Give the DR rebuild a signed-artifact publication path #2839
Description
🤖 Generated by the Agentic Engineer
Problem
The DR rebuild (dr-rebuild.yaml) publishes to the same mutable tag as a normal prod deploy — ghcr.io/devantler-tech/platform/manifests:latest — but it never signs what it pushes, and its rebuild job holds no id-token: write, so keyless signing is not even possible.
That makes it a hard blocker on the parent: root-source signature verification cannot be switched on while one writer to the tag publishes unsigned bytes under an identity the allow-list does not name. The first recovery after enabling verification would produce an artifact Flux refuses — during an incident, when manual repair is least available.
Live evidence (2026-07-28)
The posture is currently inverted — every tenant source is verified, the infrastructure root is not:
| Source | spec.verify |
|---|---|
flux-system/flux-system (root) |
null |
ascoachingogvaner, aws, doggy-countdown, github-config, wedding-app |
cosign |
dr-rebuild.yaml job rebuild declares only contents: read + packages: write, and the file contains no cosign invocation at all.
Scope
Give DR a signed-artifact path, leaving verification OFF:
id-token: writeon the rebuild job.- Install cosign and sign the digest DR already resolves (
platform_manifest), not the mutable tag. - Name the DR workflow identity in
ksail.prod.yamlmatchOIDCIdentity, pinned torefs/heads/main. - A CI-enforced contract so none of the four can silently regress.
Why this is safe to land first
Signing an artifact that nothing yet verifies is inert — it changes no reconcile behaviour. It is a strict prerequisite for the parent, and it is the only part that can ship without first making publication atomic.
Acceptance criteria
- The DR rebuild signs the artifact it publishes, using the digest it resolved.
- The DR signing identity is in the cosign allow-list, pinned to
refs/heads/main. - CI fails if the permission, the sign step, the digest pinning, or the allow-list entry is removed.
- No change to production reconcile behaviour (verification remains off).
Part of #2627
Activity
coderabbitai commentedon Jul 28, 2026
🔗 Related PRs
#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [merged]
#2404 - fix: tenant artifact verification rejects the dual signing identities from
#2399[merged]#2457 - fix(talos): accept the actions publish-app identity at node image verification [merged]
#2625 - fix(deploy): synchronize production GHCR pull auth [merged]
#2633 - fix(deploy): verify incoming image on Talos nodes [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
docs(dr): describe DR signing as the keyless OIDC flow it now performs
feat(security): give the DR rebuild a signed-artifact publication path (