IvanHunters
3ce8279019
Address the remaining review findings: - The materializer now prunes PackageSources it materialized from an earlier revision that the current artifact no longer contains (including a single/multi rename), so a removed package leaves the catalog; installed Packages stay. - A repeat connect updates the fetched OCIRepository's spec, label and name annotation instead of replacing the object, so the operator's finalizer and materialized-revision annotation survive; covered by a test. - OCIRepository write verbs move from the cluster-wide cozystack-api ClusterRole to a namespaced Role in cozy-system (get/list/watch stay cluster-wide for the watch cache), since the API only manages tap sources there. - 'cozypkg validate --require-signature' now pulls the exact manifest digest cosign verified, closing the tag-mutation window between verify and pull. - safeJoin rejects any '..' path segment outright (defense in depth and to satisfy the Zip-Slip scanner) on top of the existing containment check. - Document why the index gate's merge/label steps need a workflow_run split for fork pull requests. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Cozystack community package index (template)
This directory is a template for the standalone cozystack/packages-index repository. Copy its contents into that repository's root (moving github-workflows/validate.yaml to .github/workflows/validate.yaml) to stand up the community index and its publication gate.
The index is metadata only: it records where community packages live and who owns them. Artifacts stay in ordinary OCI registries; nothing is hosted here.
Layout
entries/<name>.yaml # one metadata-only entry per package
scripts/validate-entry.sh # offline gate: cozypkg validate + mandatory cosign
github-workflows/validate.yaml # CI that runs the gate on every entry change
Entry format
Each file under entries/ is a single record (see entries/example.foo.yaml):
name: foo.bar
ociRef: oci://ghcr.io/foo/bar
version: v1.2.3
description: A SQL database operator
maintainer: Foo <foo@example.com>
homepage: https://example.com/foo
tags:
- database
- sql
signing:
identity: https://github.com/foo/bar/.github/workflows/release.yaml@refs/heads/main
issuer: https://token.actions.githubusercontent.com
Two-lane merge policy
Following krew-index, submissions take one of two lanes:
- Owner version bump. A change that only updates an existing entry's
versionor description, leavingociRefandsigninguntouched, auto-merges once the new artifact validates and is signed by the entry's recorded cosign identity. This keeps the routine "new release of a listed package" path fast. - New entry, or a change to
ociRef,maintainer, orsigning. These are the security-relevant edits and require maintainer review before merge.
Cosign verification is mandatory on the gate for both lanes: the trust anchor is the recorded signing identity, so a bump fails if the new artifact is not signed by the originally approved identity.
Trust model
Signature verification happens here, at publication time, not at tap time. cozypkg tap and the dashboard connect flow validate an artifact's structure but do not verify its cosign signature: a cluster that taps a listed repository trusts that this index already verified it. The verification points are this CI gate (which pins each release to the entry's recorded identity) and, optionally, Flux OCIRepository verification at pull time. Tapping a third-party repository runs its charts in the management cluster, so operators should tap only sources they trust or that appear in a curated index like this one.