Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-60567

Sigstore signatures failed to be checked on mirror repos for disconnected environments after a new policy is created

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Normal Normal
    • None
    • 4.20.0
    • Node / Kubelet
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      When using a disconnected environment it's not possible to pull images from mirror repos, after a ClusterImagePolicy is created.

      Version-Release number of selected component (if applicable):

          4.20.0

      How reproducible:

      Create a disconnected environment with a ClusterImagePolicy, try to pull an image from original/main repo, signature is going to be validated and image is pulled successfully. 
      After this, try to pull the same image from mirror repo. Signature is going to error out and image is not going to be pulled.    

      Pre-requirements (mirroring image)

          1. Change local /etc/containers/registries.d to accept sigstore attachments
          2. Execute skopeo copy to copy the image + signature
          3. Execute skopeo inspect to verify that the image + signature were copied
          4. (Additional) Execute cosign verify to double-check that signature was stored
      All these steps are in the file "mirror_execution.txt"

      Steps to Reproduce:

       1. Enable featureGate TechPreviewNoUpgrade 
       2. Create a ContainerRuntimeConfig and ImageTagMirrorSet CRs
       3. Create a ClusterImagePolicy for the Original and Mirror Repos "clusterImagePolicy_disconnected.yaml"
       4. Create a pod pulling the image from mirror repo, an SignatureValidationError will happen "d_log1.txt", "success_fail.png" (mirror repo pod is on the left side)
       5. Create a pod pulling the image from main/original repo, image is going to be pulled successfully "d_log2.txt", "success_fail.png" (original repo pod is on the right side)

       

      Actual results:

      Mirror repo image fails to be created due to a SignatureValidationError, even after checking with skopeo and cosign that the signature is in there, copied (pre-requirements steps).

      Expected results:

      Signature should be validated successfully.

      Additional info:

      Step-by-step to create a disconnected environment here.

        1. success_fail.png
          success_fail.png
          373 kB
        2. mirror_execution.txt
          33 kB
        3. image-2025-08-19-18-55-42-450.png
          image-2025-08-19-18-55-42-450.png
          242 kB
        4. d_log2.txt
          25 kB
        5. d_log1.txt
          36 kB
        6. clusterImagePolicy_disconnected.yaml
          0.6 kB

              aos-node@redhat.com Node Team Bot Account
              rh-ee-anahas Alice Nahas
              None
              None
              Min Li Min Li
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: