# How can you make Flux refuse an OCI artifact that wasn't signed by your CI pipeline?

Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/how-can-you-make-flux-refuse-an-oci-artifact-that-wasnt-signed-by-your-ci-pipeline

- A. Set spec.insecure: false, which turns on signature checks
- B. Add a Kyverno verifyImages policy that targets the flux-system namespace
- C. Set spec.verify on the OCIRepository with provider cosign or notation
- D. Enable commit signing on the Kustomization's sourceRef

**Answer:** Set spec.verify on the OCIRepository with provider cosign or notation

**Explanation:** With spec.verify, source-controller checks the Cosign or Notation signature before it produces an artifact, so no Kustomization or HelmRelease sees unsigned content. For keyless Cosign signatures from CI, matchOIDCIdentity pins the expected issuer and subject.