Build custom Zarf init from signed replacement images #131

Merged

gitchegumi merged 2 commits from kiyi/gitch-init-package into main

2026-10-18 22:56:24 -05:00

kiyi commented

2026-10-18 22:29:18 -05:00

Member

The helper verifies exact image receipts with the existing signing public key, checks the locked upstream source archive and uses Zarf’s native image templates for both inventory and chart constants. It preserves the four required components, excludes optional k3s/Gitea, bounds extraction and keeps credentials out of the public source download. The containing Homelab bundle supplies the signature; no upstream signature is claimed for rebuilt init. No new workflow, status name or deployment identity.

Validation: 17 focused init/signed-image/Core-workflow tests pass; scaffold validation passes 16 mocked cases; fatal/undefined-name lint and Gitleaks pass. The actual checksum-locked upstream archive was prepared and its required components and all nine image-template values verified locally. No package/image build, publication or deployment was run locally.

Release and promote this helper to stable-v1 before merging the paired Platform adoption. Hosted packaging and complete Core image acceptance remain pending.

Core 1.14.1 currently pulls the upstream init images that blocked the upgrade scans. Add a reusable helper for the existing Core delivery workflow to build custom init 0.86.0 using the three published replacements from Homelab/base-images#56. Core stays on registry1. The helper verifies exact image receipts with the existing signing public key, checks the locked upstream source archive and uses Zarf’s native image templates for both inventory and chart constants. It preserves the four required components, excludes optional k3s/Gitea, bounds extraction and keeps credentials out of the public source download. The containing Homelab bundle supplies the signature; no upstream signature is claimed for rebuilt init. No new workflow, status name or deployment identity. Validation: 17 focused init/signed-image/Core-workflow tests pass; scaffold validation passes 16 mocked cases; fatal/undefined-name lint and Gitleaks pass. The actual checksum-locked upstream archive was prepared and its required components and all nine image-template values verified locally. No package/image build, publication or deployment was run locally. Release and promote this helper to stable-v1 before merging the paired Platform adoption. Hosted packaging and complete Core image acceptance remain pending.

kiyi added 1 commit

2026-10-18 22:29:18 -05:00

feat: package gitch init from signed replacement images

Workflow acceptance / acceptance (pull_request) Successful in 1m55s

Details

Repository security / security-1 (pull_request) Failing after 2m39s

Details

Library checks / tests (pull_request) Successful in 8m29s

Details

7c47e8ee77

portegumi approved these changes

2026-10-18 22:31:04 -05:00

Dismissed

portegumi left a comment

Reviewed the exact 7c47e8ee77 head (helper, focused tests, and documentation) against Zarf v0.86.0's tagged init and imported registry/agent definitions. The four required components and registry/proxy/agent image-template keys align with that upstream source. The contract constrains the Core/init versions, signed release provenance and exact digest refs; receipt verification precedes source download; SHA-256 verification, extraction bounds and selected-image inventory checks fail closed. This is packaging of a custom init, not a new UDS route, gateway, admission exemption or controller; no such changes are needed here. Source review APPROVED. Workflow acceptance, repository security and library checks are pending at review time; this approval is not a claim that hosted packaging, image/security acceptance, publication or deployment passed. Keep those gates and inspect the built package's selected image descriptors and Core acceptance before promotion/merge.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the exact 7c47e8ee772d40146fdb62a699a3458c3aad89db head (helper, focused tests, and documentation) against Zarf v0.86.0's tagged init and imported registry/agent definitions. The four required components and registry/proxy/agent image-template keys align with that upstream source. The contract constrains the Core/init versions, signed release provenance and exact digest refs; receipt verification precedes source download; SHA-256 verification, extraction bounds and selected-image inventory checks fail closed. This is packaging of a custom init, not a new UDS route, gateway, admission exemption or controller; no such changes are needed here. Source review APPROVED. Workflow acceptance, repository security and library checks are pending at review time; this approval is not a claim that hosted packaging, image/security acceptance, publication or deployment passed. Keep those gates and inspect the built package's selected image descriptors and Core acceptance before promotion/merge. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added 1 commit

2026-10-18 22:40:51 -05:00

fix: reject init source redirects before following them

Workflow acceptance / acceptance (pull_request) Successful in 1m58s

Details

Repository security / security-1 (pull_request) Successful in 2m9s

Details

Library checks / tests (pull_request) Successful in 10m32s

Details

010cc857a3

kiyi dismissed portegumi's review

2026-10-18 22:40:52 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

portegumi approved these changes

2026-10-18 22:42:31 -05:00

portegumi left a comment

Reviewed current exact head 010cc857a3: full helper, tests and documentation. Checked Zarf v0.86.0 tagged init and imported registry/agent component definitions: four required components and registry/proxy/agent image-template keys match. Contract restricts the Core/init versions, release owner and exact digest refs; signed-release verification precedes checksum-locked public download, which rejects redirects and bounds archive extraction; inventory validation requires the expected digest set. This is custom init packaging, not a change to UDS runtime routes, gateways, admission policies or controllers. Source review APPROVED. Workflow acceptance, repository security and library checks were pending at review time; this does not establish successful hosted packaging, full image/security acceptance or readiness to promote/merge. Preserve those gates and inspect the built package's image descriptors and signed Core release before promotion. No publication or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed current exact head 010cc857a32e0d1cbf4613e9561e9ebbb2093f5d: full helper, tests and documentation. Checked Zarf v0.86.0 tagged init and imported registry/agent component definitions: four required components and registry/proxy/agent image-template keys match. Contract restricts the Core/init versions, release owner and exact digest refs; signed-release verification precedes checksum-locked public download, which rejects redirects and bounds archive extraction; inventory validation requires the expected digest set. This is custom init packaging, not a change to UDS runtime routes, gateways, admission policies or controllers. Source review APPROVED. Workflow acceptance, repository security and library checks were pending at review time; this does not establish successful hosted packaging, full image/security acceptance or readiness to promote/merge. Preserve those gates and inspect the built package's image descriptors and signed Core release before promotion. No publication or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.