[18.0-fr6] Support per-scope sigstore remap targets

roles/edpm_podman/defaults/main.yml

@@ -110,4 +110,3 @@ edpm_container_signature_verification: false
 edpm_container_signature_cosign_key_data: ""
 edpm_container_signature_cosign_key_path: "/etc/pki/containers/cosign-redhat.pub"
 edpm_container_signature_registry_mappings: []
-edpm_container_signature_signed_prefix: ""

roles/edpm_podman/meta/argument_specs.yml

@@ -192,12 +192,7 @@ argument_specs:
           List of source-to-mirror registry mappings for signature
           verification. Each entry is a dict with 'source' (original
           registry prefix, used as policy.json key) and 'mirror' (mirror
-          registry, used for sigstore attachment lookups). Auto-populated
-          by the openstack-operator from IDMS/ICSP and ClusterImagePolicy.
-      edpm_container_signature_signed_prefix:
-        type: str
-        default: ""
-        description: >
-          Optional original registry prefix where images were signed. When set,
-          edpm_podman writes a remapIdentity signedIdentity policy to map mirror
-          registry references back to the original signing identity.
+          registry, used for sigstore attachment lookups). Entries may
+          also include 'signedPrefix' for per-mapping remapIdentity
+          configuration. Auto-populated by the openstack-operator from
+          IDMS/ICSP and ClusterImagePolicy.

roles/edpm_podman/molecule/install/converge.yml

@@ -31,6 +31,7 @@
         edpm_container_signature_registry_mappings:
           - source: "registry.redhat.io/rhoso"
             mirror: "mirror.example.com:5000/rhoso"
+            signedPrefix: "registry.redhat.io/rhoso"
         edpm_container_signature_cosign_key_data: "{{ test_cosign_key_data }}"
 
     - name: Test podman network ls
@@ -49,7 +50,9 @@
         that:
           - policy.transports.docker["registry.redhat.io/rhoso"][0].type == "sigstoreSigned"
           - policy.transports.docker["registry.redhat.io/rhoso"][0].keyPath == "/etc/pki/containers/cosign-redhat.pub"
-          - "'signedIdentity' not in policy.transports.docker['registry.redhat.io/rhoso'][0]"
+          - policy.transports.docker["registry.redhat.io/rhoso"][0].signedIdentity.type == "remapIdentity"
+          - policy.transports.docker["registry.redhat.io/rhoso"][0].signedIdentity.prefix == "registry.redhat.io/rhoso"
+          - policy.transports.docker["registry.redhat.io/rhoso"][0].signedIdentity.signedPrefix == "registry.redhat.io/rhoso"
           - policy.transports.docker["registry.redhat.io"][0].type == "signedBy"
           - policy.transports.docker["registry.access.redhat.com"][0].type == "signedBy"
       vars:

roles/edpm_podman/tasks/install.yml

@@ -204,13 +204,13 @@
                       'type': 'sigstoreSigned',
                       'keyPath': edpm_container_signature_cosign_key_path
                     } | combine(
-                      (edpm_container_signature_signed_prefix | length > 0)
+                      ((item.signedPrefix | default('')) | length > 0)
                       | ternary(
                           {
                             'signedIdentity': {
                               'type': 'remapIdentity',
                               'prefix': item.source,
-                              'signedPrefix': edpm_container_signature_signed_prefix
+                              'signedPrefix': item.signedPrefix
                             }
                           },
                           {}

zuul.d/projects.yaml

@@ -6,6 +6,10 @@
       - podified-multinode-edpm-baremetal-bootc-pipeline
     github-check:
       jobs:
+        # Keep the bootc container image explicit when the templated job resolves from ci-framework main.
+        - cifmw-crc-podified-edpm-baremetal-bootc:
+            vars:
+              cifmw_update_containers_edpm_image_url: quay.io/openstack-k8s-operators/edpm-bootc:latest-qcow2
         - noop
         - edpm-ansible-tempest-multinode
         - edpm-ansible-baremetal-minor-update