ci: add sigstore e2e test suite by stealthybox · Pull Request #2062 · fluxcd/source-controller

stealthybox · 2026-05-26T06:36:17Z

Add a parallel CI job that deploys a local sigstore stack and runs
verification tests against it.

hack infra:

kind cluster with zot (OCI 1.1 referrers API) and registry:2 (tag fallback)
sigstore scaffold Helm chart (fulcio, rekor, ctlog, trillian)
Scripts for setup, build, and teardown

tests:

v2/v3 key-pair signing with secretRef
v2/v3 keyless signing with trustedRootSecretRef
v3 key-pair with tlog entry
Combined secretRef + trustedRootSecretRef
Registry auth + verify
v3 bundles on registry:2 (referrers tag fallback)
Sad paths: wrong key, wrong identity, wrong rekor key in trusted root

Runs concurrently with the existing kind-linux-amd64 job -- hopefully i've set this up right

matheuscscp

LGTM

stealthybox · 2026-06-04T08:52:26Z

rebased, if this is green, I don't see a problem merging it
edit: it's green ✅

I am extending this significantly to test some auto policy features based off of what's in the the trustbundle.
In other words, we'll need more changes to this harness, but it does already cover the custom trust bundle fairly well.

The idea is to bridge the gap between our existing heuristic/implicit behaviors for Fulcio/Rekor to also support TSA (which GitHub uses for immutable releases)

Once we uniformly implement our existing auto behaviors, Flux users with private/hybrid/third-party sigstore stacks will be able to combine whichever key and trust materials they desire.
This can be done without adding too many fields, however, our end goal should be to add enough configuration that these auto-heuristic behaviors can be made fully deterministic and client-driven, since that is what detailed by the sigstore spec.

Realistically, people will be dynamically loading trustBundles/TUF-roots into these SecretRefs which could change how the verify policy evaluates.

Flux already supports overriding the global TUF root, so that is a considerable part of this as well. Also, whether we choose to support or not-support per-resource TUF roots.

Lastly, there's the topic of TLS/mTLS connections to verification endpoints that are not the OCI registry. We may need to plumb some additional cert fields in. Alternatively, we could load them from a separate, optional data field in the TrustBundle Secret? Not sure if that would violate the spirit of the verification material or not.

stefanprodan · 2026-06-04T08:58:48Z

+      - name: Setup cosign
+        env:
+          COSIGN_VERSION: v3.0.6
+          COSIGN_SHA256: c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74
+        run: |
+          curl -fsSL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" -o /usr/local/bin/cosign
+          echo "${COSIGN_SHA256}  /usr/local/bin/cosign" | sha256sum -c -
+          chmod +x /usr/local/bin/cosign
+      - name: Setup Flux CLI
+        run: curl -fsSL https://fluxcd.io/install.sh | bash


These should be GH Actions so that dependabot can update them.

stefanprodan · 2026-06-04T09:00:13Z

+          kubectl -n fulcio-system get cm fulcio-server-config -o json | \
+            python3 -c "
+          import json, sys
+          cm = json.load(sys.stdin)
+          config = json.loads(cm['data']['config.json'])
+          config['OIDCIssuers']['https://kubernetes.default.svc.cluster.local'] = {
+              'IssuerURL': 'https://kubernetes.default.svc.cluster.local',
+              'ClientID': 'sigstore',
+              'Type': 'kubernetes'
+          }
+          cm['data']['config.json'] = json.dumps(config, indent=2)
+          json.dump(cm, sys.stdout)
+          " | kubectl apply -f -


Let's rewrite this with yq, no need to introduce python3 in our test suite.

matheuscscp · 2026-06-17T22:02:13Z

The diff in this file should vanish after rebasing, as we split OCIRepositoryVerification into OCIRepositoryVerification and HelmChartVerification

matheuscscp · 2026-06-17T22:06:15Z

@stealthybox Are the changes in this file just refactors to allow testing? Are there any significant changes in behavior? If this is safe, we can backport this PR in v1.9.1 so users get the field description improvements in the CRD via k explain ocirepo.spec.verify.trustedRootSecretRef

Add a self-contained harness for exercising cosign verification against a local Sigstore stack on kind. The Makefile drives cluster creation, zot (referrers API) and registry:2 (tag fallback) registries, the sigstore scaffold Helm release, an RFC3161 timestamp authority, the source-controller image build and load, and the cosign CLI fetch. Run the sigstore suite in CI in parallel with the existing e2e job via make targets, installing cosign and the flux CLI through their actions. Assisted-by: GitHub Copilot CLI/gpt-5.5 Assisted-by: Kiro/opus-4.8 Signed-off-by: leigh capili <leigh@null.net>

Signed-off-by: leigh capili <leigh@null.net>

Add test-signing.sh and OCIRepository fixtures exercising the cosign verification flows source-controller already supports: v2/v3 key-pair, v2/v3 keyless with a custom trusted_root.json, v3 key-pair with tlog, combined secretRef plus trustedRootSecretRef, registry auth, and registry:2 tag fallback. Negative cases assert Ready=False with reason VerificationError for a wrong key, wrong identity, and wrong Rekor key. Assisted-by: GitHub Copilot CLI/gpt-5.5 Assisted-by: Kiro/opus-4.8 Signed-off-by: leigh capili <leigh@null.net>

stealthybox · 2026-06-18T03:03:06Z

/me * takes a deep breath *

days_lost_to_mysql_5-7++

stealthybox force-pushed the sigstore-testing branch from 4abda3f to 5e8d2e6 Compare May 26, 2026 06:38

stealthybox force-pushed the sigstore-transport branch 2 times, most recently from 211fb0a to ffa18cc Compare May 26, 2026 16:04

stealthybox force-pushed the sigstore-testing branch from 5e8d2e6 to 106bf50 Compare May 27, 2026 15:35

stealthybox force-pushed the sigstore-transport branch from ffa18cc to b00f7ba Compare June 4, 2026 05:19

stealthybox marked this pull request as draft June 4, 2026 06:41

stealthybox force-pushed the sigstore-testing branch 3 times, most recently from 9599840 to c030efd Compare June 4, 2026 07:19

matheuscscp approved these changes Jun 4, 2026

View reviewed changes

stealthybox force-pushed the sigstore-transport branch from b00f7ba to 34c7c9c Compare June 4, 2026 08:00

stealthybox force-pushed the sigstore-testing branch from c030efd to f40dbee Compare June 4, 2026 08:00

stealthybox marked this pull request as ready for review June 4, 2026 08:26

Base automatically changed from sigstore-transport to main June 4, 2026 08:37

stefanprodan added area/ci CI related issues and pull requests area/testing Testing related issues and pull requests labels Jun 4, 2026

stealthybox force-pushed the sigstore-testing branch from f40dbee to 0a2b4cf Compare June 4, 2026 08:43

stefanprodan added the hold Issues and pull requests put on hold label Jun 4, 2026

stefanprodan reviewed Jun 4, 2026

View reviewed changes

stealthybox force-pushed the sigstore-testing branch 2 times, most recently from c42b70b to aa541c7 Compare June 17, 2026 19:51

matheuscscp reviewed Jun 17, 2026

View reviewed changes

stealthybox added 3 commits June 17, 2026 20:58

hack: match local ARCH for ci scripts

677e1a9

Signed-off-by: leigh capili <leigh@null.net>

stealthybox force-pushed the sigstore-testing branch from 0932699 to 9ad7c6b Compare June 18, 2026 03:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add sigstore e2e test suite#2062

ci: add sigstore e2e test suite#2062
stealthybox wants to merge 3 commits into
mainfrom
sigstore-testing

stealthybox commented May 26, 2026

Uh oh!

matheuscscp left a comment

Uh oh!

stealthybox commented Jun 4, 2026 •

edited

Loading

Uh oh!

stefanprodan Jun 4, 2026

Uh oh!

stefanprodan Jun 4, 2026

Uh oh!

matheuscscp Jun 17, 2026

Uh oh!

matheuscscp Jun 17, 2026 •

edited

Loading

Uh oh!

stealthybox commented Jun 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

stealthybox commented May 26, 2026

Uh oh!

matheuscscp left a comment

Choose a reason for hiding this comment

Uh oh!

stealthybox commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stefanprodan Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

stefanprodan Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

matheuscscp Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

matheuscscp Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stealthybox commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stealthybox commented Jun 4, 2026 •

edited

Loading

matheuscscp Jun 17, 2026 •

edited

Loading

stealthybox commented Jun 18, 2026 •

edited

Loading