Skip to content

Third-party Crossplane provider packages are never signature-verified #4189

Description

@devantler

🤖 Generated by the Agentic Engineer

Evidence

Checked against main (2632dc67) on 2026-09-25, while making the Crossplane provider pins visible to dependency automation (#4119):

  • Only first-party packages are signature-checked. The proposed-package check collects references with the ghcr.io/devantler-tech/ prefix only (scripts/collect-first-party-packages/main.go), and admission verification (verify-app-images) names only devantler-tech signing identities. Three of the four Crossplane providers are third-party, so nothing verifies them — whether a bump arrives by hand or from the dependency bot.
  • Upbound signs its providers, so a check is possible. Every xpkg.upbound.io/upbound/provider-* release carries a keyless cosign signature and attestation (377 .sig/.att tags on provider-family-aws). cosign verify on provider-family-aws:v2.6.1 shows the signer: issuer https://token.actions.githubusercontent.com, identity https://github.com/upbound/upbound-official-build/.github/workflows/supplychain.yml@refs/heads/main.
  • crossplane-contrib/provider-upjet-github is unsigned upstream. It publishes no signature or attestation tags, matching the note in verify-app-images that the crossplane-contrib reusable publish workflow cannot sign.

Audience and problem

Platform operators. The AWS providers hold the platform's AWS CI identity and the GitHub provider manages the organisation's settings, so a tampered or swapped package runs with those privileges. With automated bumps coming (#4119), releases will arrive faster than a person reads them.

Expected behaviour

A third-party provider package is admitted only when its publisher's signature verifies, wherever the publisher signs; where it does not, the pin is immutable.

Acceptance criteria

  • Upbound provider packages are verified against the upbound/upbound-official-build supplychain.yml identity — in the proposed-package check, at admission, or both — with a negative control showing an unsigned or wrongly-signed package is refused.
  • provider-upjet-github, which cannot be verified, is pinned by digest so the reviewed bytes are the ones that run, and the reason is recorded next to the pin.
  • The Renovate provider rule's note (Crossplane provider packages are invisible to dependency automation, so they never get bumped #4119) is updated to say what is now verified.

Size: M — identity pinning is small, but proving admission refuses a bad package needs a careful negative control.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions