Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug] Flux source-controller retains Git verification after trust-key rotation

Chiusa
  • Qualcosa non va?
#2,165 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
git, go
Ambito
backend, security

Direzione di ricerca

Start with report.md and run attachments/reproduce.sh to confirm the unchanged-revision path and its second reconciliation. Trace the source-controller logic around requiresVerification and the “no changes since last reconciliation” return. Done means changing the verification SecretRef or key material causes re-verification before SourceVerified=True and Ready=True are advertised for the new generation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area/git bug

Summary

After a GitRepository.spec.verify.secretRef change, source-controller can
reuse the same-revision optimized path without rechecking the commit
signature. The prior SourceVerified=True condition and artifact remain
advertised for the new generation.

Impact

A rotated or revoked signing key can remain effectively trusted for the
currently advertised artifact. A downstream GitOps consumer can continue to
accept that artifact even though the current verification Secret no longer
authorizes its signer.

Reproduction

The attached attachments.zip contains a concise envtest reproducer. It uses
a real SSH-signed commit, two different valid public-key Secrets, a local Git
HTTP server, and two complete controller reconciliations.

unzip attachments.zip
cd attachments
SOURCE_CONTROLLER_DIR=../source-controller-v1.9.3 \
KUBEBUILDER_ASSETS=../envtest-assets \
./reproduce.sh

Observed on v1.9.3 and current main:

artifact_revision_unchanged=true
git_core_old_key_verification=passed
git_core_new_key_verification=failed
source_verified_after_rotation=True
source_verified_observed_generation=1
ready_after_rotation=True
ready_observed_generation=2

The second reconciliation logs no changes since last reconciliation and
returns before signature verification because requiresVerification tracks
the mode but not the verification SecretRef/key set.

Expected behavior

Changing the verification SecretRef or its key material should establish a
new verification-policy epoch. The unchanged revision should be reverified
under the new policy before SourceVerified=True and Ready=True are
advertised for the new generation.

Versions

  • source-controller v1.9.3: ed61ebda88cd70159b24df1c8df50b1e6be4cc3d
  • source-controller current main: 143c11a58d226bee6f9efd774751cec92cd8dfff

Detailed source analysis, pinned GitHub links, logs, and the reproducer are in
report.md and attachments.zip.

The report and reproduction code were assisted by an LLM. I personally
reviewed the analysis and confirmed the behavior with the attached reproducer.
I apologize if this LLM assistance creates extra work; the additional detail
is intended to make the behavior and fix location easier to verify.

Attachments

report.md

attachments.zip

Lingua principale
Go
Stelle
283
Fork
258
Merge medio
1g 17h
PR unite (30g)
15

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di fluxcd/source-controller

Tutte le issue di fluxcd/source-controller

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.