/goal /ultracode-workflows [POL-3] image provenance via Kyverno verifyImages + platform CI cosign signing #41

open waiting for someone plat opened this 4mo ago view on origin

plat opened this 4mo ago view on origin

Track/Wave: POL-3 · Wave G4 · Size L Repos: gitops, _app-template, mitosis Depends on: POL-0, POL-1

Why

Closes a supply-chain gap that does NOT exist at all today — anyone with registry write can deploy an unsigned image. Named as a trust gap in the enterprise vision.

Scope

(1) add a cosign signing step to the app-image CI build; (2) a verifyImages/ImageValidatingPolicy ClusterPolicy requiring that signature on any image admitted to app namespaces. mitosis touched only if cosign key material needs per-fork sealing (XL if so).

Acceptance

A CI-signed image deploys; a manually-pushed unsigned image is rejected at admission, visible in the PolicyReport.

Notes

Design gate: a misconfigured verifyImages in enforce mode can brick every app deploy — settle POL-0's enforce/audit + failurePolicy first.

--- Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

plat commented 4mo ago

cosign SIGNING delivered + proven; verifyImages held at Audit (2026-07-06)

On the product-garden.com granddaughter: generated a platform cosign keypair, sealed it (sops, fork key) into cosign-signing-key.yaml, pasted the real pubkey into verify-image-provenance, and wired COSIGN_PRIVATE_KEY/COSIGN_PASSWORD as Forgejo Actions secrets. The crew-built qa-smoke image was then signed by CI and cryptographically verified:

cosign verify --key cosign.pub git.product-garden.com/plat/qa-smoke:0.1.1
  → The signatures were verified against the specified public key
  identity: forgejo-http.forgejo.svc:3000/plat/qa-smoke  digest: sha256:87a3d48...

So signing works end-to-end. verify-image-provenance is deliberately left at Audit, NOT flipped to Enforce, because of a real gap: plat is a Forgejo user, not an org, so a freshly-generated app repo does NOT auto-receive the COSIGN secrets (only REGISTRY_TOKEN via the dispatcher). Flipping verifyImages→Enforce globally would reject every new app the owner builds (unsigned) → bricked app-building.

Remaining for full POL-3: per-app/per-fork COSIGN secret provisioning (the documented follow-up in cosign-signing-key.yaml) — teach the dispatcher to seal + inject COSIGN secrets onto each app repo like REGISTRY_TOKEN, THEN flip verifyImages to Enforce. Keeping this open for that.