[Bug] Flux source-controller retains Git verification after trust-key rotation

Start with report.md and run attachments/reproduce.sh to confirm the unchanged-revision path and its second reconciliation. Trace the source-controller logic around requiresVerification and the “no changes since last reconciliation” return. Done means changing the verification SecretRef or key material causes re-verification before SourceVerified=True and Ready=True are advertised for the new generation.

Summary

After a GitRepository.spec.verify.secretRef change, source-controller can
reuse the same-revision optimized path without rechecking the commit
signature. The prior SourceVerified=True condition and artifact remain
advertised for the new generation.

Impact

A rotated or revoked signing key can remain effectively trusted for the
currently advertised artifact. A downstream GitOps consumer can continue to
accept that artifact even though the current verification Secret no longer
authorizes its signer.

Reproduction

The attached attachments.zip contains a concise envtest reproducer. It uses
a real SSH-signed commit, two different valid public-key Secrets, a local Git
HTTP server, and two complete controller reconciliations.

unzip attachments.zip
cd attachments
SOURCE_CONTROLLER_DIR=../source-controller-v1.9.3 \
KUBEBUILDER_ASSETS=../envtest-assets \
./reproduce.sh

Observed on v1.9.3 and current main:

artifact_revision_unchanged=true
git_core_old_key_verification=passed
git_core_new_key_verification=failed
source_verified_after_rotation=True
source_verified_observed_generation=1
ready_after_rotation=True
ready_observed_generation=2

The second reconciliation logs no changes since last reconciliation and
returns before signature verification because requiresVerification tracks
the mode but not the verification SecretRef/key set.

Expected behavior

Changing the verification SecretRef or its key material should establish a
new verification-policy epoch. The unchanged revision should be reverified
under the new policy before SourceVerified=True and Ready=True are
advertised for the new generation.

Versions

• source-controller v1.9.3: ed61ebda88cd70159b24df1c8df50b1e6be4cc3d
• source-controller current main: 143c11a58d226bee6f9efd774751cec92cd8dfff

Detailed source analysis, pinned GitHub links, logs, and the reproducer are in
report.md and attachments.zip.

The report and reproduction code were assisted by an LLM. I personally
reviewed the analysis and confirmed the behavior with the attached reproducer.
I apologize if this LLM assistance creates extra work; the additional detail
is intended to make the behavior and fix location easier to verify.

Attachments

report.md

attachments.zip