The index-entry `digest` field, and the gate and README claims around it, assume
a published index that does not exist yet: decision 0002 in the marketplace
proposal defers it, and #4981 tracks that work. The gate also never compared a
recorded digest against the artifact it verified, so the field added surface
without the check that would make it trustworthy.
Drop it from this PR. Digest pinning still works from an explicit
oci://host/org/repo@sha256:... reference and from the digest a tag resolves to;
only the index-entry path is removed. The tag-based pinning and the verify-flag
wording stay in the index README.
Assisted-by: LLM
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Update the tap command help and the community-index README for the new
behaviour: digest references, the automatic tag-to-digest pin, the
--certificate-identity / --certificate-oidc-issuer pull-time verify flags, and
the optional index entry digest. Extend the generated openapi definitions and
model-name helper for the new TapVerify type (code generation is otherwise
run in CI).
Assisted-by: LLM
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Address the remaining review findings:
- The materializer now prunes PackageSources it materialized from an earlier
revision that the current artifact no longer contains (including a single/multi
rename), so a removed package leaves the catalog; installed Packages stay.
- A repeat connect updates the fetched OCIRepository's spec, label and name
annotation instead of replacing the object, so the operator's finalizer and
materialized-revision annotation survive; covered by a test.
- OCIRepository write verbs move from the cluster-wide cozystack-api ClusterRole
to a namespaced Role in cozy-system (get/list/watch stay cluster-wide for the
watch cache), since the API only manages tap sources there.
- 'cozypkg validate --require-signature' now pulls the exact manifest digest
cosign verified, closing the tag-mutation window between verify and pull.
- safeJoin rejects any '..' path segment outright (defense in depth and to
satisfy the Zip-Slip scanner) on top of the existing containment check.
- Document why the index gate's merge/label steps need a workflow_run split for
fork pull requests.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Address review findings:
- The index gate listed only added/modified entries (--diff-filter=AM), so a
renamed entry file (R) skipped validation and signature checks and could
auto-merge an unreviewed ociRef. Include renames and copies (ACMR).
- 'cozypkg tap' created its OCIRepository without the marketplace-tap label or
tap-name annotation, so the dashboard's orphan-disconnect could not find a
CLI-created source. Set both, aligned with the tap's community name.
- cozypkg validate now rejects two components whose artifact names collide after
dot-to-dash normalisation (e.g. v1.0/c and v1/0-c), which would otherwise make
the reconciler overwrite one OutputArtifact with the other.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Conformance review against the design proposals surfaced that a short-name tap
ignored the index entry's recorded version: resolveTapTarget returned the bare
ociRef, so 'cozypkg tap <name>' pulled :latest while the CI gate had validated
and cosign-verified <ociRef>:<version>. The gate signed one tag and the cluster
pulled another, breaking both the versioning model (#18) and the signature
chain (#23). Resolve the short name to <ociRef>:<version> when a version is
recorded.
Also harden the publication gate: run 'cozypkg validate --helm-lint' (with helm
installed in the workflow) so charts are linted as the design specifies, and add
a CODEOWNERS so every index entry requires maintainer review.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Second review round found the write-path RBAC fix was only half applied and the
extracted naming helper diverged from its producer:
- The tap materializer runs as the cozystack-controller ServiceAccount, whose
ClusterRole granted source.toolkit.fluxcd.io/ocirepositories only
get/list/watch. Its finalizer and materialized-revision writes (r.Update on
the OCIRepository) were therefore Forbidden, so a dashboard-connected tap
never materialized. Grant the controller update/patch on ocirepositories.
- naming.ArtifactName replaced dots only in the PackageSource name, but the
reconciler replaces them in the variant and component too, so a tapped repo
with a dotted variant or component name dropped its packages from the catalog
and tripped a false appdef-dangling warning. Replace dots in all three
segments and add a direct parity test with dotted names.
- Pin cosign-installer and the cosign release in the index gate so the
signature verifier is reproducible.
- Add a unit test for the tap rollback objectExists predicate.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
- Extract the per-component artifact-name convention into
internal/marketplace/naming and have the validator and the Tap backend
delegate to it, so the component-to-ApplicationDefinition linkage cannot
drift across copies.
- cozypkg tap only rolls back resources it actually created, so an idempotent
re-tap no longer deletes a pre-existing OCIRepository/PackageSource when a
later apply fails.
- Pin cozypkg and yq in the index publication gate so the auto-merge decision
runs on a reproducible toolchain.
- Document the trust model explicitly: tap validates structure but does not
verify signatures; verification is enforced by the index CI gate (pinned to
the recorded cosign identity) and optionally by Flux OCIRepository
verification at pull time.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Add a template for the standalone cozystack/packages-index repository: the
metadata-only entry format (with a version and a recorded cosign signing
identity), an example entry, and the publication gate. The gate script
validates every changed entry with 'cozypkg validate --require-signature'
against the entry's recorded identity and classifies the change into the
auto-merge lane (a pure version bump of an already-listed entry) or the
maintainer-review lane (a new entry or a change to ociRef, maintainer, or
signing). It fails closed: a validation error, a parse error, a signature
failure, or a security-relevant edit never auto-merges. A companion GitHub
Actions workflow runs the gate and enables auto-merge or requests review
accordingly. Add a version field to the index entry so a bump is detectable.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
IvanHunters