mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
IvanHunters
c56b9876f4
A tap can now carry a keyless cosign verification policy (spec.verify), so a
reference is only pulled when signed by the recorded identity. The CLI takes
--certificate-identity and --certificate-oidc-issuer (both required together,
mirroring validate); the API takes spec.verify.{issuer,subject} on the Tap
connect object. Both map to a Flux OCIRepository verify block with provider
cosign and a matchOIDCIdentity entry. A half-configured policy (only one of
the identity pair) is refused rather than set, since a policy that matched any
signer is worse than none. A key-based policy an admin sets on the source by
hand is preserved across repeat connects.
Assisted-by: LLM
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>