trust: switch policy.json lookup to configfile by jankaluza · Pull Request #28508 · containers/podman

jankaluza · 2026-04-14T10:54:10Z

Use shared configfile instead of custom policy.json path handling. This switches ocipull to signature.DefaultPolicy(), removes SignaturePolicyPath plumbing, and updates podman image trust to use --signature-policy.

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Podman now uses shared configfile logic for policy.json resolution and introduces `--signature-policy` for podman image trust. This new option is required for `podman image trust set`.

packit-as-a-service · 2026-04-14T10:57:12Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

packit-as-a-service · 2026-04-14T10:57:12Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

packit-as-a-service · 2026-04-14T10:57:12Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

packit-as-a-service · 2026-04-14T10:57:12Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

Luap99

some smaller comments, overall this seems mostly fine.

Longer term we really need to de duplicate this logic out of podman IMO

mtrmac · 2026-04-14T17:12:53Z

(I have added “No new tests” to let the CI run, and switched the PR to draft, correspondingly. If this PR does end up making changes to the repo, please consider removing the label.)

mtrmac · 2026-04-14T17:47:51Z

-		if err != nil {
-			logrus.Warnf("could not resolve relative path to binary: %q", err)
-		}
-		paths = append(paths, filepath.Join(filepath.Dir(p), DefaultPolicyJSONPath, policyfile))


Note this part, this seems to allow shipping Podman machine in a non-default / relocatable location.

Do we know that this is no longer necessary?

this has never been used or documented by us, it comes from patches before we agreed to not mandate policy.json for podman machine.

Using the officially documented locations consistently seem much much saner to me

OTOH we have this week been talking about starting to sign the machine images, so something like this might be coming.

If we are not worried about breaking users, I’m fine with switching back to the default now and perhaps changing the behavior again later.

Luap99

ack overall, just some minor stuff and the missing docs.

mtrmac

ACK overall, I didn’t carefully look at the CLI integration.

I’ll also drop the “no new tests” label now.

Use shared configfile instead of custom policy.json path handling. This updates ocipull to rely on signature.DefaultPolicy(), removes explicit SignaturePolicyPath, and replaces trust's custom default-policy path logic with common configfile code. Replace hidden `--policypath` with --signature-policy` and require it for `trust set` command instead of path resolution based on configfile. For `trust get`, the `--signature-policy` is optional. Signed-off-by: Jan Kaluza <jkaluza@redhat.com>

Signed-off-by: Jan Kaluza <jkaluza@redhat.com>

jankaluza · 2026-04-20T13:17:14Z

I rebased it to main and also to latest container-libs.

packit-as-a-service · 2026-04-20T13:24:31Z

tmt tests failed for commit cae4c40. @lsm5, @psss, @thrix please check.

jankaluza · 2026-04-20T13:32:09Z

/packit test

Luap99

changes LGTM overall, I would squash commit 1 and 2 though

packit-as-a-service · 2026-04-20T14:00:00Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

mtrmac

LGTM if tests pass. Thanks!

jankaluza · 2026-04-21T04:38:13Z

/packit test

packit-as-a-service · 2026-04-21T04:42:35Z

tmt tests failed for commit cae4c40. @lsm5, @psss, @thrix please check.

jankaluza · 2026-04-21T05:10:59Z

I'm down to revdeps test, which fails with suspicious message:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 04:42:13 ] :: [   FAIL   ] :: Command 'tmt run --id /tmp/tmp.PTfvFVrcdN -vvv' (Expected 0, got 2)
:: [ 04:42:13 ] :: [   FAIL   ] :: File '/var/tmp/rlRun_LOG.cL0FXj6O' should contain 'NAME.*Fedora Linux' 
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 7s
::   Assertions: 0 good, 2 bad
::   RESULT: FAIL (Test)

jankaluza · 2026-04-21T05:15:14Z

But I see the same test failure also on other recent PRs (#28550), so maybe it's just tft issue. I will retry this later today.

Luap99

LGTM, packit tests are non blocking and can be ignored, the tmt reverse dep tests use the wrong netavark version.

github-actions Bot added machine kind/api-change Change to remote API; merits scrutiny labels Apr 14, 2026

jankaluza force-pushed the configfile branch from b767918 to a871b73 Compare April 14, 2026 11:00

jankaluza mentioned this pull request Apr 14, 2026

Use unified configfile parser for policy.json containers/container-libs#711

Merged

Luap99 reviewed Apr 14, 2026

View reviewed changes

Comment thread pkg/domain/infra/abi/trust.go Outdated

Comment thread pkg/domain/infra/abi/trust.go Outdated

Comment thread pkg/domain/infra/abi/trust.go Outdated

mtrmac marked this pull request as draft April 14, 2026 17:12

mtrmac added the No New Tests Allow PR to proceed without adding regression tests label Apr 14, 2026

mtrmac reviewed Apr 14, 2026

View reviewed changes

jankaluza force-pushed the configfile branch from a871b73 to a1e19e8 Compare April 15, 2026 10:40

Luap99 reviewed Apr 15, 2026

View reviewed changes

Comment thread cmd/podman/images/trust_set.go Outdated

Comment thread cmd/podman/images/trust_show.go

mtrmac reviewed Apr 15, 2026

View reviewed changes

Comment thread pkg/domain/infra/abi/trust.go Outdated

mtrmac removed the No New Tests Allow PR to proceed without adding regression tests label Apr 15, 2026

jankaluza force-pushed the configfile branch 3 times, most recently from 9669567 to 53a5d13 Compare April 16, 2026 11:05

jankaluza mentioned this pull request Apr 16, 2026

Update to use shared configfile implementation containers/buildah#6787

Merged

jankaluza added the bloat_approved Approve a PR in which binary file size grows by over 50k label Apr 16, 2026

jankaluza added 3 commits April 20, 2026 15:11

trust: fail on policy path resolution errors, remove fallback logic

03afb74

Signed-off-by: Jan Kaluza <jkaluza@redhat.com>

compat: limit err scope in CommitContainer.

cae4c40

Signed-off-by: Jan Kaluza <jkaluza@redhat.com>

jankaluza force-pushed the configfile branch from 53a5d13 to cae4c40 Compare April 20, 2026 13:12

jankaluza changed the title ~~WIP: trust: switch policy.json lookup to configfile~~ trust: switch policy.json lookup to configfile Apr 20, 2026

Luap99 approved these changes Apr 20, 2026

View reviewed changes

mtrmac mentioned this pull request Apr 20, 2026

Multiple copies of the default signature policy path containers/container-libs#226

Open

mtrmac reviewed Apr 20, 2026

View reviewed changes

jankaluza marked this pull request as ready for review April 21, 2026 05:11

Luap99 approved these changes Apr 21, 2026

View reviewed changes

Luap99 merged commit ff6fb6e into containers:main Apr 21, 2026
90 of 91 checks passed

Conversation

jankaluza commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Does this PR introduce a user-facing change?

Uh oh!

packit-as-a-service Bot commented Apr 14, 2026

Uh oh!

packit-as-a-service Bot commented Apr 14, 2026

Uh oh!

packit-as-a-service Bot commented Apr 14, 2026

Uh oh!

packit-as-a-service Bot commented Apr 14, 2026

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mtrmac commented Apr 14, 2026

Uh oh!

Uh oh!

mtrmac Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Luap99 Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

mtrmac Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mtrmac left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jankaluza commented Apr 20, 2026

Uh oh!

packit-as-a-service Bot commented Apr 20, 2026

Uh oh!

jankaluza commented Apr 20, 2026

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

packit-as-a-service Bot commented Apr 20, 2026

Uh oh!

mtrmac left a comment

Choose a reason for hiding this comment

Uh oh!

jankaluza commented Apr 21, 2026

Uh oh!

packit-as-a-service Bot commented Apr 21, 2026

Uh oh!

jankaluza commented Apr 21, 2026

Uh oh!

jankaluza commented Apr 21, 2026

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jankaluza commented Apr 14, 2026 •

edited

Loading