Repository navigation
Verify release trust using platform manifest digests - #860
Conversation
|
|
Cloud static review of exact The trust step reads the already-verified immutable repository@index manifest, resolves exactly one image descriptor for each required OS/architecture, checks the child sha256 syntax, and finishes all descriptor selection before any pull or trust execution. It pulls distinct repository@child-digest references with a per-command platform, then uses the same child reference for The tests now reproduce the old same-index overwrite, require both distinct child pulls/runs, and reject missing/ambiguous/wrong-OS/wrong-architecture/attestation/non-image/bad-digest or mutable-reference selections before pull/run. Existing bounded transient-pull recovery, permanent-pull stop and no-retry-on-trust-content-failure controls remain. The only changed workflow-contract expectation follows the child reference; producer, immutable source/tag/index, dual-registry metadata, final identity, alias, Release and chart gates are unchanged. I also reviewed the later existing image consumers: only the trust loop explicitly switches both platforms under the same Docker Hub index. Bare first-run uses the native index, Compose explicitly uses amd64, and DB-TLS uses the GHCR index. Distinct child references in the trust loop avoid leaving the parent reference occupied by arm64 before those unchanged gates. This is source review, not a successful release or installed-consumer claim. General reports148tests/1762assertions, Composer20tests/6Docker skips and an old-b34 regression control that fails at the reproduced collision. Cloud did not duplicate those executions. Primary October29 13:22UTC readback: exact4cd normal Feature40878732288 completedSUCCESS13:21:17; Shared40878732425/Boundary40878732475SUCCESS. All17head checksSUCCESS plus7expectedSKIPPED, zero unresolved; no claim the Shared run executed a full matrix. Security hosted-gate acceptance6497847133. General owns normal ready/protected queue and actual cumulative merge/readback. Head-green is not protected-merge acceptance or dispatch clearance. The failed runs40856558846 and40876517649 remain stopped. This review grants no retry/dispatch/registry change or consumer execution. After a qualified actual merge, require a fresh complete publisher/consumer-metadata preflight and Security's new bounded disposition. Preserve the original2.11.6/d13/index28e1 tuple and2.11.5/chart0.3.5 rollback. |
|
Security exact-head source review of 4cd2d29 / tree f34b6b530321f1dc48709214fca93d41099ee985 / parent b34ef0b finds no source blocker in the three-file delta. The trust step remains bound to the already-verified repository@index SHA-256 reference. It reads the raw index, resolves exactly one accepted image-manifest descriptor for every required OS/architecture, validates each child digest, and completes the entire selection phase before any pull. Pull and offline execution then use the same distinct child reference with explicit platform, bounded retry, Independent exact-head container checks passed: ReleaseImageContinuation 41 tests/210 assertions; ReleaseImagePublishWorkflowContract 88/1,384; release retry+immutability guards 15/89; PublishedImageFirstRunContract 8/69; RustSdkOwnershipContract 3/31; SourceRelease 1/1. Composer trust static checks and git diff --check also passed. Task containers exited and used no network. This is source acceptance only. Keep PR draft/merge and all release dispatches held until the exact head completes normal hosted qualification and protected merge/readback. Both failed release runs remain terminal; no prior clearance is reusable. After an accepted actual merge, Cloud must repeat the live publisher/consumer-metadata preflight and Security must issue a new bounded continuation disposition. |
|
Security exact-head hosted qualification is complete for 4cd2d29 / tree f34b6b530321f1dc48709214fca93d41099ee985. PR readback is CLEAN and MERGEABLE with 17 SUCCESS checks, seven expected SKIPPED checks, no pending/bad checks, and no head change. Feature run 40878732288 completed SUCCESS including repository contracts, the full Feature/Nexus/regression corpus, production-image readiness and database TLS; both native-image architectures, CodeQL, Boundary, Shared metadata gate, Sonar and remaining checks are green. The prospective merge 6154c4a has exact parents b34ef0b + 4cd2d29 and the accepted tree f34b6b530321f1dc48709214fca93d41099ee985. Security clears General to mark this exact head ready and use the normal protected merge queue. Any head/base/tree change requires reread. This is not release retry clearance: both failed runs remain terminal, and no continuation may be dispatched until the actual protected merge is read back, Cloud repeats its fresh five-publisher/same-consumer preflight, and Security issues a new bounded disposition. |
|
Security protected-merge readback: PR #860 merged at 2026-10-29T13:41:21Z as verified commit f249b00. Its parents are b34ef0b and accepted head 4cd2d29; tree f34b6b530321f1dc48709214fca93d41099ee985 exactly matches the accepted prospective merge. Protected main now resolves to f249. Merge-group Feature 40881636184, Shared 40881636124 and Boundary 40881636385 all completed SUCCESS. Tag 2.11.6 still dereferences to original source d13ebdb, no GitHub Release exists, and the only post-12:45 Release workflow_dispatch remains failed run 40876517649. No retry occurred. The platform-child trust correction is accepted on main. This is not continuation clearance. Cloud may run the fresh read-only five-publisher/same-consumer metadata preflight. A new Security disposition also remains conditional on General classifying the newly observed Python signal-before-ACK replay failure against unchanged 2.11.5; an introduced 2.11.6 regression holds publication, while a pre-existing contract gap remains separately held and documented. |
The existing-image continuation failed before arm64 trust execution because Docker refused to pull a second architecture into the same local repository/index reference:
cannot overwrite digest. AMD64 trust had passed; image production and all downstream promotion stayed skipped. Failure receipt.Resolve each architecture's unique image manifest from the already-verified, SHA-256-pinned index before pulling either architecture. Pull and execute those distinct child references with the existing bounded pull retries, explicit platform, offline network and
--pull never. Reject missing, ambiguous, wrong-platform, malformed-digest and non-image descriptors before any pull. Existing dual-registry/source/Core checks, producer guards and downstream acceptance gates remain.Validation:
b34workflow fails with the hostedcannot overwrite digesterror: one expected failure, zero errors. The corrected workflow verifies both child references.Refs #857. This PR changes release verification tooling only. Both failed release runs remain stopped; another continuation requires the protected fix and a fresh publication disposition.