From 8bfa81a9ceed6eeb04025e0512f2fe2c4de81088 Mon Sep 17 00:00:00 2001 From: Akos Eros Date: Tue, 11 Aug 2026 13:11:55 +0200 Subject: [PATCH 1/5] feat: Change azure node type to newer generation (v4) Gen V4 is supported and has better availability in most regions --- pattern-metadata.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pattern-metadata.yaml b/pattern-metadata.yaml index 06fbcfcfe..437c77919 100644 --- a/pattern-metadata.yaml +++ b/pattern-metadata.yaml @@ -23,7 +23,7 @@ requirements: type: n1-standard-8 azure: replicas: 3 - type: Standard_D8s_v3 + type: Standard_D8s_v4 aws: replicas: 3 type: m5.2xlarge @@ -34,7 +34,7 @@ requirements: type: n1-standard-4 azure: replicas: 3 - type: Standard_D4s_v3 + type: Standard_D4s_v4 aws: replicas: 3 type: m5.xlarge From 1defd638ce6c5b74562ef0cf5143acdcae378b9f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 04:12:03 +0000 Subject: [PATCH 2/5] build(deps): bump ansible/ansible-lint from 26.6.0 to 26.8.0 Bumps [ansible/ansible-lint](https://github.com/ansible/ansible-lint) from 26.6.0 to 26.8.0. - [Release notes](https://github.com/ansible/ansible-lint/releases) - [Commits](https://github.com/ansible/ansible-lint/compare/262624cd0ab22a4221293216856c59671ce7aa5e...665d9e07a1943254d2910faffc106adaf7ea7294) --- updated-dependencies: - dependency-name: ansible/ansible-lint dependency-version: 26.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ansible-lint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml index ca45d9fb5..bd44cb791 100644 --- a/.github/workflows/ansible-lint.yml +++ b/.github/workflows/ansible-lint.yml @@ -15,4 +15,4 @@ jobs: persist-credentials: false - name: Lint Ansible Playbook - uses: ansible/ansible-lint@262624cd0ab22a4221293216856c59671ce7aa5e + uses: ansible/ansible-lint@665d9e07a1943254d2910faffc106adaf7ea7294 From 84f6942c3c032893c37c76e1a7b7ae4cc1d64882 Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Thu, 6 Aug 2026 18:48:31 +0200 Subject: [PATCH 3/5] Add a non-blocking image signing verification step The idea is that when we use our default container we try and verify the container's signature with cosign (if the binary is present, if it is absent we just warn the user). We do not error out in case of network issues. This is what a normal run will look like: ./pattern.sh make install Verifying image signature for quay.io/validatedpatterns/utility-container... Image signature verified successfully Trying to pull quay.io/validatedpatterns/utility-container:latest... Getting image source signatures Copying blob ac01a0bd520d [--------------------------------------] 4.0MiB / 569.1MiB | 40.6 MiB/s Copying blob 7c52896999c7 [=====================>----------------] 22.2MiB / 38.8MiB | 16.7 MiB/s --- pattern.sh | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/pattern.sh b/pattern.sh index b2172fd4f..3da031d97 100755 --- a/pattern.sh +++ b/pattern.sh @@ -17,6 +17,46 @@ function is_container() { return 1 } +function verify_image() { + local image="$1" + + case "${image}" in + quay.io/validatedpatterns/*|quay.io/hybridcloudpatterns/*) + ;; + *) + echo "Skipping image verification for third-party registry" + return 0 + ;; + esac + + if ! command -v cosign >/dev/null 2>&1; then + echo "WARNING: cosign is not installed, cannot verify image signature" + echo "Install cosign to enable image verification: https://docs.sigstore.dev/cosign/system_config/installation/" + return 0 + fi + + echo "Verifying image signature for ${image}..." + local output rc + local oidc_issuer="${VP_COSIGN_OIDC_ISSUER:-https://token.actions.githubusercontent.com}" + local cert_identity="${VP_COSIGN_CERT_IDENTITY:-https://github.com/validatedpatterns/utility-container/.*}" + output=$(cosign verify \ + --certificate-oidc-issuer "${oidc_issuer}" \ + --certificate-identity-regexp "${cert_identity}" \ + "${image}" 2>&1) && rc=$? || rc=$? + + if [ "${rc}" -eq 0 ]; then + echo "Image signature verified successfully" + elif [ "${rc}" -ge 10 ] && [ "${rc}" -le 13 ]; then + echo "ERROR: Image signature verification failed for ${image} (exit code ${rc})" + echo "${output}" + echo "Set VP_VERIFY_IMAGE=false to skip this check" + exit 1 + else + echo "WARNING: Could not verify image signature for ${image} (likely a network issue)" + echo "Set VP_VERIFY_IMAGE=false to skip this check" + fi +} + if is_container; then echo "Already running in a container" exec "$@" @@ -103,6 +143,10 @@ fi # $HOME is mounted as itself for any files that are referenced with absolute paths # $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials +if [ "${VP_VERIFY_IMAGE:-true}" != "false" ]; then + verify_image "$PATTERN_UTILITY_CONTAINER" +fi + podman run -it --rm --pull=newer \ --security-opt label=disable \ -e ANSIBLE_STDOUT_CALLBACK \ From 5988dee865a6aa0d2360c3029ebeb1f8f763f455 Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Wed, 9 Sep 2026 11:35:57 +0200 Subject: [PATCH 4/5] Fix array expansion with bash 3.x MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On macosx which has bash 3.x michele@Micheles-Mac-mini ~ % bash --version GNU bash, version 3.2.57(1)-release (arm64-apple-darwin25) michele@Micheles-Mac-mini ~ % cat /tmp/t.sh set -euo pipefail PKI_HOST_MOUNT_ARGS=() echo "FOO" echo "${PKI_HOST_MOUNT_ARGS[@]}" michele@Micheles-Mac-mini ~ % /tmp/t.sh FOO /tmp/t.sh: line 6: PKI_HOST_MOUNT_ARGS[@]: unbound variable Where as the same just works on bash 4.x/5.x: bash --version GNU bash, version 5.3.9(1)-release (x86_64-redhat-linux-gnu) ❯ cat /tmp/t.sh set -euo pipefail PKI_HOST_MOUNT_ARGS=() echo "FOO" echo "${PKI_HOST_MOUNT_ARGS[@]}" ❯ /tmp/t.sh FOO ❯ We fix this by using the expression: ${VAR_ARRAY[@]+"${VAR_ARRAY[@]}"} This works both on bash 3.x and also the newer ones. Tested on linux with bash 5.x and on Mac OSX with bash 3.x --- pattern.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pattern.sh b/pattern.sh index b2172fd4f..badc38500 100755 --- a/pattern.sh +++ b/pattern.sh @@ -129,12 +129,12 @@ podman run -it --rm --pull=newer \ -e UUID_FILE \ -e VALUES_SECRET \ -e 'VP_*' \ - "${PKI_HOST_MOUNT_ARGS[@]}" \ + ${PKI_HOST_MOUNT_ARGS[@]+"${PKI_HOST_MOUNT_ARGS[@]}"} \ -v "$(pwd -P)":"$(pwd -P)" \ -v "${HOME}":"${HOME}" \ -v "${HOME}":/pattern-home \ "${PODMAN_ARGS[@]}" \ - "${EXTRA_ARGS_ARRAY[@]}" \ + ${EXTRA_ARGS_ARRAY[@]+"${EXTRA_ARGS_ARRAY[@]}"} \ -w "$(pwd -P)" \ "$PATTERN_UTILITY_CONTAINER" \ "$@" From 8a49b13c6db608ac648e4ce2adafcd028d7983fc Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Thu, 10 Sep 2026 08:32:45 +0200 Subject: [PATCH 5/5] Move comment in the correct place --- pattern.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pattern.sh b/pattern.sh index 7365099f0..7d8937c54 100755 --- a/pattern.sh +++ b/pattern.sh @@ -139,14 +139,14 @@ if [ -n "${EXTRA_ARGS:-}" ]; then EXTRA_ARGS_ARRAY=(${EXTRA_ARGS}) fi -# Copy Kubeconfig from current environment. The utilities will pick up ~/.kube/config if set so it's not mandatory -# $HOME is mounted as itself for any files that are referenced with absolute paths -# $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials - if [ "${VP_VERIFY_IMAGE:-true}" != "false" ]; then verify_image "$PATTERN_UTILITY_CONTAINER" fi +# Copy Kubeconfig from current environment. The utilities will pick up ~/.kube/config if set so it's not mandatory +# $HOME is mounted as itself for any files that are referenced with absolute paths +# $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials + podman run -it --rm --pull=newer \ --security-opt label=disable \ -e ANSIBLE_STDOUT_CALLBACK \