cozystack

0 Fork 0

mirror of https://github.com/cozystack/cozystack.git synced 2026-11-09 14:02:56 +09:00

Files

T

IvanHunters c837838cc2 fix(marketplace): pin a tag-following tap source to the resolved digest

A tapped repository followed a mutable tag: the OCIRepository carried only
spec.ref.tag with a 5m interval, so Flux re-pulled whatever the tag pointed
at, and a moved tag reached running tenant application instances within the
interval. Whoever controlled the tag controlled what ran in the cluster.

The materializer now pins the source to the digest Flux resolved for the
artifact it just verified: it reads the manifest digest from
status.artifact.revision (source-controller formats an OCI tag revision as
'<tag>@<digest>') and writes it to spec.ref.digest, which Flux resolves
ahead of the tag. The tag is kept informational. Moving the tag upstream no
longer changes what the cluster pulls; an explicit re-connect is required to
move the pin. A user-supplied explicit digest is never rewritten, and a
revision without a well-formed digest leaves the source following its tag
rather than writing a malformed reference.

Assisted-by: LLM
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-10-22 22:02:49 +03:00

package_reconciler_memory_test.go

fix(operator): keep deleting packages out of memory policy creation

2026-10-07 06:06:52 +03:00

package_reconciler_memory.go

fix(operator): persist holds for unsafe memory defaults

2026-10-07 06:06:51 +03:00

package_reconciler_privileged_test.go

feat(marketplace): register a tapped repository's apps on connect

2026-09-21 21:57:04 +03:00

package_reconciler_test.go

test(operator): exercise failed memory safety scans