Repository navigation
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
1pav
force-pushed
the
wip/oci-deploy-no-fetch-remote-with-tests
branch
from
June 11, 2026 13:18
01c718f to
80cf57f
Compare
swick
reviewed
Jun 11, 2026
| 'system,nodeltas', | ||
| 'system,deltas', | ||
| 'system-norevokefs,nodeltas', | ||
| 'system-norevokefs,deltas', |
Collaborator
There was a problem hiding this comment.
Maybe a bit more general question: shouldn't we just add the test to test-auth.sh instead?
Contributor
Author
There was a problem hiding this comment.
I opted for a separate file because it looks like adapting test-auth.sh to also accomodate the OCI case would make the whole script a bit messy. That module is largely ostree-specific in how remote and token are setup. Adding OCI auth tests there would mean spawning a second mock web server (i.e. the OCI registry) and setting up a second (OCI) remote.
In flatpak_pull_from_oci we can be in in the system helper where we pull the mirrored OCI image into the system repo. However, to fetch the signatures in GPG signed repos, we used a remote OciImageSource created through `flatpak_remote_state_fetch_image_source`. This caused fetching some data from the registry which we don't want in the deploy method, and also fails if a token is required to access the repo. This change fetches the signatures from the mirrored OCI repo instead of pulling them from the remote OciImageSource. The signatures can come from anywhere because we verify them against the GPG key in the system repo. The important bit is the change in `flatpak_pull_from_oci` where we now pass in the local image_source to fetch the signatures from, and in the system helper, where we get the right metadata to check the signatures against (eventually ends up in `flatpak_oci_signatures_verify`).
…istry Add infrastructure for testing OCI installations from auth-protected registries. The mock server now supports requiring a bearer token on all /v2/ requests, configurable via a new POST /testing-auth/configure admin endpoint. The client gains a corresponding 'configure-auth' subcommand. Assisted-by: Cursor
1pav
force-pushed
the
wip/oci-deploy-no-fetch-remote-with-tests
branch
from
June 11, 2026 17:05
963fb1a to
449e7d5
Compare
1pav
changed the title
Add a regression test that installs from an auth-protected OCI registry. The registry requires a bearer token for all /v2/ requests; the client authenticates via the mock test authenticator and the installation completes successfully. The test runs for both user and system install paths. Assisted-by: Cursor
1pav
force-pushed
the
wip/oci-deploy-no-fetch-remote-with-tests
branch
from
June 11, 2026 17:14
449e7d5 to
35efa19
Compare
Contributor
Author
|
Closing as testing code in this PR was included in #6682 and merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a regression test for the fix introduced in #6682.
This adds
test-oci-auth.sh, which starts the mock OCI registry with bearer token auth enabled, configures the test authenticator so the client can mirror the image, then runs an install. With the fix the system helper does not access the online registry during deploy at all, so the install succeeds. Without the fix the system helper's unauthenticated manifest fetch returns 401 and the install fails.Depends on: #6682
Assisted-by: Cursor