Skip to content

fix(supply-chain): restore v8 app publisher compatibility #5215

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 4 commits into from
Oct 22, 2026
Merged

fix(supply-chain): restore v8 app publisher compatibility #5215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
08a8cb2
fix(supply-chain): restore v8 app publisher compatibility
devantler Oct 21, 2026
b0cd7d5
Merge remote-tracking branch 'origin/main' into codex/publisher-compa…
devantler Oct 21, 2026
3f22854
test(supply-chain): approve the v8 publisher's tenant RGD fingerprints
devantler Oct 21, 2026
3121e50
Merge remote-tracking branch 'origin/main' into codex/publisher-compa…
devantler Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,9 @@ spec:
keyless:
# The legacy publisher retains its full-commit compatibility rule
# (#3746). The maintained publisher accepts only the explicitly
# reviewed revision, not every commit in its repository. Mutable refs
# and tags satisfy neither location. Keep this to exactly ONE identity
# reviewed revisions during the v8 transition (#5213), not every
# commit in its repository. Mutable refs and tags satisfy neither
# location. Keep this to exactly ONE identity
# entry: the IVPOL engine verifies cosign v3 bundles through
# sigstore-go, which rejects more than one identity per verification
# ("unsupported: multiple identities are not supported at this
Expand All @@ -72,7 +73,7 @@ spec:
# form as an alternation inside this one regex.
identities:
- issuer: https://token.actions.githubusercontent.com
subjectRegExp: ^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-app\.yaml@[0-9a-f]{40}|\.github/\.github/workflows/publish-app\.yaml@0c7b6c3509b73adbc7537e030935bb01987e625b)$
subjectRegExp: ^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-app\.yaml@[0-9a-f]{40}|\.github/\.github/workflows/publish-app\.yaml@(0c7b6c3509b73adbc7537e030935bb01987e625b|467f07582436a26b62cf4aa756423512f85ba0c0))$
# The Kubescape storage compatibility image is produced inside this
# repository rather than through actions/publish-app.yaml: its publisher
# checks out one immutable upstream storage commit, applies the reviewed
Expand Down
7 changes: 4 additions & 3 deletions k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,14 +290,15 @@ spec:
# Keyless-signed by the shared publish-app workflow this tenant's
# cd.yaml calls. The legacy location retains its full-commit
# compatibility rule; the maintained location requires the exact
# reviewed revision. Tags and branches are refused at either
# location. Every tenant's caller must also pass its independent
# reviewed revisions during the v8 transition (#5213).
# Tags and branches are refused at either location. Every
# tenant's caller must also pass its independent
# approval check. cosign's keyless attestation verification
# rejects MULTIPLE identity entries outright ("unsupported: multiple
# identities are not supported at this time"), so any future
# alternation must stay inside one subject regex.
- issuer: '^https://token\.actions\.githubusercontent\.com$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-app\.yaml@[0-9a-f]{40}|\.github/\.github/workflows/publish-app\.yaml@0c7b6c3509b73adbc7537e030935bb01987e625b)$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-app\.yaml@[0-9a-f]{40}|\.github/\.github/workflows/publish-app\.yaml@(0c7b6c3509b73adbc7537e030935bb01987e625b|467f07582436a26b62cf4aa756423512f85ba0c0))$'
# --- Flux Kustomization (one of two variants by `sops`) ---------------
# The impersonating Kustomization that reconciles the tenant's own artifact
# under its namespaced SA (bound to the `tenant-edit` role). Two variants because the SOPS `decryption`
Expand Down
6 changes: 3 additions & 3 deletions scripts/rgd-template-static-scan-baseline.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
# The parameterized WebApp identities are additionally scanned after actual KRO resolution by
# test-webapp-compiled-scan.sh: omitted defaults still report writable root and UID/GID <= 10000.
# Disappearing low-ID rows below are not clearance for those compatibility defaults.
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml RGD-CONTENT SHA256 b196fbaff4273d0ec97cd0276f2e83ca9ce5f77653530864c2f7694c179e0a57
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml RGD-CONTENT SHA256 4b4f077ffee9276ede0339daf8e1a5e2f8adeb7d8c8705aabc3e872393c855b0
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/defaultDeny.yaml KSV-0039 LOW CAUSE-SHA256:6246c5e7ede528806f1f84a2b466b1a22c061b7d7f2ad38e18dc4c722ea7b32b
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/defaultDeny.yaml KSV-0040 LOW CAUSE-SHA256:6246c5e7ede528806f1f84a2b466b1a22c061b7d7f2ad38e18dc4c722ea7b32b
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/ghcrAuth.yaml KSV-0039 LOW CAUSE-SHA256:f3c7ced815c76aaba6407cf691461a7e46b0037f888f32d760286b0fde1bd286
Expand All @@ -26,8 +26,8 @@
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/kustomizationSops.yaml KSV-0040 LOW CAUSE-SHA256:59d21ae5decd83ec9c1e66036a71db7aa29ca574b4e3ef0fb803a8b45d7fac61
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/limitRange.yaml KSV-0039 LOW CAUSE-SHA256:c37b17db55af250264e52c9089e25decadde834c9ebae540db73774a4f2b5702
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/limitRange.yaml KSV-0040 LOW CAUSE-SHA256:c37b17db55af250264e52c9089e25decadde834c9ebae540db73774a4f2b5702
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/ociRepository.yaml KSV-0039 LOW CAUSE-SHA256:4fe5cbcec3db4deae608c8886a3d32ac071dcb524452e543555752b464f5cb26
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/ociRepository.yaml KSV-0040 LOW CAUSE-SHA256:4fe5cbcec3db4deae608c8886a3d32ac071dcb524452e543555752b464f5cb26
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/ociRepository.yaml KSV-0039 LOW CAUSE-SHA256:09f3a16081e9973d851ad50ebed089365dc8d9832c2d4f7ecffbe3199d93cff7
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/ociRepository.yaml KSV-0040 LOW CAUSE-SHA256:09f3a16081e9973d851ad50ebed089365dc8d9832c2d4f7ecffbe3199d93cff7
1 k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml.resources/resourceQuota.yaml KSV-0039 LOW CAUSE-SHA256:9e7f4d1bd690474236d5c0a694dce8767ed63f3b41bd94a1741ff5a8d072a8a4
1 k8s/bases/infrastructure/resource-graph-definitions/webapp/resource-graph-definition.yaml RGD-CONTENT SHA256 d72726a713827e5fb8091793ea3411f3bfb4dd5136488c11ba6e5ae9dd23a9a1
1 k8s/bases/infrastructure/resource-graph-definitions/webapp/resource-graph-definition.yaml.resources/deployment.yaml KSV-0013 MEDIUM CAUSE-SHA256:c801aedba500c27744aa5111215741ee7a4703a4968fb26c3e42a1fd33423767
Expand Down
28 changes: 28 additions & 0 deletions scripts/tests/test-publish-workflow-canonical-approvals.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -576,5 +576,33 @@ wedding k8s/bases/apps/wedding-app/oci-repository.yaml .spec.verify.matchOIDCIde
product-docs k8s/providers/hetzner/apps/khoist-documentation/oci-repository.yaml .spec.verify.matchOIDCIdentity[0].subject
PROFILES

# The starter moved to v8.0.0 before its generic consumers accepted that
# publisher (#5213). Exercise the committed predicates at all three boundaries;
# registered tenants retain their independently reviewed approval records above.
while IFS=$'\t' read -r profile file selector; do
subject="$(yq -er "$selector" "$REPO_ROOT/$file")"
while IFS=$'\t' read -r expected identity; do
result=reject
if printf '%s\n' "$identity" | grep -Eq -- "$subject"; then result=accept; fi
if [ "$result" = "$expected" ]; then
pass "v8 transition $profile: $expected $identity"
else
fail "v8 transition $profile: expected $expected for $identity, got $result"
fi
done <<'IDENTITIES'
accept https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@467f07582436a26b62cf4aa756423512f85ba0c0
reject https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@v8.0.0
reject https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@467f075
reject https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@467f07582436a26b62cf4aa756423512f85ba0c0-extra
reject https://github.com/devantler-tech/xgithub/.github/workflows/publish-app.yaml@467f07582436a26b62cf4aa756423512f85ba0c0
reject https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@467f07582436a26b62cf4aa756423512f85ba0c0
reject https://github.com/another-org/.github/.github/workflows/publish-app.yaml@467f07582436a26b62cf4aa756423512f85ba0c0
IDENTITIES
done <<'PROFILES'
admission k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml .spec.attestors[] | select(.name == "publishapp").cosign.keyless.identities[0].subjectRegExp
node-pull talos/cluster/verify-first-party-images.yaml .rules[] | select(.image == "ghcr.io/devantler-tech/*").keyless.subjectRegex
generic-tenant k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml .spec.resources[] | select(.id == "ociRepository").template.spec.verify.matchOIDCIdentity[0].subject
PROFILES

printf '\n%d failure(s)\n' "$failures"
[ "$failures" -eq 0 ]
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ iam.aws.m.upbound.io/v1beta1|Policy|aws|eks-ci-smoke-boundary 019210611429956763

iam.aws.m.upbound.io/v1beta1|Role|aws|eks-ci c40205b3f48d193e8be1a39abda738865b954c90733039a49854f0bac5844306

kro.run/v1alpha1|ResourceGraphDefinition||tenant.kro.run 9708bfc22af3dd7a4f24ac578bd153a921fdbbf400aed72b1feecfb08b8cbff4
kro.run/v1alpha1|ResourceGraphDefinition||tenant.kro.run 230562ae39b386fe6a5b4226eb0f1dff4078013855fdcc2dfc78b598077bbba0

kustomize.toolkit.fluxcd.io/v1|Kustomization|ascoachingogvaner|ascoachingogvaner ac00ca29c04de8d2c30a045d583570536a97fc305a1b06c4300da018ecdfb864

Expand Down
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,7 +289,7 @@ var expectedRenderedHashes = map[resourceIdentity]string{
{apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", name: "crossview-view"}: "536a4baa1970100ea117d1655f80e06ed874e2248b75f33f161e8b44ca3df50c",
{apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", name: "oidc-cluster-reader"}: "7d896404f02d6418c289065d73f9ad79345217d76c8d89eadca2c06e6066b487",
{apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", name: "oidc-view"}: "4d07ba3a995cfc139351b4227739efeba9348777f7fe47ac69b87d08e70bd45f",
{apiVersion: "kro.run/v1alpha1", kind: "ResourceGraphDefinition", name: "tenant.kro.run"}: "e07b4c08e4eb1138247969b5b92374f2da00e6e6e179e607c9a34999a322980c",
{apiVersion: "kro.run/v1alpha1", kind: "ResourceGraphDefinition", name: "tenant.kro.run"}: "ece1ec0a00fdbed29ef5bba180165e5a2f9b95e57c9a77ad56188ea14db13c12",
{apiVersion: "kustomize.toolkit.fluxcd.io/v1", kind: "Kustomization", namespace: "ascoachingogvaner", name: "ascoachingogvaner"}: "f921a4720a182b24f289c6a5e1ae684a174ed2f5a748c01cc6bc6bc14c644c03",
{apiVersion: "kustomize.toolkit.fluxcd.io/v1", kind: "Kustomization", namespace: "aws", name: "aws"}: "7bde9c682a81b752bdf9d2b14ce69ca1690008a39f2562d4887f8200447dea71",
{apiVersion: "kustomize.toolkit.fluxcd.io/v1", kind: "Kustomization", namespace: "flux-system", name: "apps"}: "b7dd0ad507a26f2ebd8ddf472a68a638b41dc2f2f1b476d0a6291f15332efe5d",
Expand Down
7 changes: 4 additions & 3 deletions talos/cluster/verify-first-party-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,9 +181,10 @@ rules:
issuer: https://token.actions.githubusercontent.com
subjectRegex: ^https://github\.com/devantler-tech/world-at-ruin/\.github/workflows/server-cd\.yaml@refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$
# First-party APP images retain legacy full-commit verification and accept the
# explicitly reviewed maintained publisher revision. Mutable refs, tags and
# other maintained commits are refused, as in the app admission policy.
# two reviewed maintained publisher revisions during the v8 transition (#5213).
# Mutable refs, tags and other maintained commits are refused, as in the app
# admission policy.
- image: ghcr.io/devantler-tech/*
keyless:
issuer: https://token.actions.githubusercontent.com
subjectRegex: ^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-app\.yaml@[0-9a-f]{40}|\.github/\.github/workflows/publish-app\.yaml@0c7b6c3509b73adbc7537e030935bb01987e625b)$
subjectRegex: ^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-app\.yaml@[0-9a-f]{40}|\.github/\.github/workflows/publish-app\.yaml@(0c7b6c3509b73adbc7537e030935bb01987e625b|467f07582436a26b62cf4aa756423512f85ba0c0))$
Loading