Image mirroring fails

[lazharh]

Describe the bug
Hello when mirroring image of
it fails with error

2026/07/27 18:21:17  [ERROR]  : [Worker] error mirroring image docker://registry.connect.redhat.com/intel/intel-dsa-plugin@sha256:18b1cd603a57255ac387ea056ef5d96f325d59eb66ce78c3cc0fa4f5c0534b6c (Operator bundles: [intel-device-plugins-operator.v0.36.0] - Operators: [intel-device-plugins-operator]) error: reading signatures: reading manifest sha256-18b1cd603a57255ac387ea056ef5d96f325d59eb66ce78c3cc0fa4f5c0534b6c.sig in registry.connect.redhat.com/intel/intel-dsa-plugin: name unknown: Image not found
....
2026/07/27 18:21:17  [ERROR]  : [Worker] error mirroring image docker://registry.connect.redhat.com/intel/intel-gpu-plugin@sha256:2569cfa01f54d7f73acc889c380bc2f7f5a3098866b9b43b48ae2fa9fa34355c (Operator bundles: [intel-device-plugins-operator.v0.36.0] - Operators: [intel-device-plugins-operator]) error: reading signatures: reading manifest sha256-2569cfa01f54d7f73acc889c380bc2f7f5a3098866b9b43b48ae2fa9fa34355c.sig in registry.connect.redhat.com/intel/intel-gpu-plugin: name unknown: Image not found

To Reproduce

set a minfest file with mirroring the plugin operator:

apiVersion: mirror.openshift.io/v2alpha1

apiVersion: mirror.openshift.io/v2alpha1
kind: ImageSetConfiguration
archiveSize: 10
mirror:
  operators:
    - catalog: registry.redhat.io/redhat/certified-operator-index:v4.19
      packages:
        - name: intel-device-plugins-operator
          channels:
            - name: stable
        - name: sriov-fec
          channels:
            - name: stable
              #minVersion: v2.9.0
              #maxVersion: v2.9.0

run oc mirror

oc-mirror -c  imageset-config-intel.yaml --remove-signatures=false --secure-policy=true  --cache-dir ./mirror-cache/  file://./mirror-tar-4226

[ if you set the flags to these it will succeed: --remove-signatures=true --secure-policy=false )

you see the above error.

Expected behavior
expect to mirror the operator to the tar file with no issue

Screenshots
N/A

System (please complete the following information):
oc-mirror version 4.20
Linux any.

Additional context
Add any other context about the problem here.

[lazharh]

it fails also with registry.redhat.io/redhat/certified-operator-index:v4.22

[tkatila]

Thanks @lazharh for the issue. Has this ever worked for you? i.e. did it break?

[lazharh]

we found a why to set the 3rd party operators to not be checked for signature for now. But Red Hat is working internally to ensure all Operator will be signed in the near future

[mythi]

@lazharh thanks for the update. I believe the error message with --remove-signatures=false --secure-policy=true is expected as we don't sign the images (mainly because we've not seen any docs how this expected to work with Redhat Catalog and the certification process).

Can you confirm --remove-signatures=true --secure-policy=false unblocks you and we can work on enabling the signatures later once it becomes fully supported by Redhat Catalog flows?

[lazharh]

@mythi yes It works I tested it already.
What we can expect is that all operators will need to be signed soon.
I think there is an internal initiative to help 3rd party vendor to sign.