Merge pull request #3615 from fluxcd/release/1.25.2

Release 1.25.2

Author: Kingdon Barrett

CHANGELOG.md

@@ -8,6 +8,21 @@
 > requests](https://github.com/fluxcd/toolkit/discussions) for Flux v2
 > and Toolkit components.
 
+## 1.25.2 (2022-05-26)
+
+This patch release reverts a deprecation induced during an upgrade of OpenSSH.
+A regression affected Azure DevOps, and Google Cloud Source Repositories users.
+
+### Fixes
+
+- Regression: Allow RSA signatures using SHA-1 hash algorithm [fluxcd/flux#3614][]
+
+### Thanks
+
+Thanks to @mskcode, @dimbleby, @julienduchesne and @pjbgf for their contributions to this release.
+
+[fluxcd/flux#3614]: https://github.com/fluxcd/flux/pull/3614
+
 ## 1.25.1 (2022-05-03)
 
 This release includes a base image upgrade to the Alpine 3.15.4 upstream

chart/flux/CHANGELOG.md

@@ -1,4 +1,13 @@
-## 1.12.0 (2021-12-08)
+## 1.13.0 (2022-05-05)
+
+### Improvements
+
+ - Updated Flux to `1.25.1`
+   [fluxcd/flux#3607](https://github.com/fluxcd/flux/pull/3607)
+ - Add access to `--git-verify-signatures-mode`
+   [fluxcd/flux#3603](https://github.com/fluxcd/flux/pull/3603)
+
+## 1.12.0 (2022-03-30)
 
 ### Improvements
 

chart/flux/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
-appVersion: "1.25.0"
-version: 1.12.0
+appVersion: "1.25.1"
+version: 1.13.0
 kubeVersion: ">=1.16.0-0"
 name: flux
 description: Flux is a tool that automatically ensures that the state of a cluster matches what is specified in version control

chart/flux/README.md

@@ -270,6 +270,7 @@ The following tables lists the configurable parameters of the Flux chart and the
 | `git.setAuthor`                                   | `false`                                              | If set, the author of git commits will reflect the user who initiated the commit and will differ from the git committer.
 | `git.signingKey`                                  | `None`                                               | If set, commits will be signed with this GPG key
 | `git.verifySignatures`                            | `false`                                              | If set, the signatures of the sync tag and commits will be verified
+| `git.verifySignaturesMode`                        | ``                                                   | If set, takes precendence over verifySignatures and sets which strategy to use for signature verification (one of "all", "none", "first-parent")
 | `git.label`                                       | `flux-sync`                                          | Label to keep track of sync progress, used to tag the Git branch
 | `git.ciSkip`                                      | `false`                                              | Append "[ci skip]" to commit messages so that CI will skip builds
 | `git.pollInterval`                                | `5m`                                                 | Period at which to poll git repo for new commits

chart/flux/templates/deployment.yaml

@@ -234,7 +234,11 @@ spec:
           {{- if .Values.git.signingKey }}
           - --git-signing-key={{ .Values.git.signingKey }}
           {{- end }}
+          {{- if .Values.git.verifySignaturesMode }}
+          - --git-verify-signatures-mode={{ .Values.git.verifySignaturesMode }}
+          {{ else }}
           - --git-verify-signatures={{ .Values.git.verifySignatures }}
+          {{ end }}
           - --git-set-author={{ .Values.git.setAuthor }}
           {{- if .Values.git.secret.enabled }}
           - --git-secret

chart/flux/values.yaml

@@ -9,7 +9,7 @@ logFormat: fmt
 
 image:
   repository: docker.io/fluxcd/flux
-  tag: 1.25.0
+  tag: 1.25.1
   pullPolicy: IfNotPresent
   pullSecret:
 
@@ -116,8 +116,10 @@ git:
   email: "[email protected]"
   # If set, commits will be signed with this GPG key.
   signingKey: ""
-  # If set, the signatures of the sync tag and commits will be verified.
+  # If set, the signatures of the sync tag and commits will be verified (deprecated)
   verifySignatures: false
+  # If set, takes precendence over verifySignatures and sets which strategy to use for signature verification (one of "all", "none", "first-parent")
+  verifySignaturesMode: ""
   # If set, the author of git commits will reflect the user who initiated the commit and will differ from the git committer.
   setAuthor: false
   # Label to keep track of sync progress

deploy/flux-deployment.yaml

@@ -66,7 +66,7 @@ spec:
         # There are no ":latest" images for flux. Find the most recent
         # release or image version at https://hub.docker.com/r/fluxcd/flux/tags
         # and replace the tag here.
-        image: docker.io/fluxcd/flux:1.25.1
+        image: docker.io/fluxcd/flux:1.25.2
         imagePullPolicy: IfNotPresent
         resources:
           requests:

docker/ssh_config

@@ -3,3 +3,5 @@ StrictHostKeyChecking yes
 IdentityFile /etc/fluxd/ssh/identity
 IdentityFile /var/fluxd/keygen/identity
 LogLevel error
+HostkeyAlgorithms +ssh-rsa
+PubkeyAcceptedAlgorithms +ssh-rsa

pkg/install/generated_templates.gogen.go

@@ -66,7 +66,7 @@ spec:
         # There are no ":latest" images for flux. Find the most recent
         # release or image version at https://hub.docker.com/r/fluxcd/flux/tags
         # and replace the tag here.
-        image: docker.io/fluxcd/flux:1.25.1
+        image: docker.io/fluxcd/flux:1.25.2
         imagePullPolicy: IfNotPresent
         resources:
           requests: