Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Feature Request: add "forward only" option for GitRepository with signed commits

オープン
  • 何か問題がありますか？
#2,010 コメント 3 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
42/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
静か
技術スタック
git, go
領域
backend, security

調査の方向性

実装ファイルやテストは指定されていません。まず、GitRepository のリコンシリエーションと、source-controller における現在の commit checkout および署名検証のフローを追跡します。保存された検証済み commit をどのように追跡するか、force push 後にどのように祖先関係を確認するかを定義し、受け入れられる子 commit、拒否されるリセット、無効な署名のカバレッジを追加します。

索引モデルが issue の本文から書いたものです。

説明

I'm wondering if it is possible to implement a GitRepository option to only accept new signed commits which are a child of the current validated signed commit.

Current situation:

At the moment it is possible to reset the GIT history to an older singed commit by force pushing and the source controller accepts the commit. This permits user, which have write permission to the GIT repository to change the deployment to an older state even though their public key is not in the list of permitted signers.

example GIT log:

commit 5b468b41996fcb4146bb8fe9e88aa6735c799fc9
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:53:01 2026 +0100

    second signed commit

commit f99de69ed074fd3b59570786d515ed4ba56aef12
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:52:15 2026 +0100

    first signed commit

commit 721a520671afc30070c0767baff4f44a4fe72fab
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:51:42 2026 +0100

    initial commit

If the source controller has currently checked out and verified commit 5b468b41996fcb4146bb8fe9e88aa6735c799fc9 it is possible for user a user with write access to the repo but without the users key in the list of trusted keys to do following:

git reset --hard f99de69ed074fd3b59570786d515ed4ba56aef12
git push -f

The source-controller would checkout and verify commit f99de69ed074fd3b59570786d515ed4ba56aef12 even though the change was performed by a user that should not be permitted to perform changes within this GitRepository resource.

Technically: if the same repo would contain a kustomization with the secret of permitted signers. A user with write access to the repo and who was previously in the list of permitted singers could revert to a version where the user was in the list. The secret would be revert to the old state and the user could push a complete different configuration with a now valid signed commit.

Possible solution:

Adding a config option which permit for "forward-only" changes. It should not be possible to reset the history to an older GIT commit id. Only signed revert commits or regular commits which are child of the current parent are accepted.

example GIT log:

commit 683408a1ae2425940ea5cc7b3d9120fdf1dd274f
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:54:20 2026 +0100

    another signed commit

commit dfd2c8d0ab2ff2ebc27601fd0bc7beb11c392d2b
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:53:49 2026 +0100

    an example unsigned commit

commit 5b468b41996fcb4146bb8fe9e88aa6735c799fc9 (HEAD -> main)
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:53:01 2026 +0100

    second signed commit

commit f99de69ed074fd3b59570786d515ed4ba56aef12
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:52:15 2026 +0100

    first signed commit

commit 721a520671afc30070c0767baff4f44a4fe72fab
Author: Example User <[email protected]>
Date:   Mon Mar 23 22:51:42 2026 +0100

    initial commit

Situation:

  • forward-only is enabled
  • currently checked out commit id is 5b468b41996fcb4146bb8fe9e88aa6735c799fc9

Now the source-controller would:

  • not accept a reset of HEAD to commit f99de69ed074fd3b59570786d515ed4ba56aef12 as this commit would not be a child of the current checked out commit.
  • not accept commit dfd2c8d0ab2ff2ebc27601fd0bc7beb11c392d2b as it's an unsigned or invalid signed commit
  • would accept commit 683408a1ae2425940ea5cc7b3d9120fdf1dd274f as it is a child commit of 5b468b41996fcb4146bb8fe9e88aa6735c799fc9 and has a valid signature.

This permits only user which are in the list of permitted signers to push commits which are accepted by the source-controller.

This would require to backtrack the git history to a matching current git commit id if new commits are pushed. Not sure how much performance or memory this would cost, but this would improve supply chain security quite a lot, from my point of view.

主要言語
Go
スター
283
フォーク
258
平均マージ
1日 17時間
マージ済み PR（30日）
15

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

fluxcd/source-controller のほかの issue

fluxcd/source-controller の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。