Repository navigation
oci-registry: Check signatures from mirrored repo in the system helper - #6682
Merged
Merged
Conversation
owtaylor
reviewed
Jun 10, 2026
owtaylor
left a comment
owtaylor
left a comment
Contributor
There was a problem hiding this comment.
As far as I can tell without testing, this should fix the problem. I do find the result a bit hard and confusing to read - some suggestions for improving attached.
In flatpak_pull_from_oci we can be in in the system helper where we pull the mirrored OCI image into the system repo. However, to fetch the signatures in GPG signed repos, we used a remote OciImageSource created through `flatpak_remote_state_fetch_image_source`. This caused fetching some data from the registry which we don't want in the deploy method, and also fails if a token is required to access the repo. This change fetches the signatures from the mirrored OCI repo instead of pulling them from the remote OciImageSource. The signatures can come from anywhere because we verify them against the GPG key in the system repo. The important bit is the change in `flatpak_pull_from_oci` where we now pass in the local image_source to fetch the signatures from, and in the system helper, where we get the right metadata to check the signatures against (eventually ends up in `flatpak_oci_signatures_verify`).
swick
force-pushed
the
wip/oci-deploy-no-fetch-remote
branch
from
June 11, 2026 15:33
a41c990 to
7809169
Compare
…istry Add infrastructure for testing OCI installations from auth-protected registries. The mock server now supports requiring a bearer token on all /v2/ requests, configurable via a new POST /testing-auth/configure admin endpoint. The client gains a corresponding 'configure-auth' subcommand. Assisted-by: Cursor
swick
marked this pull request as ready for review
June 11, 2026 15:41
Collaborator
Author
Add a regression test that installs from an auth-protected OCI registry. The registry requires a bearer token for all /v2/ requests; the client authenticates via the mock test authenticator and the installation completes successfully. The test runs for both user and system install paths. Assisted-by: Cursor
swick
force-pushed
the
wip/oci-deploy-no-fetch-remote
branch
from
June 11, 2026 18:19
3e3f80d to
35efa19
Compare
Collaborator
Author
|
Pulled in trivial changes from #6683 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In flatpak_pull_from_oci we can be in in the system helper where we pull the mirrored OCI image into the system repo. However, to check for signatures in GPG signed repos, we used an OciImageSource in the repo to fetch the signatures. This caused fetching some data from the registry which we don't want in the deploy method, and also fails if a token is required to access the repo.
This change uses the signatures in the mirrored OCI repo instead of pulling them from the lookaside server. The signatures can come from anywhere because we verify them against the GPG key in the system repo.