open-platform/mitosis

Fork 0

/goal /ultracode-workflows [POL-3] image provenance via Kyverno verifyImages + platform CI cosign signing #41

New issue

Open

opened 2026-07-01 02:03:50 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:50 +00:00

Owner

Track/Wave: POL-3 · Wave G4 · Size L
Repos: gitops, _app-template, mitosis
Depends on: POL-0, POL-1

Why

Closes a supply-chain gap that does NOT exist at all today — anyone with registry write can deploy an unsigned image. Named as a trust gap in the enterprise vision.

Scope

(1) add a cosign signing step to the app-image CI build; (2) a verifyImages/ImageValidatingPolicy ClusterPolicy requiring that signature on any image admitted to app namespaces. mitosis touched only if cosign key material needs per-fork sealing (XL if so).

Acceptance

A CI-signed image deploys; a manually-pushed unsigned image is rejected at admission, visible in the PolicyReport.

Notes

Design gate: a misconfigured verifyImages in enforce mode can brick every app deploy — settle POL-0's enforce/audit + failurePolicy first.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `POL-3` · Wave **G4** · Size **L** **Repos:** `gitops`, `_app-template`, `mitosis` **Depends on:** POL-0, POL-1 ## Why Closes a supply-chain gap that does NOT exist at all today — anyone with registry write can deploy an unsigned image. Named as a trust gap in the enterprise vision. ## Scope (1) add a cosign signing step to the app-image CI build; (2) a verifyImages/ImageValidatingPolicy ClusterPolicy requiring that signature on any image admitted to app namespaces. mitosis touched only if cosign key material needs per-fork sealing (XL if so). ## Acceptance A CI-signed image deploys; a manually-pushed unsigned image is rejected at admission, visible in the PolicyReport. ## Notes **Design gate: a misconfigured verifyImages in enforce mode can brick every app deploy — settle POL-0's enforce/audit + failurePolicy first.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:50 +00:00

plat added the

goal

roadmap

horizon:governance

labels

2026-07-01 02:03:50 +00:00

plat added a new dependency

2026-07-01 02:04:49 +00:00

#38 /goal /ultracode-workflows [POL-0] DESIGN the policy-authoring & governance-of-governance model (Kyverno)

plat added a new dependency

2026-07-01 02:04:50 +00:00

#39 /goal /ultracode-workflows [POL-1] land Kyverno as a Flux-reconciled component + primitive-independent baselines

plat added a new dependency

2026-07-01 02:04:56 +00:00

#46 /goal /ultracode-workflows [GATE] validated grandchild acceptance gate — secrets+domains+rbac+policy on a VPS depth-2/3 platform

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit

2026-07-01 18:39:53 +00:00

POL-3: Kyverno verifyImages — admit only CI-signed tenant images (plat/mitosis#41)

plat referenced this issue from a commit

2026-07-01 18:39:53 +00:00

POL-3: bake cosign into the CI toolchain image (plat/mitosis#41)

plat referenced this issue from a commit

2026-07-01 18:39:53 +00:00

POL-3: cosign-sign app images in CI (preview + release) (plat/mitosis#41)

plat referenced this issue from open-platform/ci-builder

2026-07-01 18:40:46 +00:00

POL-3: bake cosign into CI toolchain image (plat/mitosis#41) #1

plat referenced this issue from open-platform/app-template

2026-07-01 18:40:47 +00:00

POL-3: cosign-sign app images in CI (plat/mitosis#41) #4

plat referenced this issue from a commit

2026-07-01 20:31:58 +00:00

POL-3: bake cosign into CI toolchain image (plat/mitosis#41) (#1)

plat referenced this issue from a commit

2026-07-01 20:32:02 +00:00

POL-3: cosign-sign app images in CI (plat/mitosis#41) (#4)

plat referenced this issue from a commit

2026-07-01 20:32:05 +00:00

POL-3: image provenance — Kyverno verifyImages (plat/mitosis#41) (#8)

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat added the

operator-decision

label

2026-07-06 14:52:18 +00:00

plat referenced this issue

2026-07-06 14:52:45 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat commented

2026-07-06 19:24:10 +00:00

Author

Owner

cosign SIGNING delivered + proven; verifyImages held at Audit (2026-07-06)

On the product-garden.com granddaughter: generated a platform cosign keypair, sealed it (sops, fork key) into cosign-signing-key.yaml, pasted the real pubkey into verify-image-provenance, and wired COSIGN_PRIVATE_KEY/COSIGN_PASSWORD as Forgejo Actions secrets. The crew-built qa-smoke image was then signed by CI and cryptographically verified:

cosign verify --key cosign.pub git.product-garden.com/plat/qa-smoke:0.1.1
  → The signatures were verified against the specified public key
  identity: forgejo-http.forgejo.svc:3000/plat/qa-smoke  digest: sha256:87a3d48...

So signing works end-to-end. verify-image-provenance is deliberately left at Audit, NOT flipped to Enforce, because of a real gap: plat is a Forgejo user, not an org, so a freshly-generated app repo does NOT auto-receive the COSIGN secrets (only REGISTRY_TOKEN via the dispatcher). Flipping verifyImages→Enforce globally would reject every new app the owner builds (unsigned) → bricked app-building.

Remaining for full POL-3: per-app/per-fork COSIGN secret provisioning (the documented follow-up in cosign-signing-key.yaml) — teach the dispatcher to seal + inject COSIGN secrets onto each app repo like REGISTRY_TOKEN, THEN flip verifyImages to Enforce. Keeping this open for that.

## cosign SIGNING delivered + proven; verifyImages held at Audit (2026-07-06) On the `product-garden.com` granddaughter: generated a platform cosign keypair, sealed it (sops, fork key) into `cosign-signing-key.yaml`, pasted the real pubkey into `verify-image-provenance`, and wired `COSIGN_PRIVATE_KEY`/`COSIGN_PASSWORD` as Forgejo Actions secrets. The crew-built `qa-smoke` image was then **signed by CI and cryptographically verified**: ``` cosign verify --key cosign.pub git.product-garden.com/plat/qa-smoke:0.1.1 → The signatures were verified against the specified public key identity: forgejo-http.forgejo.svc:3000/plat/qa-smoke digest: sha256:87a3d48... ``` So signing works end-to-end. **verify-image-provenance is deliberately left at Audit**, NOT flipped to Enforce, because of a real gap: `plat` is a Forgejo **user, not an org**, so a freshly-generated app repo does NOT auto-receive the COSIGN secrets (only `REGISTRY_TOKEN` via the dispatcher). Flipping verifyImages→Enforce globally would reject every new app the owner builds (unsigned) → bricked app-building. **Remaining for full POL-3:** per-app/per-fork COSIGN secret provisioning (the documented follow-up in `cosign-signing-key.yaml`) — teach the dispatcher to seal + inject COSIGN secrets onto each app repo like `REGISTRY_TOKEN`, THEN flip verifyImages to Enforce. Keeping this open for that.