cozystack

0 Fork 0

mirror of https://github.com/cozystack/cozystack.git synced 2026-11-09 14:02:56 +09:00

Files

T

IvanHunters c837838cc2 fix(marketplace): pin a tag-following tap source to the resolved digest

A tapped repository followed a mutable tag: the OCIRepository carried only
spec.ref.tag with a 5m interval, so Flux re-pulled whatever the tag pointed
at, and a moved tag reached running tenant application instances within the
interval. Whoever controlled the tag controlled what ran in the cluster.

The materializer now pins the source to the digest Flux resolved for the
artifact it just verified: it reads the manifest digest from
status.artifact.revision (source-controller formats an OCI tag revision as
'<tag>@<digest>') and writes it to spec.ref.digest, which Flux resolves
ahead of the tag. The tag is kept informational. Moving the tag upstream no
longer changes what the cluster pulls; an explicit re-connect is required to
move the pin. A user-supplied explicit digest is never rewritten, and a
revision without a well-formed digest leaves the source following its tag
rather than writing a malformed reference.

Assisted-by: LLM
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-10-22 22:02:49 +03:00

apigate

ci(api-gate): report name declarations the API server would refuse

2026-09-24 09:35:10 +03:00

backupcontroller

fix(backups): prepare standalone VMDisk restore targets before the data mover runs

2026-10-13 18:05:45 +04:00

controller

fix(fluxcd): give each release its own share of the hook's retries

2026-10-13 15:09:00 +03:00

cozyvaluesreplicator

refactor: apply the Go 1.27 modernizers