it with `kill $(cat issuer.pid)`. Set `ISSUER_PORT` to use another port.