🤖 Generated by the Agentic Engineer
Evidence
Checked against main (2632dc67) on 2026-09-25, while making the Crossplane provider pins visible to dependency automation (#4119):
- Only first-party packages are signature-checked. The proposed-package check collects references with the
ghcr.io/devantler-tech/ prefix only (scripts/collect-first-party-packages/main.go), and admission verification (verify-app-images) names only devantler-tech signing identities. Three of the four Crossplane providers are third-party, so nothing verifies them — whether a bump arrives by hand or from the dependency bot.
- Upbound signs its providers, so a check is possible. Every
xpkg.upbound.io/upbound/provider-* release carries a keyless cosign signature and attestation (377 .sig/.att tags on provider-family-aws). cosign verify on provider-family-aws:v2.6.1 shows the signer: issuer https://token.actions.githubusercontent.com, identity https://github.com/upbound/upbound-official-build/.github/workflows/supplychain.yml@refs/heads/main.
crossplane-contrib/provider-upjet-github is unsigned upstream. It publishes no signature or attestation tags, matching the note in verify-app-images that the crossplane-contrib reusable publish workflow cannot sign.
Audience and problem
Platform operators. The AWS providers hold the platform's AWS CI identity and the GitHub provider manages the organisation's settings, so a tampered or swapped package runs with those privileges. With automated bumps coming (#4119), releases will arrive faster than a person reads them.
Expected behaviour
A third-party provider package is admitted only when its publisher's signature verifies, wherever the publisher signs; where it does not, the pin is immutable.
Acceptance criteria
Size: M — identity pinning is small, but proving admission refuses a bad package needs a careful negative control.
Evidence
Checked against
main(2632dc67) on 2026-09-25, while making the Crossplane provider pins visible to dependency automation (#4119):ghcr.io/devantler-tech/prefix only (scripts/collect-first-party-packages/main.go), and admission verification (verify-app-images) names only devantler-tech signing identities. Three of the four Crossplane providers are third-party, so nothing verifies them — whether a bump arrives by hand or from the dependency bot.xpkg.upbound.io/upbound/provider-*release carries a keyless cosign signature and attestation (377.sig/.atttags onprovider-family-aws).cosign verifyonprovider-family-aws:v2.6.1shows the signer: issuerhttps://token.actions.githubusercontent.com, identityhttps://github.com/upbound/upbound-official-build/.github/workflows/supplychain.yml@refs/heads/main.crossplane-contrib/provider-upjet-githubis unsigned upstream. It publishes no signature or attestation tags, matching the note inverify-app-imagesthat the crossplane-contrib reusable publish workflow cannot sign.Audience and problem
Platform operators. The AWS providers hold the platform's AWS CI identity and the GitHub provider manages the organisation's settings, so a tampered or swapped package runs with those privileges. With automated bumps coming (#4119), releases will arrive faster than a person reads them.
Expected behaviour
A third-party provider package is admitted only when its publisher's signature verifies, wherever the publisher signs; where it does not, the pin is immutable.
Acceptance criteria
upbound/upbound-official-buildsupplychain.ymlidentity — in the proposed-package check, at admission, or both — with a negative control showing an unsigned or wrongly-signed package is refused.provider-upjet-github, which cannot be verified, is pinned by digest so the reviewed bytes are the ones that run, and the reason is recorded next to the pin.Size: M — identity pinning is small, but proving admission refuses a bad package needs a careful negative control.