The safeguards map / 3.7 Admission and owner settings
Flux (OCI source verification)
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
Flux's OCIRepository source can verify the Cosign or Notation signature of an OCI artifact against keys or identities the owner supplies, and records the result on the object.
Where it sits
3.7 Admission and owner settings (primary): Verifies the Cosign or Notation signature of an OCI artifact that a source object points to, using public keys, a trust policy or OIDC identity matchers the owner supplies, and records the outcome as a condition on that object.
.spec.verify is an optional field to enable the verification of Cosign or Notation signatures.
captured
The cosign provider can be used to verify the signature of an OCI artifact using either a known public key or via the Cosign Keyless procedure.
captured
to specify a reference to a Secret in the same namespace as the OCIRepository, containing the Cosign public keys of trusted authors.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
Handoffs
consumes Provenance and signatures: Cosign signatures (including keyless) and Notation signatures
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.