controller: pass TLS config and insecure to cosign verifier for HelmChart OCI

stealthybox · stealthybox · commit 34c7c9c32649 · 2026-06-04T01:59:48.000-06:00
Pass clientOpts.TLSConfig and clientOpts.Insecure to the cosign
verifier in makeVerifiers so that HelmChart verification of OCI-sourced
charts works against registries behind private CAs and on HTTP.

Signed-off-by: leigh capili &lt;leigh@null.net&gt;
diff --git a/internal/controller/helmchart_controller.go b/internal/controller/helmchart_controller.go
@@ -1313,6 +1313,7 @@ func (r *HelmChartReconciler) makeVerifiers(ctx context.Context, obj *sourcev1.H
 	case "cosign":
 		defaultCosignOciOpts := []scosign.Options{
 			scosign.WithRemoteOptions(verifyOpts...),
+			scosign.WithTLSConfig(clientOpts.TLSConfig),
 		}
 
 		// get the public keys from the given secret

Original file line number	Diff line number	Diff line change
`@@ -1313,6 +1313,7 @@ func (r HelmChartReconciler) makeVerifiers(ctx context.Context, obj sourcev1.H`
`1313`	`1313`	`case "cosign":`
`1314`	`1314`	`defaultCosignOciOpts := []scosign.Options{`
`1315`	`1315`	`scosign.WithRemoteOptions(verifyOpts...),`
	`1316`	`+ scosign.WithTLSConfig(clientOpts.TLSConfig),`
`1316`	`1317`	`}`
`1317`	`1318`
`1318`	`1319`	`// get the public keys from the given secret`