mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 18:05:31 +02:00
Garry TanandOpenAI Codex
4a3c6a8a3c
* feat(cso): add verified audits and replayable repair bundles * fix(cso): harden qualification and setup boundaries * fix(cso): assemble security canaries at runtime * fix(cso): bound release proof and maintenance work Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): require complete evaluation reports Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): replay expired snapshots from supplied source Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): synchronize DNS cancellation assertion Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore(ship): exempt repository owner from liveness proof Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): make recheck retention overlap deterministic Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: bump version and changelog (v1.85.0.0) Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass native release gates Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.86.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): resolve rechecks by finding Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.87.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass macOS and Windows release gates Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures. Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): harden native verification gates * fix(cso): refine Windows native diagnostics * test(cso): isolate Windows Git startup failure * test(cso): stabilize Windows native diagnostics * fix(cso): support hardened Git on Windows * fix(cso): close final verification gaps * test(cso): bound cold Docker fixture setup * fix(cso): restore cross-platform free-suite gates --------- Co-authored-by: OpenAI Codex <noreply@openai.com>
27 lines
1.4 KiB
Docker
27 lines
1.4 KiB
Docker
# BASE_IMAGE must be a reviewed PostgreSQL image@sha256 digest. The image is
|
|
# rebuilt with a fixed non-root identity so Docker policy and initdb agree.
|
|
ARG BASE_IMAGE
|
|
FROM ${BASE_IMAGE} AS upstream
|
|
|
|
# A fresh image configuration prevents an upstream VOLUME declaration from
|
|
# creating an unbounded anonymous host volume behind the read-only root policy.
|
|
FROM scratch
|
|
COPY --from=upstream / /
|
|
ENV LANG=C.UTF-8 \
|
|
LC_ALL=C.UTF-8 \
|
|
PGDATA=/work/postgresql-data \
|
|
PATH=/opt/cso/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
USER root
|
|
RUN set -eu; \
|
|
if ! awk -F: '$3 == 10001 { found=1 } END { exit found ? 0 : 1 }' /etc/group; then printf 'cso:x:10001:\n' >> /etc/group; fi; \
|
|
if ! awk -F: '$3 == 10001 { found=1 } END { exit found ? 0 : 1 }' /etc/passwd; then printf 'cso:x:10001:10001:CSO PostgreSQL:/work:/sbin/nologin\n' >> /etc/passwd; fi; \
|
|
mkdir -p /opt/cso/bin /work /policy; chown 10001:10001 /work; \
|
|
for tool in initdb postgres createdb psql pg_isready; do target="$(find /usr/lib/postgresql /usr/local -type f -name "$tool" -perm /0111 -print 2>/dev/null | sort | head -n 1)"; test -n "$target"; ln -s "$target" "/opt/cso/bin/$tool"; done
|
|
COPY --chmod=0555 entrypoint /opt/cso/entrypoint
|
|
COPY --chmod=0555 run-postgresql /opt/cso/run-postgresql
|
|
COPY --chmod=0555 postgresql-ready /opt/cso/postgresql-ready
|
|
COPY --chmod=0555 gstack-cso-verifier /opt/cso/verifier
|
|
USER 10001:10001
|
|
WORKDIR /work
|
|
ENTRYPOINT ["/opt/cso/entrypoint"]
|