providers/filesystem: honor SIGSTORE_OIDC_TOKEN_FILE env var

pkg/providers/filesystem/filesystem.go

@@ -31,22 +31,37 @@ type filesystem struct{}
 var _ providers.Interface = (*filesystem)(nil)
 
 const (
-	// FilesystemTokenPath is the path to where we read an OIDC
-	// token from the filesystem.
+	// FilesystemTokenPath is the default path to where we read an OIDC
+	// token from the filesystem. Used when FilesystemTokenFileEnvVar is unset.
 	// nolint
 	FilesystemTokenPath = "/var/run/sigstore/cosign/oidc-token"
+
+	// FilesystemTokenFileEnvVar, when set, overrides FilesystemTokenPath with
+	// any user-writable location. This allows the filesystem provider to be
+	// used on desktop / dev workstations without the one-time sudo step
+	// required to create /var/run/sigstore/cosign.
+	FilesystemTokenFileEnvVar = "SIGSTORE_OIDC_TOKEN_FILE"
 )
 
+// tokenPath returns the path the filesystem provider reads the OIDC token
+// from: SIGSTORE_OIDC_TOKEN_FILE if set, else the historical default.
+func tokenPath() string {
+	if p := os.Getenv(FilesystemTokenFileEnvVar); p != "" {
+		return p
+	}
+	return FilesystemTokenPath
+}
+
 // Enabled implements providers.Interface
 func (ga *filesystem) Enabled(_ context.Context) bool {
 	// If we can stat the file without error then this is enabled.
-	_, err := os.Stat(FilesystemTokenPath)
+	_, err := os.Stat(tokenPath())
 	return err == nil
 }
 
 // Provide implements providers.Interface
 func (ga *filesystem) Provide(ctx context.Context, audience string) (string, error) { //nolint: revive
-	b, err := os.ReadFile(FilesystemTokenPath)
+	b, err := os.ReadFile(tokenPath())
 	if err != nil {
 		return "", err
 	}

pkg/providers/filesystem/filesystem_test.go

@@ -0,0 +1,71 @@
+//
+// Copyright 2026 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package filesystem
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestTokenPathDefault(t *testing.T) {
+	t.Setenv(FilesystemTokenFileEnvVar, "")
+	if got := tokenPath(); got != FilesystemTokenPath {
+		t.Errorf("tokenPath() = %q, want default %q", got, FilesystemTokenPath)
+	}
+}
+
+func TestTokenPathEnvVarOverride(t *testing.T) {
+	const custom = "/tmp/my-custom-oidc-token"
+	t.Setenv(FilesystemTokenFileEnvVar, custom)
+	if got := tokenPath(); got != custom {
+		t.Errorf("tokenPath() = %q, want override %q", got, custom)
+	}
+}
+
+func TestProvideReadsFromEnvVarPath(t *testing.T) {
+	dir := t.TempDir()
+	tokenFile := filepath.Join(dir, "token")
+	const want = "raw.jwt.contents"
+	if err := os.WriteFile(tokenFile, []byte(want), 0o600); err != nil {
+		t.Fatalf("writing token fixture: %v", err)
+	}
+	t.Setenv(FilesystemTokenFileEnvVar, tokenFile)
+
+	fs := &filesystem{}
+	if !fs.Enabled(context.Background()) {
+		t.Fatalf("Enabled() = false, expected true when env-var-pointed file exists")
+	}
+	got, err := fs.Provide(context.Background(), "any-audience")
+	if err != nil {
+		t.Fatalf("Provide: %v", err)
+	}
+	if got != want {
+		t.Errorf("Provide() = %q, want %q", got, want)
+	}
+}
+
+func TestEnabledFalseWhenNeitherPathExists(t *testing.T) {
+	// Point the env var at a path that definitely doesn't exist; default
+	// /var/run/sigstore/cosign/oidc-token typically also doesn't exist in
+	// CI, so Enabled should be false.
+	t.Setenv(FilesystemTokenFileEnvVar, filepath.Join(t.TempDir(), "does-not-exist"))
+	fs := &filesystem{}
+	if fs.Enabled(context.Background()) {
+		t.Skip("default FilesystemTokenPath unexpectedly exists in this environment; can't test the negative case")
+	}
+}