feat: source patch parents from published DU packages #134
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!134
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/package-parent-images"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Base-images run 360 attempted an unnecessary direct Iron Bank login while preparing the gitch Core patches. Add opt-in
package_parent_pullsto the existingbase-image.ymlandvalidate-base-images.ymlso image parents come from DU’s published, signature-verified package instead.Each image declares the original package version/digest, DU publisher verification mapping and exact bundled image digest. The helper pulls the unchanged package through UDS, verifies the selected image bytes, and supplies a local OCI layout to Buildx. Core charts/manifests and unmodified images remain in their published package; only the selected image patch is built. Missing or changed parent bytes stop the build without a remote-parent fallback.
The existing UDS credential pair is scoped to
registry.defenseunicorns.comin temporary private storage and removed after package preparation. Signed image receipts record the package/image provenance and the checksum-pinned package client. Source/history scans, full-image scans, signing, publication guards, workflow names and required-check names remain intact. Defaults remain false.Use checkout-based workflows for this batch. The existing preinstalled security image embeds v1.33.0 and lacks this helper/container argument; its original interface stays supported. Tests account explicitly for the new checkout-only capability while preserving every other operation boundary. The stable-v1 compiler freezes the optional validator helper checkout and rejects changes to its condition or destination.
Validation: 568 Linux unit/contract tests completed successfully (20 tool/integration-dependent skips), plus the native Windows Git-path channel contract. The final 21 focused extraction/container tests passed after adding client provenance. YAML/Bash validation and 16 mocked gate cases, Ruff, staged-diff checks and native Gitleaks passed. Synthetic archives cover package/image identity, changed payloads, duplicate members, temporary auth cleanup, signature failures and shared-package reuse. No local Docker build, real registry package pull, scan or deployment was run. Hosted acceptance remains required.
Merge, publish and promote this shared capability before rerunning base-images #57. It replaces direct Iron Bank acquisition for that PR; it does not activate the Core upgrade.
Reviewed the exact head
32c8c586e0. The optional package-parent path pins the DU package and selected image by digest, constrains the DU publisher verification mapping, verifies selected OCI manifest/config/layer bytes before supplying an OCI-layout Buildx context, and fails closed when parent preparation is absent or altered. The reusable validator and base-image build retain source/image scans, publication guard and signing; stable-v1 freezes the optional helper checkout, while the preinstalled image's unchanged interface is explicitly tested. This is package-input preparation, not a UDS deploy/routing or policy change; I found no demonstrated reason for a new gateway, bundle deployment or scan exemption. The pinned UDS 0.39.0 release documents Legacyuds createandkeylessVerification, and Docker documents the digest-pinned OCI-layout named context. Source approval only: the live Library, repository-security and compatibility checks are pending as of this review; hosted acceptance, a real DU package pull, and an actual Buildx image build have not been independently verified. Keep all required CI/security gates and do not publish, promote or merge on this review alone.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
@kiyi — exact-head CI follow-up for run 1078 (API run 8196), commit
32c8c586e0:security-1reached the scan gate and exited 1 with 1 blocking, 4 mitigated, 0 scanner errors. This is a real gate failure, not a runner-startup or missing-log issue. The bounded log does not include the blocker identity, and I could not inspectdecision.json,findings.csv, orsummary.mdthrough the available PR/run tools; I cannot attribute it to this PR's new code or to an existing finding yet. Please inspect the run's sanitized decision artifact, report the exact blocking finding (scope, package/version and fix if applicable), remediate confirmed source/security defects without weakening the gate, then validate the new exact head and its hosted security decision. My existing APPROVED review is source-only at this SHA, not security acceptance or merge readiness. Library checks were still pending at this follow-up.New commits pushed, approval review dismissed automatically according to repository settings
Follow-up to the CI review: the expanded scan stage exposes the blocker at run 1078, line 21:
semgrep python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected,pipeline/package_parents.py:271. This is the new UDS client downloader, a source SAST finding rather than a dependency CVE. The other four findings retain their existing mitigations.Fixed in 6804766. The downloader now constructs an HTTPS-only opener with no HTTP, file, data or FTP handlers. GitHub HTTPS asset redirects work; protocol changes fail before opening their destination. Default certificate validation, the 180-second timeout and the pinned SHA-256 verification before execution remain enforced. No mitigation or scanner policy changed.
Validation: all 23 focused package-parent/container tests passed under Linux, including rejection of non-HTTPS requests and redirects and altered client bytes; Ruff, whitespace checks and the native Gitleaks pre-commit gate passed. The push started the normal checks, including security run 1082. Its hosted security decision remains pending; this reply does not claim scan acceptance or merge readiness.
Reviewed the live exact head
6804766090after the prior source approval and the old-head security failure. I inspected the newpackage_client_opener()/bootstrap()implementation and its protocol/redirect/checksum tests: the downloader retains a fixed HTTPS release URL, removes non-HTTPS handlers, rejects protocol-changing redirects before opening their destination, hashes the downloaded client against the pinned SHA-256 before execution, and keeps the existing TLS verification and timeout. This addresses the reported dynamic-urllib source concern without changing the scan policy. The opt-in package path still verifies package publisher and digest, checks local OCI payload bytes, and retains source/image scan, signature, publication and compatibility boundaries. This prepares build inputs, not a UDS deployment, policy or routing change; no duplicate route/gateway/bundle is justified. Source approval only: repository security, Library, acceptance and compatibility checks at this exact head remain pending; a fresh hosted security decision, actual package pull and Buildx build are not yet verified. Required gates remain in force; this approval does not authorize merge, promotion or publication.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.