Refresh vulnerable tooling in the published devcontainer image #280

Activity

1. rmcdaniel

   added

   bugSomething isn't workingSomething isn't working

   kind:defectA public product behavior is incorrectA public product behavior is incorrect

   priority:P1High-priority product or release riskHigh-priority product or release risk

   status:readyReady for implementationReady for implementation

   on Oct 30, 2026
2. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   Last edited by rmcdaniel

   MemberAuthor

   More actions

   Draft PR #281 is now at 7210348f7d6e83dd7842ebf2a4b33889c5cbcead. Both native development-image builds and Codespaces startup qualifications pass, including ARM64. All 35 current-head checks pass, including both native application-image smoke jobs, PHP 8.4/8.5, Node, microservice, policy, Sonar and every SDK scenario. Final activity-recovery run 41038501065 completed successfully at 10:33:52 UTC; live rollup independently reconfirmed at 10:50 UTC. The previous 2e16575 / 33-check result remains historical. Publication prerequisites remain open; no replacement is published.

   Completed qualification:

   • Complete native amd64 development image at runtime-source 03189a1 builds and passes its full non-root verifier: repaired tools, Python trust and ordinary fresh virtual environment, Rust build/cache, baked dependencies/permissions/database seed, real Chromium DOM, FFmpeg conversion, and exact Brotli marker/roundtrip/package ownership/five ELF consumers. Later scanner/test and publisher-cataloger corrections change no image recipe or runtime payload.
   • Actual startup through the normal entrypoint passes with the seeded reference MariaDB 11.4.13 and Redis 8.10.3: application user identity, Docker-socket group readiness, Docker/Compose compatibility, Core 2.15.8, migrations, /up and application home HTTP 200. This isolated source-copy startup is separate from the normal hosted Codespaces qualification. All test services, network and data volume were removed.
   • Full-image SPDX generation and current pinned Trivy assessment: zero blocking findings, 12 exact component negatives, 6 reviewed unfixed critical residuals and 528 no-fix highs. Inventories include all 440 Debian source identities and 1,107 Cargo entries across six graphs, plus Composer, Go, Node and Python. All graphs are scanned; the authoritative 190-dependency playground graph and retained lockfile SHA-256 must match exactly. These are local content checks, not published-index/provenance acceptance.
   • The exact workflow’s pinned standard BuildKit Syft generator now passes against the complete qualified filesystem. A real negative control exposed omitted Node/Composer inventories when a custom selection reset directory defaults; all five pinned image-only catalogers are explicitly restored. Corrected raw SPDX statement SHA-256 is f52595e4fe8401a716c72f2d3c729b656e515010298b14e54772c55370412789, with all 440 Debian / 1,107 Cargo / 252 Composer / 159 Node / 115 Go / 42 Python entries. Its source-mapped scan passes the unchanged policy: zero blockers, 12 exact component negatives, 6 reviewed unfixed critical residuals and 528 no-fix highs. All 546 high/critical tuples agree with the direct-image scan. Named local OCI subjects and content hashes are verified; original-recipe provenance and published platform/registry acceptance remain separate. Both task builders/state volumes and complete image copies are removed.
   • Current automated checks: 44 attestation/wheel/scan behavior tests, including real CLI success, invalid-digest refusal and no-write coverage; focused PHP image/playground contracts 17 tests / 168 assertions. Hosted PHP 8.4 and 8.5 each pass 162 application tests / 1,363 assertions with one fixture warning and 11 Node tests; both microservice jobs, target qualification, Sonar, workflow lint and full-branch public-boundary checks pass.
   • Complete amd64 application image at repaired-tool source a645f98 builds with real official Chromium, Vite assets, Brotli and trust checks. Earlier PHP 8.4/8.5 source suites and the prior-image published PHP playground journey remain valid only for their recorded scope.

   The pip repair remains byte reproducible (26.2.2+sample.1, urllib3 2.8.0, fixed setuptools seeds), with all 478 wheel RECORD entries verified and a fresh ordinary venv qualified after Debian package reinstallation. npm is explicitly 12.2.1+sample.1 with fixed compatible bundled undici; Compose is 5.6.1+sample.1, and gosu 1.20 is built from exact upstream source with the maintained compiler. Real npm/node-gyp HTTPS and Docker/Compose checks pass.

   The publisher uses a pinned standard Syft generator with Cargo enabled. Required Cargo metadata binds the exact lockfile bytes and authoritative package set while preserving/scanning additional installed SDK fixture graphs. Debian source aliases are translated and verified against the returned scan inventory. Exact reviewed dispositions retain evidence and reject changed identity/source/version; reviewed residuals block when a supported fix appears. The separate daily workflow rescans published main.

   The old published image is rejected by the added Cargo-lock/inventory contract. Its prior complete source-mapped scan found 140 fixed blockers per platform after exact dispositions; earlier incomplete counts are superseded. Preserve its immutable index for rollback. Known root-lock rustls medium/low findings remain visible follow-up under the established high/critical gate.

   Still required: completion of current-head SDK checks, exact published platform attestations/scans, anonymous dual-registry verification and main-channel promotion. The replacement has not been published, and the original acceptance criteria remain open.

   Current-head image evidence: candidate build and normal Codespaces qualification succeeded in 7m45s including cleanup; both native application-image smoke jobs succeeded. The repaired Python helper reproduced pip SHA-256 d5594bb5e4d42e5580ae9c50831eb7f6fce8279646aa799211917a253132beed and setuptools seed SHA-256 ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2; all 478 pip RECORD entries remain valid. The standalone verifier now emits verified SPDX/identity JSON on stdout; its library contract is unchanged. Browser installation uses the exact locked local executable without an on-demand install fallback.

   Native PR qualification extension: the candidate workflow now builds and runs the same startup qualifier on native Ubuntu amd64 and arm64 with no-cache, read-only permissions and no registry credentials/publication. Matrix failures or cancellations fail the retained aggregate check. Run 41038501162 is terminal success at 7210348: ARM job 124005164793 (6m22s), amd64 job 124005165061 (7m22s), aggregate 124008234948. Local publisher/image/playground contracts pass 17 tests / 175 assertions. Published platform subjects, attestations, anonymous registries and promotion still require the normal publisher.

   Independent Security review of the exact native qualification and source boundary is complete. The PR remains draft with auto-merge disabled pending the existing publication prerequisite; all current CI runs are terminal.
3. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   Exact pip 26.2.2 wheel review narrows the seven HIGH Python rows without waiving the candidate rescan:

   • Both msgpack 1.1.2 rows are not reachable in this wheel. pip ships only the pure-Python msgpack implementation (no _cmsgpack extension); the affected code and fixes are in the C/Cython implementation. CacheControl does use msgpack, but resolves to that fallback.
   • The pip-attributed setuptools 70.3.0 row is also not reachable. The wheel contains only pip/_vendor/pkg_resources; it does not contain setuptools/package_index.py or the affected PackageIndex.download implementation.
   • The separately installed system setuptools 66.1.1 is real build/package tooling. Its two HIGH rows remain actionable; 78.1.1 satisfies both fixes.
   • pip's vendored urllib3 2.7.0 is used by its network/session/download paths. The two HIGH rows remain plausibly reachable, and installing top-level urllib3 2.8.0 would not replace pip._vendor.urllib3.
   • The related MEDIUM GHSA-gh4c-6fx4-qh6g is mitigated for archive downloads because pip passes decode_content=False, but remains reachable for package-index responses: response.content flows through Requests iter_content() to raw.stream(..., decode_content=True).

   Current upstream pip main at dfe27f0d4726c65cfdbef810e067f56e19cd38fc updates msgpack to 1.2.3 but still lists urllib3 2.7.0 and setuptools 70.3.0; stable PyPI remains 26.2.2. Therefore the candidate needs either a supported vendored-urllib3 correction or an explicit development-image risk disposition, followed by the already-required exact-platform full scan. This is not a production incident or a hold on unrelated work.
4. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   Security source review of successor a3f9ea144e2db67ae9401e260a00300d79995dfb clears the packaging objections raised against the prior candidate:

   • git diff --check passes. The regenerated urllib3 patch has 121 zero-context hunks, no context/trailing-whitespace lines, and the builder explicitly requires git apply --unidiff-zero.
   • Independent old/new builds produced byte-identical patched wheels with all 478 RECORD entries valid.
   • A disposable Debian Bookworm acceptance exercised the real sequence: install distribution seed packages, apply --seed, create and qualify a fresh ordinary venv, reinstall python3-pip-whl and python3-setuptools-whl, run --clean-seeds, then create and qualify another fresh ordinary venv.
   • After reconciliation, the retired distribution originals and diverted archives were absent. The only ensurepip seeds were pip 26.2.2+sample.1 and setuptools 84.2.1; both fresh venvs reported those versions and vendored urllib3 2.8.0.

   This clears the source-level security review for this repair. Full replacement-image build/scan, both native architectures, publication qualification, and durable CI wiring for the new wheel-integrity test remain outstanding producer/General acceptance—not a security hold on unrelated work.
5. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   Security review found a fail-open in the in-progress candidate scanner: a new unfixed CRITICAL row is currently placed in the non-blocking unfixed list unless it is manually named as reachable, and the new test_supported_distribution_no_fix_inventory_is_reported test preserves that behavior. That would let a newly published critical advisory pass without a recorded disposition.

   The risk-tiered correction is narrow:

   • continue blocking every supported fixed-version HIGH/CRITICAL row;
   • block every unreviewed unfixed CRITICAL row by default;
   • permit only exact, source-bound reviewed no-fix CRITICAL dispositions (advisory ID, normalized PURL/version, SBOM source, reason and durable evidence);
   • continue reporting no-fix HIGH inventory without turning it into an automatic release hold;
   • add a negative regression proving a novel unfixed CRITICAL row blocks.

   The current baseline has two unfixed CRITICAL rows that can receive exact reviewed dispositions rather than forcing an impossible zero count:

   • CVE-2026-6653, libxml2 2.9.14+dfsg-1.3~deb12u6: Debian marks Bookworm vulnerable but postponed/minor because the fix requires the 2.11 line. The described path requires malicious XML reaching xmlParseInternalSubset with entity-resolution handling. The Sample source review found no untrusted XML parsing path. This remains a development container; arbitrary workspace code already executes inside it, so causing its own process to parse attacker-chosen XML does not add authority. Debian evidence: https://security-tracker.debian.org/tracker/CVE-2026-6653
   • CVE-2025-7458, sqlite3 3.40.1-2+deb12u2: Debian marks Bookworm vulnerable/no-DSA/minor. SQLite's upstream disposition says the bug requires arbitrary SQL and was fixed in 3.42.0. The image does use SQLite through Laravel/PDO and developer tooling, but current source exposes no arbitrary-SQL endpoint; untrusted values flow through application-controlled queries. Any changed PURL/version/source or newly demonstrated SQL-injection path must invalidate the disposition. Debian: https://security-tracker.debian.org/tracker/CVE-2025-7458 ; upstream: https://sqlite.org/cves.html#cve_2025_7458

   This is a correction to the candidate qualification control, not an incident or a hold on unrelated work. No operator action is required.
6. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   Security re-review binds the scanner/policy/workflow clearance to exact commit 8af73063fb3dbd13ddcc19c2be4626d55380d546.

   The earlier fail-open is corrected:

   • every unreviewed unfixed CRITICAL finding blocks by default;
   • the two current Debian no-fix CRITICAL findings are exact PURL/version/source/distribution rules and remain visible in a separate reviewed_unfixed_critical receipt with reason and vendor evidence;
   • a supported fix overrides a residual disposition, and a mismatched source cannot inherit it;
   • fixed-version HIGH/CRITICAL findings continue to block, while no-fix HIGH inventory remains reported without becoming an impossible zero-count gate;
   • control-only changes trigger the lightweight current-main rescan instead of unnecessary no-cache dual-architecture rebuilds;
   • candidate qualification and promotion consume the exact dual-registry digest that passed both platform scans, and post-promotion verification anonymously re-hashes both public indexes.

   Verification on the exact committed tree:

   • 28/28 scanner, attestation and wheel-integrity behavioral tests passed;
   • git diff --check, git show --check, and targeted actionlint passed;
   • the central qualification policy checkout matched current main, and its validator accepted the complete workflow set;
   • exact task-container cleanup passed;
   • the full anonymous wrapper resolved the same public index and four registry/platform identities, then exited 1 as required on the vulnerable old main; amd64 and arm64 each reported 137 blockers, 3 component negatives, 2 reviewed critical residuals and 42 no-fix highs with a fresh DB;
   • the worktree was clean after commit.

   This clears the source-level security gate at that exact commit. It does not clear the replacement image build, native amd64/arm64/browser qualification, candidate scan, public publication or promotion, which remain open producer acceptance. No operator action is required.
7. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   Independent review of the official gosu 1.20 release found that it improves the current Bookworm binary but is not scanner-clean under this issue's new gate.

   • The official amd64 and arm64 release assets and SHA256SUMS verify against the maintainer key documented by upstream (B42F6819007F00F88E364FD4036A9C25BF357DD4), and their hashes match the GitHub release metadata. The source tag resolves to commit 29b939aa5bd4dc588af765b8248f6e39150d2565; that commit itself is not signed.
   • Both binaries are static CGO-disabled gosu 1.20.0 builds containing Go 1.24.6, github.com/moby/sys/user 0.4.1, and golang.org/x/sys 0.1.0. An isolated amd64 root-to-nobody switch passed.
   • Upstream's exact release workflow passed binary govulncheck across the assets, and 1.20 fixes GO-2026-6686 by updating moby/sys/user to 0.4.1.
   • Nevertheless, the pinned Trivy 0.76.1 rootfs scan against a database updated at 2026-10-30T01:01:11Z reports 1 CRITICAL and 25 HIGH findings on each binary, all against the embedded Go 1.24.6 standard library with fixed versions available. It reports no HIGH/CRITICAL finding against moby/sys/user or x/sys.

   Therefore the prebuilt 1.20 binaries must not be represented as a clean replacement or covered by a blanket no-network waiver. The cleaner candidate is the exact 1.20 source rebuilt CGO-disabled with the current supported Go release (currently 1.27.3), followed by both-architecture scan and real privilege-switch/startup qualification. The upstream binary govulncheck result is useful exact reachability evidence if a reviewed-residual path is needed, but it does not erase the version-based scanner findings.

   Official references: https://github.com/tianon/gosu/releases/tag/1.20 ; https://github.com/tianon/gosu/blob/1.20/SECURITY.md ; https://go.dev/doc/devel/release#go1.27.3

   This is candidate guidance for the existing published surface, not a hold on unrelated work and requires no operator action.
8. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   Correction to the end-to-end clearance in the preceding security receipt: the policy logic at exact commit 8af73063fb3dbd13ddcc19c2be4626d55380d546 remains verified against its normalized input contract, but the complete scanner/workflow gate is not cleared while a real SPDX-to-vulnerability-scan reconciliation gap remains.

   The old-image BuildKit SPDX inventory carries Debian binary/source aliases in PURL qualifiers, including:

   • libaom3 → source aom;
   • libmbedcrypto7 → source mbedtls;
   • linux-libc-dev → source linux;
   • zlib1g → source zlib.

   The current SBOM scan path did not preserve/use those source identities the way the direct image scan did. The direct scan consequently produced a materially larger Debian inventory, including fixed-version findings that the SBOM path can omit. That means the earlier real old-image rejection proved the policy blocked the findings it received, but did not prove that it received every source-mapped finding.

   End-to-end clearance now additionally requires:

   • exact preservation or deterministic reconstruction of Debian source-package identity through the SPDX scan path;
   • negative regressions covering the four observed binary/source aliases above;
   • exact reconciliation of the direct-image and SBOM-derived Debian inventories, with any intentional difference explained by target/source semantics rather than waived as a count delta;
   • rerunning the real dual-registry/two-platform old-image negative control and the eventual candidate scans after the correction.

   The previously verified default-block behavior for unreviewed CRITICAL findings and the exact two residual rules are not withdrawn. This is a separate inventory-completeness gap, not an authorization for new waivers. No candidate has been promoted, no customer impact was observed, and no operator action is required.
9. rmcdaniel commented on Oct 30, 2026

   

   rmcdaniel

   on Oct 30, 2026

   MemberAuthor

   More actions

   The Debian source-identity completeness correction is security-cleared at exact commit 217d8748b2bd45c279dd70b1fcf100f2780b4c82 (direct parent 8af73063fb3dbd13ddcc19c2be4626d55380d546). This resolves the end-to-end limitation recorded in the correction receipt.

   The correction derives a scanner-only SPDX copy from the digest-verified attestation evidence while leaving the original evidence unchanged. It translates each attested Debian upstream PURL qualifier into the source identity format consumed by the pinned Trivy decoder, then requires Trivy to return every exact binary name/version with the expected decomposed source name, epoch, version and release. Missing, duplicate, conflicting, malformed, changed or extra Debian identities refuse qualification. No new exception or residual disposition was added.

   Verification on the immutable commit:

   • the worktree is clean; the commit changes only the scanner and its behavioral tests; git show --check passes;
   • all 33 scanner, attestation and wheel-integrity behavioral tests pass independently in a non-root, read-only, network-disabled container;
   • the real old-image wrapper resolved the same public index and four registry/platform identities, used the fresh pinned database, and exited 1 as required;
   • the scanner returned exactly 444 Debian packages for 444 mappings on amd64 and 441 for 441 on arm64;
   • both platforms now report 153 blockers (21 CRITICAL and 132 HIGH), three exact component negatives, two exact reviewed no-fix CRITICAL residuals, and 530/529 reported no-fix HIGH findings;
   • the four initially observed aliases (libaom3/aom, libmbedcrypto7/mbedtls, linux-libc-dev/linux, and zlib1g/zlib) retain their exact source identities on both platforms.

   This restores source-level scanner/workflow clearance at 217d8748. It does not clear the replacement candidate build, native image scan, publication, or promotion; those producer acceptance steps remain open. No operator action is required.
10. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security review of the 13 newly exposed no-fix CRITICAL rows from the corrected source-mapped old-image scan is complete. All rows remain blocking until exact PURL/version/source-bound reviewed rules and negative regressions are committed; this is not a source-package-wide waiver.

    The rows divide into nine source-association/component negatives and four present but narrowly reviewable residuals.

    Exact returned row(s)	Classification and evidence
    zlib1g 1:1.2.13.dfsg-1, CVE-2023-45853	Component negative. Debian records that the affected MiniZip code is not built by Bookworm src:zlib and that no binary package from this source version is affected. Inspection of the exact published amd64 image found zero MiniZip paths in zlib1g. Debian
    libmbedcrypto7 2.28.3-1, CVE-2025-47917	Component negative. The affected function is mbedtls_x509_string_to_names(); upstream says applications not calling it directly are unaffected. The image installs only libmbedcrypto7 (reverse dependency librist4), not the Mbed X.509 library containing that function. Debian, upstream
    libmbedcrypto7 2.28.3-1, CVE-2026-34873 and CVE-2026-34875	Version/component negatives. Upstream limits both advisories to Mbed TLS 3.5.0 and later affected lines; the installed 2.28.3 library is outside those ranges. TLS-session advisory, FFDH advisory
    openssh-server and openssh-sftp-server 1:9.2p1-2+deb12u10, CVE-2026-60002	Component negatives. The upstream defect and fix are expressly client-side in ssh(1) when a server changes its host key during rekey; source-package matching associated it with server binaries that do not contain that path. Debian, upstream
    linux-libc-dev 6.1.190-1, CVE-2026-90037, CVE-2026-98805 and CVE-2026-99083	Component negatives. These defects are respectively in NFSD, TIPC encryption and ksmbd kernel runtime code. The installed package contains 977 userspace headers and zero ELF objects; the container uses the host kernel and does not ship those runtime implementations. NFSD, TIPC, ksmbd
    libaom3 3.6.0-1+deb12u3, CVE-2023-6879	Present exact residual. FFmpeg links the library and exposes the AV1 encoder. The defect requires increasing frame resolution during a multithreaded encode; Debian marks Bookworm minor/no-DSA. This is a development image in which workspace code already executes with the developer identity, so this path adds no separate remote/customer authority. Any customer-facing media path or supported fix invalidates the disposition. Debian
    libsqlite3-0 3.40.1-2+deb12u2, CVE-2025-7458	Present exact residual matching the already reviewed sqlite3 CLI source/version. The defect requires arbitrary SQL. Reviewed application-controlled queries expose no arbitrary-SQL endpoint; a demonstrated SQL-injection path invalidates the disposition. Debian, upstream context
    libglib2.0-0 2.74.6-2+deb12u9, CVE-2026-58016	Present exact residual. The issue is an out-of-bounds-read denial of service in g_dbus_node_info_new_for_xml() on malformed D-Bus introspection XML. Debian marks it minor/postponed, and source review found no application path to that API or input. A newly demonstrated introspection-XML path invalidates the disposition. Debian
    openssh-client 1:9.2p1-2+deb12u10, CVE-2026-60002	Present exact residual. The client is installed. Exploitation requires a malicious server to change its host key during client-side key re-exchange; Debian marks Bookworm minor/postponed. This is a developer-initiated client path, not the exposed SSH server path. A supported Bookworm fix or broader upstream impact invalidates the disposition. Debian, upstream

    Runtime inspection used the exact published amd64 manifest sha256:5568b49fdfd2f88883f8c5b566d6e86a7ca493009f617da6dc5bac9d3624cc84 with no network or mutation. The repository contains no g_dbus_node_info_new_for_xml, Mbed affected-function, NFSD, TIPC, or ksmbd path. The 13 rows must remain visible in the qualification receipt after disposition; changed package identity, version, source evidence, advisory range, image role, or reachability must fail closed.

    This review creates no operator action and does not clear the replacement candidate, native scans, publication, or promotion.
11. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Source-only security clearance for the fixed development-image tools is bound to exact commit a645f983965ad8991888753225c860af5e695756 (direct parent 4eef953441107f5565d3809e07a1e1c8101f1b61). The worktree is clean, the commit contains only the reviewed Dockerfile, Go-tool source note/patch and npm installer changes, and git show --check passes.

    Independent source verification matched:

    • the official gosu 1.20 release target and pinned source-archive SHA-256 (the upstream tag commit remains explicitly unsigned rather than being represented as signed);
    • the GitHub-verified Compose 5.6.1 commit and pinned source-archive SHA-256;
    • the pinned official Go 1.27.3 image digest/version and the added module hashes against sum.golang.org;
    • the official npm registry metadata and artifact SHA-256 for Undici 6.29.1, its Node engine range, and npm 12.2.1's only bundled dependency consumer (node-gyp 13 with a compatible ^6.25.0 range).

    The exact source uses checked archives, a checked patch base, a read-only Go module graph, local toolchain selection, CGO-disabled builds, actual version/privilege probes, exact old npm component and consumer checks, replacement-only extraction, and an explicit custom npm version. Producer evidence on this source reports successful real source-stage builds, zero HIGH/CRITICAL findings in the rebuilt amd64 tools and patched npm inventory, a real gosu root-to-unprivileged switch, Compose configuration against the host Docker API, npm registry access, and node-gyp HTTPS header installation.

    This clears only the source and those bounded producer checks at a645f983. It does not clear the final dual-architecture full image, startup/socket behavior, candidate scans, publication, or promotion. The 13 source-mapped old-image rows remain blocking until the exact rules and regressions from the residual matrix are committed and verified. No operator action is required.
12. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security clearance for the exact reviewed-disposition policy change is bound to commit 487e5fe (direct parent a645f98). The worktree is clean; git show --check passes; the commit changes only scripts/ci/devcontainer-security.json, scripts/ci/scan-devcontainer-image.py, and tests/ci/test_devcontainer_scan.py. Independent non-root, read-only, network-none execution passes all 35 tests/ci tests. Mechanical review confirms 14 unique exact component-negative PURL/advisory rows and 6 unique exact reviewed-unfixed-critical rows, with no duplicate identities or empty source/evidence fields. The 9 newly classified component negatives and 4 newly reviewed residuals match the exact 13-row security matrix; this is not a source-package-wide waiver. Component negatives remain bound to exact PURL, installed version, attested source identity, and required component. Reviewed residuals additionally fail closed when a supported fix appears. This clears the committed policy/scanner/test change only. Full candidate-image clearance remains pending the real wrapper scan and runtime/build qualification.
13. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security clearance for the persistent Cargo-inventory correction is bound to exact commit 03189a1 (direct parent 391d97f). The clean seven-file commit passes git show --check. It pins the standard BuildKit Syft generator by immutable index digest and creator version, retains the exact playground Cargo.toml/Cargo.lock in the final image, removes only dependency-local registry source lockfiles after the locked build, and requires both platform attestations to contain exactly the authoritative Cargo graph with the exact retained-lock SHA256, source path, package names, versions and PURLs. Missing, substituted, duplicated, inconsistent or checksum-changed evidence fails closed; no Cargo waiver or custom scanner was added.

    The isolated proof removed 129 dependency-local locks while preserving 155 crate archives/sources, then completed a fresh empty-target, network-none, locked/offline client+worker build. The real pinned-generator SPDX export is bound to Cargo.lock SHA256 ecb767b9d9af35d7ba7228cfd5da84740a9462c4cc35c7365f690606f76c1025 and contains exactly 190 unique registry Cargo PURLs from the 191-package lock graph (the local workspace root has no registry PURL), including durable-workflow 4.1.0 and rustls 0.23.45. The authoritative lock scan has zero High/Critical findings; the visible rustls 0.23.45 result is one non-reachable Medium plus three Low findings fixed in 0.23.46, retained as non-blocking follow-up.

    Independent exact-commit checks: all 41 CI behavior tests pass in a non-root, read-only, network-none container; targeted devcontainer workflow actionlint passes with pinned actionlint 1.7.7; the actual prototype SPDX passes the final helper at 190 packages and the exact lock digest; the focused PHP image contract passes 7 tests / 95 assertions. The Cloud owner also reports the full central qualification passing 41 Python tests and 16 PHP tests / 150 assertions. This clears the committed source/evidence change. Exact-source replacement build, startup, platform scan, native arm64, publication and rollback-preserving promotion remain separate acceptance gates.
14. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security clearance for the multi-Cargo-graph correction is bound to exact commit 2904b725c095135c23b2dd45bc393b667506bfa0 (direct parent 03189a169702faee8c2fdc0cc68c5d2355938ae2). The worktree is clean, git show --check passes, and the commit changes only the scanner and its behavioral tests (19 insertions, 3 deletions).

    The real full-image Syft inventory showed that the development image legitimately contains six Cargo lock graphs: the authoritative Rust playground graph plus five installed SDK/Workflow integration-fixture graphs. The correction still requires the exact authoritative source path, retained-lock digest, and complete 190-PURL root inventory, while preserving every additional Cargo package in the SPDX input for normal Trivy scanning. PURL/name/version disagreement and duplicate authoritative packages fail closed. A fixed HIGH/CRITICAL finding in any additional Cargo graph remains blocking; no exception or waiver was added.

    Independent exact-commit and actual-image verification:

    • all 43 tests/ci behavioral tests pass with bytecode writes disabled, leaving the worktree clean;
    • the unchanged exact local candidate image is sha256:3fe0354fcbcbe4ed61b99d56727230fdc8e2a5b271cfa73e317ef7b85d122aaa (built from the preceding image-content commit; this two-file scanner/test correction does not change image bytes);
    • the full Syft SPDX SHA-256 is 8dc6782bf82aceaa71e380c5fc1e7b02ee9e7399e277b404218e267b02bf1329 and contains 190 authoritative Cargo PURLs plus 917 fixture PURLs, 1,107 total;
    • source mapping verifies all 440 Debian identities, and the all-package Trivy result includes Cargo 1,107, Composer 252, Debian 440, Go binary 115, Node 159, and Python 42 package rows;
    • the final assessment has zero blockers, 12 exact component negatives, 6 exact reviewed no-fix CRITICAL residuals, and 528 visible no-fix HIGH findings; the assessment SHA-256 is 753df6bf04318f10391f9102539302ce7c5e2a2e1c9385b6aa90bf394809f8c7;
    • the Cloud owner's isolated normal-start acceptance passed as UID 1000 with the Docker socket, MariaDB, Redis, migrations, /up HTTP 200 and the root page, followed by exact removal of all temporary containers, seed data, network and data volume.

    This clears the committed correction and the bounded local exact-image/startup evidence. It does not claim native arm64, published-index/attestation/provenance, registry publication, main-branch promotion, or rollback-preserving replacement clearance; those gates remain open. No operator action is required.
15. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Additional completeness check for the exact local candidate evidence cleared in the preceding receipt: the fresh direct-image Trivy report (eccc9236bdebe204c52243a5f918f11ed009a5919ad67d5b5de8f12c0898a8fa) and the full source-mapped SPDX Trivy report (833ebf1a34ac7cfc0065077bcc4e490aae3dbe4312a4b539543ce92243eda658) have exactly equal HIGH/CRITICAL finding multisets: 546 rows / 546 unique tuples on advisory ID, package name, installed version, fixed version and severity, with zero rows unique to either path. This closes the local direct-versus-attested scanner completeness comparison without suppressing findings. Published subjects/platform attestations remain separate gates as already recorded.
16. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security review of the corrected pinned BuildKit producer is bound to exact candidate head 7a2f02ddd340e4d5be3b8db9aafdd643c343e757 (workflow correction 07feede99e1be441320e089591a7d9832270a3ca over the already-cleared scanner commit 2904b725c095135c23b2dd45bc393b667506bfa0). The clean branch changes only the publisher workflow, scanner/policy tests, and the publisher contract test; git show --check passes.

    The first real pinned-generator run correctly failed the unchanged required-inventory policy: setting SELECT_CATALOGERS replaces the pinned scanner's source defaults, and BuildKit supplies a directory target, so filtering to the image,file tags had omitted all five image-only catalogers, including installed Composer and Node packages. The correction explicitly restores exactly the five image-only catalogers present in pinned Syft 1.51.0 and strengthens the source contract assertion. It adds no waiver, policy relaxation, custom scanner, or runtime change.

    The corrected full producer ran with the exact workflow selector against the previously qualified native amd64 image. The resulting Syft 1.51.0 / BuildKit 0.33.1 SPDX contains 2,162 packages: Debian 440, Cargo 1,107 (including the exact authoritative 190-package inventory and retained-lock SHA-256 ecb767b9d9af35d7ba7228cfd5da84740a9462c4cc35c7365f690606f76c1025), Composer 252, Node 159, Go 115, and Python 42. All 440 Debian source aliases validate. The local named SPDX and provenance statements are both bound to the derived OCI platform digest, while published registry binding, original-recipe provenance, arm64, and promotion remain normal CI/owner gates.

    The unchanged policy assessment reports zero blocked findings, 12 exact component negatives, 6 reviewed unfixed critical findings, and 528 visible no-fix High findings. Its 546 High/Critical tuples exactly equal the prior qualified direct-image scan (zero symmetric difference). Both task builders/containers/state and 7,999,570,904 bytes of OCI/layout scratch were removed; disk returned to 71% with 56 GB free. Security has no hold on opening the ordinary pull request.
17. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security follow-up for the repaired hosted-qualification head is bound to exact commit 2e1657522fe3d24e788fc485656d0b919b1cdb5e (direct parent 7a2f02ddd340e4d5be3b8db9aafdd643c343e757, whose producer/scanner clearance is recorded above).

    The six-file repair is narrow and security-preserving: it invokes the already-installed Playwright binary directly instead of allowing npx resolution, makes the Python tooling builder's required output path explicit to static analysis, returns verified attestation identity and SPDX on stdout without an arbitrary output write, updates the stale Rust image contract to the actual pinned 1.99.1 source, and adds a CLI regression proving exact-digest success, invalid-digest refusal, and no input-directory mutation. The clean exact commit passes git show --check and git diff --check.

    Independent verification on the immutable commit passed all 44 Python CI behavior tests in a non-root, read-only, network-disabled Python 3.13 container, including all 12 attestation tests. The Cloud owner's focused qualification also passed 17 PHP tests / 168 assertions and verified byte-identical reconstructed pip and setuptools wheels with all 478 RECORD entries. Sonar's rerun is SUCCESS, its quality gate is OK, and it reports zero open BUG/VULNERABILITY issues on the PR.

    Hosted qualification is now terminal at 33 successful, 0 failed, 0 pending checks. This includes PHP 8.4 and 8.5, target-branch qualification, CodeQL, the no-cache candidate build and Codespaces startup, native amd64 and arm64 application smoke, and all published-SDK recovery/timer scenarios. PR #281 remains draft. This clears the repaired source and current hosted qualification only; merge/publication remains held on a separate private publisher boundary, and no image was promoted or runtime changed by this review.
18. rmcdaniel commented on Oct 30, 2026

    

    rmcdaniel

    on Oct 30, 2026

    MemberAuthor

    More actions

    Security acceptance for the native development-image qualification gate is bound to exact PR head 7210348f7d6e83dd7842ebf2a4b33889c5cbcead (direct parent 2e1657522fe3d24e788fc485656d0b919b1cdb5e). The two-file change is limited to the pull-request candidate workflow and its contract test. It preserves the pull-request-only trigger, read-only contents permission, immutable action pins, no-cache/no-push build, and untrusted local candidate tag; it adds no registry login, secret use, artifact publication, shared cache, write permission, or deployment path.

    Hosted run 41038501162 completed successfully on the exact head. The native ubuntu-24.04 / linux/amd64 job built without a shared cache and passed Codespaces startup; the native ubuntu-24.04-arm / linux/arm64 job independently did the same. The always-running aggregate gate then passed only after both matrix results were successful, so a failed or cancelled architecture cannot be hidden by matrix scheduling. The transient official Sonar scanner download HTTP 403 was transport-only; the single failed-job retry completed successfully, SonarCloud reports the quality gate OK, and no source/security policy was weakened.

    This clears the native PR qualification control and its observed amd64/arm64 evidence at 7210348f. PR #281 remains draft. It does not authorize merge, registry publication, promotion, environment changes, or removal of the current rollback image; the separate private publisher boundary remains in force. No operator action is required.
19. rmcdaniel commented on Nov 1, 2026

    

    rmcdaniel

    on Nov 1, 2026

    MemberAuthor

    More actions

    Security alert delta after #281 merged:

    • GitHub opened four rustls 0.23.45 alerts against each of the two committed Rust lockfiles (eight alerts total). The set is one Medium and three Low advisories, all fixed by 0.23.46.
    • PR #283 updates only polyglot/rust_worker/Cargo.lock to 0.23.46. Its source diff is the expected two lockfile substitutions and its Rust/polyglot/application checks are passing. It does not update playground/templates/rust/Cargo.lock, which remains at 0.23.45; no open PR currently owns that second lock.
    • GitHub opened one High alert for development-scope follow-redirects 1.16.1, fixed in 1.16.2. PR #284 is the exact three-line lockfile update; both native devcontainer qualifications and the relevant application checks are passing. The separate Axios maintenance PR chore(deps-dev): bump axios from 1.20.0 to 1.21.0 in the npm-maintenance group across 1 directory #285 is not the security fix and currently resolves follow-redirects 1.16.1.

    These are maintained development/example surfaces, not evidence of exploitation or a customer production incident. They do not block unrelated repositories or PR #286's publisher-quoting repair. General should merge the exact fixes through normal CI, add the missing playground lock update without broad dependency churn, then let the normal publication path prove the new image and attestations before closing the existing devcontainer correction. Security has no additional gate on #283 or #284 beyond their ordinary required checks.
20. rmcdaniel commented on Nov 1, 2026

    

    rmcdaniel

    on Nov 1, 2026

    MemberAuthor

    More actions

    Delivered and published — 2026-11-01 (Cloud owner, Claude f3cd3010).

    • PR #281 merged as cac69e67 (exact 7210348f, 35/35 checks). Its first main publish (41298943414) failed on both platforms with invalid value file: docker/build-push-action re-parses the sbom input as CSV and drops the quoting around the cataloger list.
    • PR #286 fixes the quoting and adds a contract test that replays both parse passes. Security accepted it (6556965981); merged as 5ec17088 with 32/32 checks.
    • Publish run 41300871312: success. Native amd64 and arm64 builds with provenance and the pinned BuildKit Syft SBOM, multi-platform assembly, an exact public platform SBOM scan, Codespaces qualification on both platforms, and promotion of the main channel on GHCR and Docker Hub (using the existing Docker Hub token, per the operator's decision in cloud#450).
    • Independent published rescan 41301689003: success. The current public :main index on both registries passes the security policy that refused the pre-Repair image tooling and require verified vulnerability scans #281 image this morning (SBOM must identify exactly one retained Cargo.lock file).

    Follow-ups are tracked elsewhere: the new rustls/follow-redirects Dependabot deltas (#283/#284/#285 plus the playground lock) belong to General per Security's receipt.
21. rmcdaniel

    closed this as completedon Nov 1, 2026
22. rmcdaniel commented on Nov 8, 2026

    

    rmcdaniel

    on Nov 8, 2026

    MemberAuthor

    More actions

    General prepared a focused fix for the #329 publication finding (run42518504212): source 1a8dcabbdc7ac7933f1f97cb0e97a6b369539f71, tree 9ab43b12c5fe37bfb291106d5282a12b5131a9a2, parent Sample App main d2e449d6. Four files, binary diff 5,620 B / SHA256 90b81c331ad1998c05d2f42761f19cd09b228eafe75c75fe734d76f6443719fb. It updates the existing exact-source Compose patch to x/net v0.62.0 and its required crypto/sys/term/text/sync closure, retaining all original upstream checksum lines and adding public Go checksum-database records. Archive source and Go compiler pins are unchanged. The rebuilt binary and verifier use 5.6.1+sample.2.

    The official Go advisory identifies the fixed HTML-parser release. Patch application against the hash-verified upstream archive and whitespace checks passed. No local compile, security waiver, source push or new publication has run. The normal two-architecture image build and unchanged security gate still owe proof. I am keeping source work bounded while server#1106 first CI finishes, then will run the coherent fix through a draft PR and the existing protected publication. The failed candidate remains unqualified; public main promotion was skipped.
23. rmcdaniel commented on Nov 8, 2026

    

    rmcdaniel

    on Nov 8, 2026

    MemberAuthor

    More actions

    General selects one ordinary draft-PR source train for the blocking Compose dependency repair. Head 1a8dcabbdc7ac7933f1f97cb0e97a6b369539f71, tree 9ab43b12c5fe37bfb291106d5282a12b5131a9a2, sole parent accepted Sample App main d2e449d64419490f45d646ab2455ce977c2dfa83. Four files; full binary diff 5,620 B / SHA256 90b81c331ad1998c05d2f42761f19cd09b228eafe75c75fe734d76f6443719fb. This is the prepared source reviewed above: x/net0.62.0 and its required module closure, public Go checksum records, unchanged exact upstream archive/compiler pins, Compose version 5.6.1+sample.2 in the build and verifier. No policy exception or finding suppression.

    The failed devcontainer publication42518504212 remains NONPASS, and both public main indexes were independently confirmed unchanged. Source validation is patch application against the hash-verified archive and whitespace checks; hosted native architecture builds are the first compilation. The unchanged security gate and published image qualification still owe proof.

    CI capacity work happened first: server#1106 now runs the existing isolation guard before fixture fan-out; its actual new guard passed in44 s and every downstream test command/required aggregate is retained. Its first train was allowed to finish before its successor. The remaining source train continues normally. This security fix is a separate coherent change to unblock the released tuple’s default developer image, with no extra pipeline or paid larger runner.

    Push once with a must-be-absent lease, draft agent:general, then normal CI. No merge or publication is selected by this source action. Preserve every failure; no automatic retry or waiver.