Script to fetch and calculate OpenID Connect thumbprint for Github Actions (or others)

thumbprint.sh

GITHUB_ACTIONS='token.actions.githubusercontent.com'
OIDC_PATH='.well-known/openid-configuration'

HOST=$(curl https://$GITHUB_ACTIONS/$OIDC_PATH \
 | jq -r '.jwks_uri | split("/")[2]')
echo "Fetching thumbprint for: $HOST"
RAWCERT=$(echo | openssl s_client -servername $HOST -showcerts -connect $HOST:443 2> /dev/null)

CERT=$(echo "$RAWCERT" | sed -n -e '/BEGIN/h' -e '/BEGIN/,/END/H' -e '$x' -e '$p' | tail -n +2)
SSLPRINT=$(openssl x509 -fingerprint -noout <<< $CERT)

THUMBPRINT=$(echo $SSLPRINT | sed -e "s/.*=//" -e "s/://g" | tr "ABCDEF" "abcdef")
echo "thumbprint: $THUMBPRINT"

The arcane version peppered around in various places online does not copy+paste to linux (because of a tail +2).
This rewrite should accomplish the same thing, calculating the fingerprint, but hopefully names a few of the intermediary steps, to better hint at how the thumbprint is assembled.