Support `OCIRepository.status.sourceVerificationFingerprint` for keyless cosign with public sigstore infra
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
Start by reading #2179 and tracing how OCIRepository.status.sourceVerificationFingerprint is updated when .spec.verify references a Secret. Then investigate the controller's 24-hour key refresh path for keyless cosign with public Sigstore infrastructure. The issue is done when a feasible approach to refresh the fingerprint in that case is identified; the issue names no specific files or tests.
Written by the indexing model from the issue text.
Description
#2179 Introduced OCIRepository.status.sourceVerificationFingerprint for triggering a reconciliation when verification material has changed. This is supported if any of the .spec.verify Secret references are being used, but not when both are unset (keyless cosign with public sigstore infra). The reason is the complexity to implement this. The controller only refreshes the key once every 24h and it's hard to tap into it. Research is needed for this.
- Dominant language
- Go
- Stars
- 285
- Forks
- 259
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 20
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from fluxcd/source-controller
-
OCIRepository: pick the Helm chart layer automatically when the first layer is a provenance filePossibly taken @rg3122 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
fluxcd/source-controller#2198 ·
Maintainers usually reply within 1 day
-
Improve documentation on debugging the controller locallyMay be free again @Bryandero98 claimed this 37 days ago, and no pull request is open. Openarea/docs good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
fluxcd/source-controller#666 · 2 comments ·
Maintainers usually reply within 1 day
-
`OCIRepository`/cosign verification: support TSA-only trusted roots (no transparency log) for private Sigstore instances like GitHub Artifact AttestationsPossibly taken @stealthybox claimed this 151 days ago. Openarea/oci area/security enhancement
Difficulty 4/5 3-5 days Newbie friendliness 68/100
fluxcd/source-controller#2167 · 4 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
fluxcd/source-controller#2150 ·
Maintainers usually reply within 1 day
-
GitRepository `.spec.ref.commit` + `.spec.ref.branch` does not shallow clone, contrary to the docsOpen
Difficulty 5/5 Over a week Newbie friendliness 42/100
fluxcd/source-controller#2146 · 2 comments ·
Maintainers usually reply within 1 day
All issues in fluxcd/source-controller
Similar issues
-
[BUG] deploy.restart_policy without condition drops the restart policyPossibly taken @akshat-lakhera claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
docker/compose#14383 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
AvengeMedia/dank-greeter#39 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
dokku/dokku-datastore#367 ·
Maintainers usually reply within 1 day
-
[Bug]: ap gateway image build cannot find local policies on WindowsPossibly taken @Jayzilva claimed this today. OpenAspect/Configuration Severity/Major
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
wso2/api-platform#3912 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 2 days