[rmcdaniel]

The exact published devcontainer scan blocked both platforms on CVE-2026-78661 in Compose’s golang.org/x/net v0.60.0. Build the same pinned Compose source with x/net v0.62.0 and its required module closure, retaining Go checksum verification and readonly builds. Identify the repaired binary as 5.6.1+sample.2 and require that identity in image verification.

The upstream archive/compiler pins, published product tuple and vulnerability policy are unchanged. The failed publication did not promote main.

Validation: patch applies to the hash-verified upstream archive and whitespace checks pass. Normal hosted native architecture builds are the first compilation. After source qualification, the existing protected publication must scan and qualify both exact public images before promotion. No waiver or installed-image pass is claimed.

Refs #280; follows #329 and publication run42518504212.

[sonarqubecloud]

Quality Gate passed

Issues
8 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General accepts #330 source and selects one ordinary MERGE of exact head 1a8dcab, tree 9ab43b12c5fe37bfb291106d5282a12b5131a9a2, onto unchanged main d2e449d, with match-head protection and no bypass. The four-file diff is 5,620 bytes / SHA-256 90b81c331ad1998c05d2f42761f19cd09b228eafe75c75fe734d76f6443719fb.

All 33 checks succeeded, including candidate validation, native amd64/arm64 qualification, image-security behavior, both Compose architectures, CodeQL, Sonar, published-tuple playground and SDK timer/upgrade checks. This retains the verified upstream Compose 5.6.1 source and upgrades its x/net dependency to v0.62.0 with the required module closure; the local binary identity becomes 5.6.1+sample.2.

After merge: verify signed commit, ordered parents, exact reviewed tree and original actual-main terminal checks; delete only the merged topic with an exact lease and verify absence. Then prepare one fresh protected devcontainer publication at accepted main. The earlier publication 42518504212 stays NONPASS, and existing published aliases stay unqualified for this correction until the exact new public image passes the unchanged security and architecture gates. No waiver or alias override is selected.

[rmcdaniel]

#330 actual-main custody is complete. Signed merge 0a7942deac66770dc4d9931041dc236251e9411a has ordered parents [d2e449d, 1a8dcab] and reviewed tree 9ab43b12c5fe37bfb291106d5282a12b5131a9a2. Main is unchanged. All 28 checks and all 15 original workflows succeeded on attempt1; zero statuses. Both native architecture qualifications passed on the PR. The merged topic was deleted once with the exact head lease, after ancestry and no-open-PR guards; API404 and empty remote ref confirmed.

Next is one fresh protected devcontainer publication at this main commit. The earlier rejected image remains NONPASS, and no successful public-image security claim is made until that publication's unchanged exact-SBOM and architecture gates pass.

[rmcdaniel]

General selects one fresh protected devcontainer-image.yml workflow_dispatch on main 0a7942deac66770dc4d9931041dc236251e9411a, after #330 custody (28 successful actual-main checks,15 original workflows successful, valid merge signature/tree and exact topic retirement).

This publishes immutable native amd64/arm64 candidates for the Compose5.6.1+sample.2 dependency correction, then runs the unchanged anonymous exact-public-SBOM scan and native architecture qualification. Only that workflow's successful gates may promote the two main aliases. No scan waiver, input/source override, larger runner or other registry effect. Before dispatch both public main aliases anonymously resolve to sha256:2a381d49854f6af1d1e2cadcc47d0f68c6f6ead5c4eeaaa213218f27a73f8aa1; zero publication runs are live. Recheck exact main, workflow and absence of live runs immediately before the one dispatch. Bind the returned run, attempt1 and source commit; observe to terminal, report within90minutes. No automatic retry, cancellation or policy weakening.

The prior publication42518504212 remains NONPASS on CVE-2026-78661. The public image and full PHP replay are still unqualified for this correction until actual success. The full PHP replay dispatch is separate and will use only the resulting qualified immutable tooling digest.

[rmcdaniel]

The repaired devcontainer is published and independently verified at sha256:535e111abed1fa9603f5dc375118d3e24173e590cf978e45f1bdcccabbbf33a6 on both GHCR and Docker Hub main channels. Their anonymous 1,613-byte OCI indexes are byte-identical and body hashes equal both registry digest headers.

Publication 42527008420, attempt 1, source 0a7942deac66770dc4d9931041dc236251e9411a, passed all 7 jobs: native amd64/arm64 builds, assembly, exact public SBOM scan, both native architecture qualifications and protected promotion. All four registry/platform identities bind that source and digest. The scan reports golang.org/x/net v0.62.0 and zero CVE-2026-78661 rows on both platforms. This passes the unchanged policy: each platform still has 11 component-negative dispositions and 6 reviewed unfixed-critical findings, plus530/529 unfixed high rows. No zero-vulnerability or new-waiver claim is made.

The earlier publication 42518504212 remains NONPASS. An initial local artifact read hit a TLS timeout; the subsequent evidence read succeeded, with no publication retry. The new immutable tooling digest is ready for the separately selected complete PHP replay run. #330 source, integration, publication and downstream tooling verification are complete.