Description

Every aicr bundle --attest invocation triggers a fresh full OIDC
browser flow and writes a permanent Rekor transparency-log entry.
Users iterating on bundle generation (tweaking --set / --dynamic
and re-bundling) will rack up Rekor entries and browser interruptions.
Not strictly a bug, but op-notable.

Impact

Medium — annoying during iteration; each run adds a permanent
transparency-log entry.

Where

Updated 2026-06-02: line reference refreshed; the original pkg/cli/bundle.go:510 is now the app-name flag.

• pkg/cli/bundle.go — selectAttester (now ~line 751) wires CLI flags into the resolver on every invocation.
• The token is actually acquired in attestation.ResolveAttesterLazy
  (pkg/bundler/attestation/resolver.go), resolved lazily at the first
  Attest() call. Caching belongs here so it covers all acquisition
  flows, not just selectAttester.

Proposed Fix

Cache the OIDC token:

1. In-process for the lifetime of a single command (also solves
   multi-component bundles if signing ever splits).
2. Optionally on disk under $XDG_CACHE_HOME/aicr/oidc.json with
   cert-expiry gating (cosign upstream does this). Re-prompt only when
   the token has expired.

Scope

Medium-sized standalone PR. Not stable-blocking. Higher value once
anyone is iterating; low value for a single release-build flow. Tests
for cache hit / miss / expiry go in
pkg/bundler/attestation/oidc_test.go.

Related

Updated 2026-06-02: the headless-OIDC work referenced originally has largely landed.

The resolver now supports multiple token-acquisition flows:
--identity-token / COSIGN_IDENTITY_TOKEN, ambient (GitHub Actions
OIDC), the device-code flow (--oidc-device-flow), and the interactive
browser flow. Caching should hook ResolveAttesterLazy so the cache
behaves correctly across ambient / device-code / interactive paths
(e.g. the cache is moot for pre-fetched --identity-token, but valuable
for browser and device-code flows).