REUSABLE WORKFLOW IS GOOD… UNTIL YOU REALIZE YOUR IDENTITY IS ALSO REUSABLE BY ANYONE

Summary from the TLDR InfoSec newsletter

Keyless signing is used in conjunction with sigstore by organizations to sign artifacts to enable artifact attestation. A novel attack method shows that if a repository publishes a reusable workflow to sign artifacts using sigstore, an attacker can use that workflow to sign artifacts with a SAN of the reusable workflow's repository. The researcher does not believe that this is a worrisome threat as they could only find two repositories that the attack would actually work against and even then the impact would depend on how the potential victim verified the signature.