feat(source-integrity): Implement Source Integrity checking by olivergondza · Pull Request #25371 · argoproj/argo-cd

olivergondza · 2025-11-20T16:07:55Z

Implements #25148

This replaces the former GPG feature with a more general mechanism to enforce integrity. The design enables introducing various kinds of sources (OCI/Helm) and using various verification mechanisms in the future.

This maintains the manifest API functionality (AppProject's .spec.signatureKeys), but it is interpreting it using the new implementation (no duplicated code, some regression risk)
- It is applied to all git-based application sources - not just the first one.
The AppProject GPG signing keys management is labeled deprecated from now on (UI, CLI, CR), encouraging users to switch to Source Integrity managed through project manifest.
The ability to manage Source Integrity criteria through UI and CLI is left out - only configurable through the Custom Resource. Adding/removing GPG keys (repo-server keyring management) is left unchanged.

Checklist:

Presentation of an application failing Source Integrity criteria:

bunnyshell · 2025-11-20T16:08:01Z

❌ Preview Environment undeployed from Bunnyshell

Available commands (reply to this comment):

🚀 /bns:deploy to deploy the environment

olivergondza · 2025-11-20T16:08:33Z

This is still WIP. Filed for CI feedback...

pkg/apis/application/v1alpha1/source_integrity.go

codecov · 2025-11-27T14:20:25Z

Codecov Report

❌ Patch coverage is 77.90179% with 99 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.68%. Comparing base (c13ba1e) to head (fabce0a).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
util/git/client.go	67.66%	39 Missing and 15 partials ⚠️
pkg/apis/application/v1alpha1/source_integrity.go	59.25%	11 Missing ⚠️
reposerver/repository/repository.go	70.00%	4 Missing and 5 partials ⚠️
util/sourceintegrity/source_integrity.go	91.81%	5 Missing and 4 partials ⚠️
cmd/util/project.go	0.00%	4 Missing ⚠️
controller/state.go	83.33%	3 Missing and 1 partial ⚠️
cmd/argocd/commands/project.go	57.14%	3 Missing ⚠️
server/gpgkey/gpgkey.go	0.00%	3 Missing ⚠️
server/application/application.go	60.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #25371      +/-   ##
==========================================
+ Coverage   62.66%   62.68%   +0.02%     
==========================================
  Files         412      414       +2     
  Lines       55564    55795     +231     
==========================================
+ Hits        34818    34976     +158     
- Misses      17424    17478      +54     
- Partials     3322     3341      +19

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

blakepettersson

All in all I think this is great, awesome work!

I've added a few questions/thoughts, LMK what you think

util/clusterauth/clusterauth_test.go

pkg/apis/application/v1alpha1/source_integrity.go

controller/state.go

server/application/application.go

test/e2e/applicationset_git_generator_test.go

olivergondza · 2026-01-05T10:19:51Z

@jannfis, @blakepettersson, @pasha-codefresh, the implementation is complete. Please review.

server/application/application.go

util/sourceintegrity/source_integrity.go

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

olivergondza · 2026-03-14T09:12:15Z

test/e2e/app_management_ns_test.go

 		})
 }

-func TestNamespacedSyncToUnsignedCommit(t *testing.T) {


Tests moved to app_management_source_integrity_test.go‎ and extended.

olivergondza · 2026-03-14T09:19:29Z

test/e2e/app_management_test.go

 		})
 }

-func TestSyncToUnsignedCommit(t *testing.T) {


Tests moved to app_multiple_sources_source_integrity_test.go.

olivergondza · 2026-03-14T10:15:02Z

docs/user-guide/source-integrity-git-gpg.md

+
+The GnuPG verification requires populating the Argo CD GnuPG keyring, and configuring source integrity policies for your repositories.
+
+## Managing Argo CD GnuPG keyring


Moved from the old location, renamed, unchanged.

I believe mkdocs supports redirects for dropped pages. Can you add a redirect for the old gpg verification page?

Good point. I see we do not use the redirect plugin, and I do not want to pull it in just for this. So I kept nothing but a note on the old location informing about the eventual removal, and linked to the new approach.

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

blakepettersson

I think this in general is in great shape!

I do think we need to have at least CLI support for source integrity, by adding new CLI commands, and ideally (if possible) we should migrate the existing commands to set/unset source-integrity (if the legacy signature keys are not already in use, then that should instead be used).

I'll defer the nitty-gritty of the GPG signing logic to @jannfis

blakepettersson · 2026-03-16T09:19:14Z

docs/user-guide/source-integrity.md

+Each application can be a subject or multiple checks, and the sync will be enabled only when all criteria are met.
+
+> [!NOTE]
+> Source Integrity Verification is only configured through `AppProject` manifests at this point. CLI and UI are not supported.


I do think we should at least have CLI support for this, if not also UI (which we'd default to use source integrity if not already used)

I agree, and CLI is something I intend to work on next. Although, I propose to add it in a separate PR once this is merged, not to add few hundreds LOC to this already giant PR. WDYT?

I'd be fine having this in a separate PR 👍

crenshaw-dev · 2026-03-16T15:37:25Z

reposerver/repository/repository.proto

-    // Request to verify the signature when generating the manifests (only for Git repositories)
-    bool verifySignature = 16;
+    // Source integrity constrains to verify the sources before use
+    github.com.argoproj.argo_cd.v3.pkg.apis.application.v1alpha1.SourceIntegrity sourceIntegrity = 16;


This would be a breaking API change. Do we have a path to deprecate/remove the old verify style API results?

Thanks. Let me re-add verifyResult and signatureInfo here.

@crenshaw-dev, backward compatibility is restored.

…fication Signed-off-by: Oliver Gondža <ogondza@gmail.com>

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

olivergondza requested a review from a team as a code owner November 20, 2025 16:07

olivergondza force-pushed the proposal-source-policies-poc branch 4 times, most recently from 71850e2 to 53d5533 Compare November 26, 2025 13:02

blakepettersson reviewed Nov 26, 2025

View reviewed changes

pkg/apis/application/v1alpha1/source_integrity.go Outdated Show resolved Hide resolved

olivergondza force-pushed the proposal-source-policies-poc branch from 09dae5d to 0b618a1 Compare November 27, 2025 13:44

olivergondza force-pushed the proposal-source-policies-poc branch from 0b618a1 to de3d402 Compare November 28, 2025 13:33

blakepettersson reviewed Nov 28, 2025

View reviewed changes

olivergondza commented Dec 1, 2025

View reviewed changes

test/e2e/applicationset_git_generator_test.go Outdated Show resolved Hide resolved

olivergondza force-pushed the proposal-source-policies-poc branch 4 times, most recently from 36c6663 to 3362313 Compare December 1, 2025 20:22

olivergondza requested review from a team as code owners December 4, 2025 13:08

olivergondza force-pushed the proposal-source-policies-poc branch 3 times, most recently from c6aac44 to d04c6fa Compare December 10, 2025 13:20

olivergondza mentioned this pull request Dec 10, 2025

docs: Proposal: Source Integrity Policies #25148

Merged

11 tasks

olivergondza force-pushed the proposal-source-policies-poc branch 2 times, most recently from 27c964a to 826199b Compare December 15, 2025 11:51

olivergondza force-pushed the proposal-source-policies-poc branch 2 times, most recently from 183de87 to fcca2c9 Compare January 2, 2026 09:07

olivergondza force-pushed the proposal-source-policies-poc branch from 96e2a51 to 707740f Compare January 5, 2026 10:53

blakepettersson reviewed Jan 11, 2026

View reviewed changes

olivergondza added 10 commits March 14, 2026 08:58

feat(source-integrity): Collapse problems by key, reduce to 10

1d686cb

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

Update after rebase

437c381

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

feat(source-integrity): More flexible repo spec

70ac6e3

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

feat(source-integrity): Add support for semantic constraints

fbc74d7

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

chore: Please linters

18c8ddb

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

fix(source-integrity): Fix test

970a92d

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

feat(source-integrity): Ensure only one policy can match

51cbb6d

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

Fix tests

a760966

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

fix(docs): Reflect page move

979c528

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

chore: Fix lint after rebase

01bacb0

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

olivergondza force-pushed the proposal-source-policies-poc branch from 5491ff0 to 01bacb0 Compare March 14, 2026 07:58

olivergondza commented Mar 14, 2026

View reviewed changes

olivergondza force-pushed the proposal-source-policies-poc branch from e542849 to 66202dc Compare March 14, 2026 10:45

Style improvements

8f2e093

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

olivergondza force-pushed the proposal-source-policies-poc branch from 66202dc to 8f2e093 Compare March 14, 2026 12:51

olivergondza added 3 commits March 15, 2026 08:47

Merge branch 'master' into proposal-source-policies-poc

0f12f0c

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

Merge branch 'master' into proposal-source-policies-poc

c409d9c

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

Merge branch 'master' into proposal-source-policies-poc

1d64d08

blakepettersson requested changes Mar 16, 2026

View reviewed changes

blakepettersson modified the milestones: v3.5, v3.3 Mar 16, 2026

crenshaw-dev requested changes Mar 16, 2026

View reviewed changes

feat(source-integrity): Preserve API compatibility for signature veri…

1ecc55b

…fication Signed-off-by: Oliver Gondža <ogondza@gmail.com>

blakepettersson mentioned this pull request Mar 17, 2026

feat: (PoC) Source Verification Policies #14966

Closed

13 tasks

docs: Keep the old doc page for external links

bd867a4

Signed-off-by: Oliver Gondža <ogondza@gmail.com>


		The GnuPG verification requires populating the Argo CD GnuPG keyring, and configuring source integrity policies for your repositories.

		## Managing Argo CD GnuPG keyring

Conversation

olivergondza commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bunnyshell bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Preview Environment undeployed from Bunnyshell

Uh oh!

olivergondza commented Nov 20, 2025

Uh oh!

Uh oh!

codecov bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blakepettersson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

olivergondza commented Jan 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blakepettersson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

olivergondza commented Nov 20, 2025 •

edited

Loading

bunnyshell bot commented Nov 20, 2025 •

edited

Loading

codecov bot commented Nov 27, 2025 •

edited

Loading