v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)

* feat(cso): add verified audits and replayable repair bundles * fix(cso): harden qualification and setup boundaries * fix(cso): assemble security canaries at runtime * fix(cso): bound release proof and maintenance work Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): require complete evaluation reports Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): replay expired snapshots from supplied source Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): synchronize DNS cancellation assertion Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore(ship): exempt repository owner from liveness proof Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): make recheck retention overlap deterministic Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: bump version and changelog (v1.85.0.0) Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass native release gates Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.86.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): resolve rechecks by finding Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.87.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass macOS and Windows release gates Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures. Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): harden native verification gates * fix(cso): refine Windows native diagnostics * test(cso): isolate Windows Git startup failure * test(cso): stabilize Windows native diagnostics * fix(cso): support hardened Git on Windows * fix(cso): close final verification gaps * test(cso): bound cold Docker fixture setup * fix(cso): restore cross-platform free-suite gates --------- Co-authored-by: OpenAI Codex <noreply@openai.com>
2026-09-23 05:10:50 +02:00 · 2026-09-14 15:14:58 -07:00
parent 9f81911136
commit 4a3c6a8a3c
160 changed files with 24697 additions and 2288 deletions
@@ -0,0 +1,48 @@
+# CSO scanner image release inputs
+
+The committed scanner catalog is intentionally empty until trusted CI produces
+real qualification evidence. Nothing in this directory authorizes a host tool,
+a mutable tag, or an agent-supplied image.
+
+`build-inputs.json` is the review gate. A reviewed file contains exactly six
+profiles, two native image digests per profile, and one immutable SBOM generator.
+Every image records its source repository and commit, signer workflow and
+digest, and reviewed canonical SLSA/SPDX statement-set digests. CI uses
+`gh attestation verify` with all of those identities and rejects a statement
+digest mismatch before the image participates in a build. Each upstream image
+must already expose the declared scanner executable. Semgrep images must contain the
+reviewed local rules at `/policy/catalog/...`. OSV and Trivy images must contain
+their complete offline data below `/opt/cso/scanner-data/...`; the release job
+copies that path out of the staged image and recomputes its canonical content
+hash before running the network-none adapter test. Preparing those asset-bearing
+upstream images is an external publication prerequisite, not something an audit
+may download on demand.
+
+The wrapper normalizes every image to `/opt/cso/entrypoint` and
+`/opt/cso/bin/scanner`, embeds the trusted HTTP assertion verifier needed by the
+Schemathesis qualification fixture, and runs as a fixed non-root image user.
+The product runner still supplies the effective host uid, read-only root,
+dropped capabilities, seccomp, no-new-privileges, bounded tmpfs and shared
+memory, network
+namespace, disabled daemon logging, and watchdog cleanup.
+Images that declare `VOLUME` are rejected; exact cleanup also removes anonymous
+volumes defensively.
+
+`.github/workflows/cso-scanner-images.yml` lets a dispatched branch run only its
+read-only input and contract checks. Publishing and native qualification require
+a dispatch from protected `main` plus approval through the
+`cso-scanner-release` environment. That protected lane emits a complete
+`catalog.json` proposal with image, version-output, asset, SBOM, provenance,
+source-commit, and workflow identities. Selecting the promotion input may then
+open a catalog update pull request. Review that PR like code. The helper
+validates the committed catalog at startup and has no fallback when a profile is
+absent or incompatible.
+Promotion also requires the proposal's `previousRevision` to equal the catalog
+currently on `main`, so a stale qualification run cannot overwrite a newer one.
+
+GHCR creates a new scanner package private. A package administrator must make
+the bootstrap package public in GitHub's package settings before its wrapper can
+qualify; GitHub documents this change as irreversible. The qualification row
+and the protected promotion job both require public package metadata and pull
+the exact platform digest through a fresh Docker client config containing empty
+`auths`. A workflow GHCR login cannot satisfy this gate.
@@ -0,0 +1,8 @@
+{
+  "schemaVersion": 1,
+  "helperAbi": 3,
+  "state": "pending",
+  "sbomGenerator": null,
+  "profiles": [],
+  "instructions": "Add one reviewed, digest-pinned SBOM generator and exactly one profile for each scanner. Every platform image and the generator must declare its GitHub repository, source commit, release, signer workflow and signer digest, plus canonical SLSA and SPDX statement-set digests that the workflow re-verifies cryptographically before use. Semgrep bases must contain the reviewed rules bundle. OSV and Trivy bases must contain the declared offline databases. Change state to reviewed only after all identities and content hashes have been independently checked."
+}
@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "revision": "cso-scanners-v3-unqualified",
+  "previousRevision": null,
+  "helperAbi": 3,
+  "scanners": []
+}
@@ -0,0 +1,20 @@
+{
+  "schemaVersion": 1,
+  "helperAbi": 3,
+  "state": "pending",
+  "platforms": ["linux/amd64", "linux/arm64"],
+  "scanners": ["gitleaks", "osv", "semgrep", "zizmor", "trivy", "schemathesis"],
+  "requiredChecks": [
+    "native image build from a reviewed immutable upstream digest",
+    "verified upstream and wrapper provenance plus SPDX SBOM",
+    "exact version-output hash through the fixed entrypoint",
+    "adapter feature contract and representative output normalization",
+    "network-none target execution with read-only source and exact cleanup",
+    "secret canary redaction and malformed-output failure",
+    "Semgrep rules or OSV/Trivy database content hash matches reviewed input",
+    "OSV and Trivy complete a representative scan with no network",
+    "Schemathesis reaches only an admitted loopback fixture and completes selected operations"
+  ],
+  "promotion": "CI emits a complete immutable catalog proposal. Only an environment-approved run from protected main may open the source-controlled catalog promotion PR.",
+  "rollback": "Restore the previous compatible scanner catalog revision; never replace a missing profile with a host executable or mutable image tag."
+}
@@ -0,0 +1,19 @@
+# BASE_IMAGE is a separately reviewed scanner image digest. For Semgrep, OSV,
+# and Trivy it must already contain the reviewed immutable rules/database path.
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+ARG SCANNER_EXECUTABLE
+USER root
+RUN set -eu; \
+    case "$SCANNER_EXECUTABLE" in /*) ;; *) exit 64 ;; esac; \
+    test -x "$SCANNER_EXECUTABLE"; \
+    test -x /bin/sh; test -x /bin/sleep; test -x /bin/cp; test -x /bin/cat; \
+    mkdir -p /opt/cso/bin /work /source /policy /fixtures; \
+    ln -s "$SCANNER_EXECUTABLE" /opt/cso/bin/scanner; \
+    chown 10001:10001 /work
+COPY --chmod=0555 images/entrypoint /opt/cso/entrypoint
+COPY --chmod=0555 images/run-app /opt/cso/run-app
+COPY --chmod=0555 images/gstack-cso-verifier /opt/cso/verifier
+USER 10001:10001
+WORKDIR /work
+ENTRYPOINT ["/opt/cso/entrypoint"]