fix: scan and attest patched runtime v0.5.1 #19

Merged

jlxq0 merged 2 commits from fix/fixed-runtime-20261029 into main

2026-10-28 21:19:25 +00:00

jlxq0 commented

2026-10-28 21:15:06 +00:00

Owner

The existing runtime carries fixable OpenSSL findings and its release workflow lacks a final-image publication gate. Dependency remediation is already merged separately in PR #18.

Use the fixed official Debian 13 non-root runtime, preserve the pinned builder/MSRV, and label version/source provenance. Solve one attested OCI artifact, scan it before publication, then copy its complete index/blobs by digest. Reject conflicting release tags; require tag/version agreement and main ancestry. Main remains the only cache writer. The publisher assumes one authorized release writer; registry tags are not CAS.

Validation: 59 tests pass; fmt, Clippy, Rust 1.93 MSRV, audit, deny and OSV checks pass. Fresh independent read-only Codex review approved exact head 9fec081b5f before this PR; exact-head CI remains required. Old-binary/new-base compatibility fixtures pass non-root read-only health, unauthenticated MCP rejection and ELF checks; those fixtures have zero HIGH/CRITICAL scan entries, not a claim about all severities or the final new binary.

The checked-in disposable-registry integration test confirms all 27 supplied OCI objects and SPDX/SLSA byte preservation, same-digest replay and conflicting-tag refusal. Its nonexistent-object case is a missing root digest; the fixture seeds target storage first. Final newly built artifact scan/provenance/runtime validation and authenticated live reads remain release/promotion gates. No production deployment is included.

The existing runtime carries fixable OpenSSL findings and its release workflow lacks a final-image publication gate. Dependency remediation is already merged separately in PR #18. Use the fixed official Debian 13 non-root runtime, preserve the pinned builder/MSRV, and label version/source provenance. Solve one attested OCI artifact, scan it before publication, then copy its complete index/blobs by digest. Reject conflicting release tags; require tag/version agreement and main ancestry. Main remains the only cache writer. The publisher assumes one authorized release writer; registry tags are not CAS. Validation: 59 tests pass; fmt, Clippy, Rust 1.93 MSRV, audit, deny and OSV checks pass. Fresh independent read-only Codex review approved exact head 9fec081b5f89b91a9085c3ad77e2081baea935c5 before this PR; exact-head CI remains required. Old-binary/new-base compatibility fixtures pass non-root read-only health, unauthenticated MCP rejection and ELF checks; those fixtures have zero HIGH/CRITICAL scan entries, not a claim about all severities or the final new binary. The checked-in disposable-registry integration test confirms all 27 supplied OCI objects and SPDX/SLSA byte preservation, same-digest replay and conflicting-tag refusal. Its nonexistent-object case is a missing root digest; the fixture seeds target storage first. Final newly built artifact scan/provenance/runtime validation and authenticated live reads remain release/promotion gates. No production deployment is included.

jlxq0 added 2 commits

2026-10-28 21:15:06 +00:00

fix: qualify and attest patched runtime for v0.5.1 1508e6dfdd

fix: publish the exact scanned attested OCI artifact

CI / cargo (pull_request) Successful in 1m23s

Details

CI / docker (pull_request) Successful in 1m35s

Details

9fec081b5f

jlxq0 merged commit dfbaf3295e into main

2026-10-28 21:19:25 +00:00

jlxq0 referenced this pull request from a commit