mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
IvanHunters
0195e73d38
With --certificate-identity and --certificate-oidc-issuer, `cozypkg tap` pulled by tag without verifying and applied the artifact's PackageSources with ForceOwnership; only the Flux source carried the verify policy. A tag moved by someone without the signing identity could land unsigned content in the cluster. Verify the signature at tap time and pin the verified digest, so the content pulled and applied is what a trusted identity signed. Flux evaluates a cosign matchOIDCIdentity issuer and subject as Go regexps, and they were written unanchored. An exact identity such as alice@example.com would also accept malice@example.com, and the dots would match any character. Anchor and quote both values at the API and the CLI. Reject --tag together with a digest reference instead of silently ignoring the tag. Assisted-by: LLM Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>