Make the signature/public-key endpoint public ?

[sloonz]

From https://woodpecker-ci.org/docs/usage/extensions#security :

You can get the public Woodpecker key by opening http://my-woodpecker.tld/api/signature/public-key or by visiting the Woodpecker UI, going to you repo settings and opening the extensions page.

This, however, requires a signed-in user. Is there a point to this requirement ?

This prevents configuration extensions to automatically fetch the public key by itself.

[anbraten]

Good question, actually I don't see a risk in sharing the public key with everyone. Should be pretty similar to what GitHub is doing with https://github.com/sloonz.keys

[sloonz]

That’s also how OIDC works. Public keys are published on a public endpoint, for example https://token.actions.githubusercontent.com/.well-known/jwks for github action tokens.