mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 09:55:29 +02:00
Garry TanandOpenAI Codex
4a3c6a8a3c
* feat(cso): add verified audits and replayable repair bundles * fix(cso): harden qualification and setup boundaries * fix(cso): assemble security canaries at runtime * fix(cso): bound release proof and maintenance work Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): require complete evaluation reports Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): replay expired snapshots from supplied source Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): synchronize DNS cancellation assertion Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore(ship): exempt repository owner from liveness proof Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): make recheck retention overlap deterministic Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: bump version and changelog (v1.85.0.0) Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass native release gates Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.86.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): resolve rechecks by finding Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.87.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass macOS and Windows release gates Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures. Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): harden native verification gates * fix(cso): refine Windows native diagnostics * test(cso): isolate Windows Git startup failure * test(cso): stabilize Windows native diagnostics * fix(cso): support hardened Git on Windows * fix(cso): close final verification gaps * test(cso): bound cold Docker fixture setup * fix(cso): restore cross-platform free-suite gates --------- Co-authored-by: OpenAI Codex <noreply@openai.com>
49 lines
2.9 KiB
Markdown
49 lines
2.9 KiB
Markdown
# CSO scanner image release inputs
|
|
|
|
The committed scanner catalog is intentionally empty until trusted CI produces
|
|
real qualification evidence. Nothing in this directory authorizes a host tool,
|
|
a mutable tag, or an agent-supplied image.
|
|
|
|
`build-inputs.json` is the review gate. A reviewed file contains exactly six
|
|
profiles, two native image digests per profile, and one immutable SBOM generator.
|
|
Every image records its source repository and commit, signer workflow and
|
|
digest, and reviewed canonical SLSA/SPDX statement-set digests. CI uses
|
|
`gh attestation verify` with all of those identities and rejects a statement
|
|
digest mismatch before the image participates in a build. Each upstream image
|
|
must already expose the declared scanner executable. Semgrep images must contain the
|
|
reviewed local rules at `/policy/catalog/...`. OSV and Trivy images must contain
|
|
their complete offline data below `/opt/cso/scanner-data/...`; the release job
|
|
copies that path out of the staged image and recomputes its canonical content
|
|
hash before running the network-none adapter test. Preparing those asset-bearing
|
|
upstream images is an external publication prerequisite, not something an audit
|
|
may download on demand.
|
|
|
|
The wrapper normalizes every image to `/opt/cso/entrypoint` and
|
|
`/opt/cso/bin/scanner`, embeds the trusted HTTP assertion verifier needed by the
|
|
Schemathesis qualification fixture, and runs as a fixed non-root image user.
|
|
The product runner still supplies the effective host uid, read-only root,
|
|
dropped capabilities, seccomp, no-new-privileges, bounded tmpfs and shared
|
|
memory, network
|
|
namespace, disabled daemon logging, and watchdog cleanup.
|
|
Images that declare `VOLUME` are rejected; exact cleanup also removes anonymous
|
|
volumes defensively.
|
|
|
|
`.github/workflows/cso-scanner-images.yml` lets a dispatched branch run only its
|
|
read-only input and contract checks. Publishing and native qualification require
|
|
a dispatch from protected `main` plus approval through the
|
|
`cso-scanner-release` environment. That protected lane emits a complete
|
|
`catalog.json` proposal with image, version-output, asset, SBOM, provenance,
|
|
source-commit, and workflow identities. Selecting the promotion input may then
|
|
open a catalog update pull request. Review that PR like code. The helper
|
|
validates the committed catalog at startup and has no fallback when a profile is
|
|
absent or incompatible.
|
|
Promotion also requires the proposal's `previousRevision` to equal the catalog
|
|
currently on `main`, so a stale qualification run cannot overwrite a newer one.
|
|
|
|
GHCR creates a new scanner package private. A package administrator must make
|
|
the bootstrap package public in GitHub's package settings before its wrapper can
|
|
qualify; GitHub documents this change as irreversible. The qualification row
|
|
and the protected promotion job both require public package metadata and pull
|
|
the exact platform digest through a fresh Docker client config containing empty
|
|
`auths`. A workflow GHCR login cannot satisfy this gate.
|