Use a signed security tool image with the released library embedded #86

New issue

Open

opened 2026-10-11 21:02:15 -05:00 by kiyi · 1 comment

kiyi commented

2026-10-11 21:02:15 -05:00

Member

Prepare explicit digest-pinned preinstalled-* reusable entry points so opted-in security and delivery jobs skip both library checkout and verified-toolchain installation. Embed released workflows v1.33.0, verify its immutable source and tool locks, and retain actual library provenance. Preserve existing entry points without container overrides or pull credentials, along with their workflow/job/check names.

Acceptance:

Review image definition and workflow support in linked PRs.
Publish through the protected base-images pipeline and accept signed full-scan evidence before execution.
Publish the next unused workflow minor release after v1.33.0.
Review caller adoption with the corresponding preinstalled entry-point path, paired workflow/library release pins and accepted image digest, and validate source/image/bundle/deployment compatibility and setup-step skips.

Prepared source is not publication or live adoption. Keep this issue open until hosted acceptance and caller adoption are recorded.

Prepare explicit digest-pinned `preinstalled-*` reusable entry points so opted-in security and delivery jobs skip both library checkout and verified-toolchain installation. Embed released workflows v1.33.0, verify its immutable source and tool locks, and retain actual library provenance. Preserve existing entry points without container overrides or pull credentials, along with their workflow/job/check names. Acceptance: - Review image definition and workflow support in linked PRs. - Publish through the protected base-images pipeline and accept signed full-scan evidence before execution. - Publish the next unused workflow minor release after v1.33.0. - Review caller adoption with the corresponding preinstalled entry-point path, paired workflow/library release pins and accepted image digest, and validate source/image/bundle/deployment compatibility and setup-step skips. Prepared source is not publication or live adoption. Keep this issue open until hosted acceptance and caller adoption are recorded.

kiyi added this to the Homelab Roadmap project

2026-10-11 21:02:16 -05:00

kiyi referenced this issue

2026-10-11 21:09:20 -05:00

Support security job images with verified embedded library #87

kiyi referenced this issue from Homelab/Documentation

2026-10-11 21:14:01 -05:00

Record security tool image decision and staged adoption #38

kiyi referenced this issue

2026-10-11 22:01:07 -05:00

WIP: Reuse base-image routing, validation and required gate after #87 #88

kiyi referenced this issue from Homelab/Documentation

2026-10-13 07:54:43 -05:00

Record published security image and hosted startup acceptance #40

kiyi commented

2026-10-13 07:55:27 -05:00

Author

Member

2026-10-13 checkpoint: the security image is published as tool-security-v2026.10.13-r6990, digest sha256:67cb01038ac30c796e45c894db75689bc70ec1b750736a6f99beac457fd03cbc (private base-images PR #40/release).

Workflow PR #87 now uses explicit preinstalled-* entry points and preserves existing credential-free entry points and check names. At commit 15ebb699e2, hosted run 587 passed both legacy and authenticated image startup, including verified activation, offline tool smoke checks and retained sanitized provenance. Acceptance 585, source-security 586 and library 588 also passed. The review reply contains the implementation and validation evidence.

Documentation PR #40 updates the published state, explicit adoption contract and rollback; local documentation checks and production build passed.

Remaining acceptance: owner review/merge, the next unused minor workflow release, and reviewed owning callers exercising application source/image/bundle/deployment operations with the accepted digest and skipped setup steps. Setup savings still need measurement. This issue remains open for that acceptance.

2026-10-13 checkpoint: the security image is published as `tool-security-v2026.10.13-r6990`, digest `sha256:67cb01038ac30c796e45c894db75689bc70ec1b750736a6f99beac457fd03cbc` (private base-images PR #40/release). [Workflow PR #87](https://git.gitchegumi.com/Homelab/workflows/pulls/87) now uses explicit `preinstalled-*` entry points and preserves existing credential-free entry points and check names. At commit [15ebb699e2](https://git.gitchegumi.com/Homelab/workflows/commit/15ebb699e2e8e01077cc5de65eb6d4b86163866d), [hosted run 587](https://git.gitchegumi.com/Homelab/workflows/actions/runs/587) passed both legacy and authenticated image startup, including verified activation, offline tool smoke checks and retained sanitized provenance. Acceptance 585, source-security 586 and library 588 also passed. [The review reply](https://git.gitchegumi.com/Homelab/workflows/pulls/87#issuecomment-6036) contains the implementation and validation evidence. [Documentation PR #40](https://git.gitchegumi.com/Homelab/Documentation/pulls/40) updates the published state, explicit adoption contract and rollback; local documentation checks and production build passed. Remaining acceptance: owner review/merge, the next unused minor workflow release, and reviewed owning callers exercising application source/image/bundle/deployment operations with the accepted digest and skipped setup steps. Setup savings still need measurement. This issue remains open for that acceptance.

kiyi referenced this issue from Homelab/Documentation

2026-10-13 09:49:24 -05:00

Record Harbor dev readiness and released workflow adoption #41