Repository navigation
chore(workflows): move the five image pins to what 02c62e4's build published - #95
Merged
Merged
Conversation
…blished The second half of #91 and #93, and the first pins that scripts/check-image-pins.py can actually verify: 02c62e4 is the first build that stamps each image with a fingerprint of its build inputs, so before this every pin reported UNVERIFIABLE. Resolved from each image's `sha-02c62e46ac16` tag rather than `latest`. Measured reason: the #91 and #93 builds started 25 seconds apart and ran concurrently, both pushing `latest`, and for iac-toolbox the earlier run's push landed last. `latest` resolved to 7f5292725111 while the 774ab22 build had published c1d133bb0e97. The per-commit tag is race-free. build-toolbox.yml has no concurrency guard, which is a separate thing to fix. Each digest was verified before being written: its build-inputs label was read back out of the registry and compared with the fingerprint this repo computes now, and nothing would have been written if any of the five disagreed. scripts/check-image-pins.py then reports all five current.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The second half of #91 and #93, and the first set of pins that
scripts/check-image-pins.pycan actually verify.02c62e4is the first build that stamps each image with a fingerprint of its build inputs, so until now every pin reportedUNVERIFIABLE.security-toolbox-base9be060794ecb4d1337450ff0gha-toolbox4cef3443acbd9df49b1d2c2bsast-toolboxedfd4db8752abdbbdabc07ebiac-toolbox08e1338df20c98d329b49e54skill-audit-toolboxf5f99b96668f161cbe2cb220Callers now get #91's tool bumps (trufflehog 3.99.7, snyk-agent-scan 0.6.9, semgrep 1.182.1) and #93's corrected
dev-exec-writes-agent-memoryrule. Before this they were still scanning with the pre-#91 toolchain.Resolved from the per-commit tag, not
latestlatestis not trustworthy here, and that is measured rather than assumed. The #91 and #93 builds started 25 seconds apart and ran concurrently, both pushinglatest. Foriac-toolboxthe earlier run's push landed last:Each digest here came from resolving
<image>:sha-02c62e46ac16, which is race-free and resolved to exactly what that build reported for both images I cross-checked against the build log.build-toolbox.ymlhas noconcurrency:guard, which is what allowed the race. That is a separate fix, not folded in here.Verified before writing
For every image, the resolved digest's
io.github.garymike.toolbox.build-inputslabel was read back out of the registry and compared with the fingerprint this repo computes now. Nothing would have been written if any of the five disagreed. After the move:This should take
Image pinsgreen for the first time.