flux v2.9.5

OCIRepository.spec.verify

Verify contains the secret name containing the trusted public keys used to verify the signature and specifies which provider to use to check whether OCI image is authentic.

OCIRepository.spec.verify fields and descriptions
Field / Type	Description
matchOIDCIdentity `object[]`	MatchOIDCIdentity specifies the identity matching criteria to use while verifying an OCI artifact which was signed using Cosign keyless signing. The artifact's identity is deemed to be verified if any of the specified matchers match against the identity.
provider `string` required	Provider specifies the technology used to sign the OCI Artifact. `enum: ["cosign","notation"]` `default: "cosign"`
secretRef `object`	SecretRef specifies the Kubernetes Secret containing the trusted public keys.
trustedRootSecretRef `object`	TrustedRootSecretRef specifies the Kubernetes Secret containing a Sigstore trusted_root.json file. This enables verification against self-hosted Sigstore infrastructure (custom Fulcio CA, self-hosted Rekor instance). The Secret must contain a key named "trusted_root.json".