Dependency review: go-oidc

• Decision: approved for the isolated github.com/spice-framework/starter-oidc module.
• Version: github.com/coreos/go-oidc/v3 v3.20.0.
• Upstream: https://github.com/coreos/go-oidc.
• License: Apache-2.0; retained in vendored module license files.
• Maintenance: established OIDC integration used by the Go ecosystem; v3.20.0 was released July 8, 2026 and requires Go 1.25.
• Security: the adapter exposes no skip-issuer, skip-audience, skip-expiry, or skip-signature switches. RFC 9068 token typing prevents ID-token substitution. Algorithms are allowlisted, discovery and JWKS are HTTPS-only, redirects are refused, and responses and tokens are bounded. The reachable graph remains subject to gosec and govulncheck.
• Cancellation: verification accepts the request context. Explicit discovery requires a timed caller-owned client and propagates cancellation through both metadata and JWKS requests.
• Observability: decisions use bounded reason classes and never contain raw tokens, subjects, upstream errors, roles, or scopes.
• Configuration: exact issuer, audience, claim names, algorithm allowlist, and token size are constructor inputs. There is no environment lookup or global verifier.
• Transitive scope: go-jose/v4 and golang.org/x/oauth2; no provider SDK, session store, reverse proxy, browser flow, or server framework is adopted.
• Spice compatibility: the module selects the provisional minimum. The strict repository compatibility manifest and isolated CI matrix verify distinct minimum and current revisions with exact MVS selection; the starter manifest independently requires the exact Spice starter API.

Primary references:

• https://pkg.go.dev/github.com/coreos/go-oidc/v3/oidc
• https://github.com/coreos/go-oidc
• https://openid.net/specs/openid-connect-core-1_0.html
• https://www.rfc-editor.org/rfc/rfc9068.html

Build-only dependencies: Spice release tools

• Decision: approved as the repository-authorized release signer, renderer, and independent verifier.
• Signer version: github.com/spice-framework/development v0.0.0-20260806132124-4c308d1b9fda.
• Signer tool: github.com/spice-framework/development/cmd/spice-dev through the standard Go tool directive; invocations always use the full package path.
• Verifier version: github.com/spice-framework/toolchain v0.0.0-20260806133530-71211498297c.
• Verifier tool: github.com/spice-framework/toolchain/cmd/spice-library-release-verify.
• License: Apache-2.0, with its notice retained in vendor.
• Runtime scope: none. Product packages do not import the development module, and released applications acquire no runtime dependency on it.
• Dependency graph: the tool participates in normal Go minimal-version selection. That build-time coupling is accepted and visible in go.mod, go.sum, and vendor/modules.txt; no parallel tool registry is introduced.
• Integrity and network behavior: the exact pseudo-version is pinned and checksummed. Release rehearsal runs with GOWORK=off, GOPROXY=off, GOTOOLCHAIN=local, and GOFLAGS=-mod=vendor, so it cannot select an ambient checkout, upgrade itself, or download dependencies.
• Security: the native build tool is trusted repository code, reads the exact committed Git graph, and writes only to a caller-supplied temporary output directory. The rehearsal emits no signatures or signing material.
• Maintenance: the protected central workflow is the sole production builder. The former repository-local builder was removed after the first protected, independently verified preview release proved the central path.