Garry TanandOpenAI Codex
4a3c6a8a3c
* feat(cso): add verified audits and replayable repair bundles * fix(cso): harden qualification and setup boundaries * fix(cso): assemble security canaries at runtime * fix(cso): bound release proof and maintenance work Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): require complete evaluation reports Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): replay expired snapshots from supplied source Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): synchronize DNS cancellation assertion Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore(ship): exempt repository owner from liveness proof Co-Authored-By: OpenAI Codex <noreply@openai.com> * test(cso): make recheck retention overlap deterministic Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: bump version and changelog (v1.85.0.0) Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass native release gates Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.86.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): resolve rechecks by finding Co-Authored-By: OpenAI Codex <noreply@openai.com> * chore: move release to v1.87.0.0 Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): pass macOS and Windows release gates Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures. Co-Authored-By: OpenAI Codex <noreply@openai.com> * fix(cso): harden native verification gates * fix(cso): refine Windows native diagnostics * test(cso): isolate Windows Git startup failure * test(cso): stabilize Windows native diagnostics * fix(cso): support hardened Git on Windows * fix(cso): close final verification gaps * test(cso): bound cold Docker fixture setup * fix(cso): restore cross-platform free-suite gates --------- Co-authored-by: OpenAI Codex <noreply@openai.com>
CSO scanner image release inputs
The committed scanner catalog is intentionally empty until trusted CI produces real qualification evidence. Nothing in this directory authorizes a host tool, a mutable tag, or an agent-supplied image.
build-inputs.json is the review gate. A reviewed file contains exactly six
profiles, two native image digests per profile, and one immutable SBOM generator.
Every image records its source repository and commit, signer workflow and
digest, and reviewed canonical SLSA/SPDX statement-set digests. CI uses
gh attestation verify with all of those identities and rejects a statement
digest mismatch before the image participates in a build. Each upstream image
must already expose the declared scanner executable. Semgrep images must contain the
reviewed local rules at /policy/catalog/.... OSV and Trivy images must contain
their complete offline data below /opt/cso/scanner-data/...; the release job
copies that path out of the staged image and recomputes its canonical content
hash before running the network-none adapter test. Preparing those asset-bearing
upstream images is an external publication prerequisite, not something an audit
may download on demand.
The wrapper normalizes every image to /opt/cso/entrypoint and
/opt/cso/bin/scanner, embeds the trusted HTTP assertion verifier needed by the
Schemathesis qualification fixture, and runs as a fixed non-root image user.
The product runner still supplies the effective host uid, read-only root,
dropped capabilities, seccomp, no-new-privileges, bounded tmpfs and shared
memory, network
namespace, disabled daemon logging, and watchdog cleanup.
Images that declare VOLUME are rejected; exact cleanup also removes anonymous
volumes defensively.
.github/workflows/cso-scanner-images.yml lets a dispatched branch run only its
read-only input and contract checks. Publishing and native qualification require
a dispatch from protected main plus approval through the
cso-scanner-release environment. That protected lane emits a complete
catalog.json proposal with image, version-output, asset, SBOM, provenance,
source-commit, and workflow identities. Selecting the promotion input may then
open a catalog update pull request. Review that PR like code. The helper
validates the committed catalog at startup and has no fallback when a profile is
absent or incompatible.
Promotion also requires the proposal's previousRevision to equal the catalog
currently on main, so a stale qualification run cannot overwrite a newer one.
GHCR creates a new scanner package private. A package administrator must make
the bootstrap package public in GitHub's package settings before its wrapper can
qualify; GitHub documents this change as irreversible. The qualification row
and the protected promotion job both require public package metadata and pull
the exact platform digest through a fresh Docker client config containing empty
auths. A workflow GHCR login cannot satisfy this gate.