feat(security): reuse signed ClamAV image evidence for seven days #45

Merged

gitchegumi merged 2 commits from kiyi/malware-evidence into main

2026-09-19 17:22:47 -05:00

kiyi commented

2026-09-19 16:58:02 -05:00

Member

Bundle builds verify image receipts from the same app repository against the independently configured signing key, then verify the decision hash. Deployment consumes only evidence covered by the verified bundle receipt. Reuse preserves original timestamps and signature-database hashes. Legacy reports, invalid signatures, tampered reports and incompatible profiles do not authorize reuse. PR source scans are unchanged and receive no new credentials.

Security artifacts now include clamav.json with findings, scan status and reuse/provenance information; summary.md also shows ClamAV image status. Existing exact workflow self-scan exceptions are rebound only to the moved lines. App exceptions remain app-local.

Validation: 62 focused tests pass, including signature rejection, report tampering, expiry, digest/profile/engine matching, malware blocking, reporting and workflow credential boundaries. The broader 157-test Windows run has Linux-environment limitations: /tmp-dependent tests pass with a test-only temporary-directory adapter, while three Bash canary subcases remain unsupported locally; Linux CI remains required. No image rebuild, job cancellation, release or deployment was performed.

Independent of #44. Related: #4 and Homelab/Comfy-UI#1. Merge/release and application workflow pin adoption are still required before this changes live builds.

Bundle creation and deployment currently repeat the full ClamAV image scan even immediately after publication. Reuse a clean result for seven days from its original scan, bound to the exact image reference/digest, pinned engine and full-scan profile. Container publication still scans in full; Trivy checks and SBOM generation remain current on each evaluation. Expired or unavailable evidence rescans the existing image without rebuilding it. Bundle builds verify image receipts from the same app repository against the independently configured signing key, then verify the decision hash. Deployment consumes only evidence covered by the verified bundle receipt. Reuse preserves original timestamps and signature-database hashes. Legacy reports, invalid signatures, tampered reports and incompatible profiles do not authorize reuse. PR source scans are unchanged and receive no new credentials. Security artifacts now include clamav.json with findings, scan status and reuse/provenance information; summary.md also shows ClamAV image status. Existing exact workflow self-scan exceptions are rebound only to the moved lines. App exceptions remain app-local. Validation: 62 focused tests pass, including signature rejection, report tampering, expiry, digest/profile/engine matching, malware blocking, reporting and workflow credential boundaries. The broader 157-test Windows run has Linux-environment limitations: /tmp-dependent tests pass with a test-only temporary-directory adapter, while three Bash canary subcases remain unsupported locally; Linux CI remains required. No image rebuild, job cancellation, release or deployment was performed. Independent of #44. Related: #4 and Homelab/Comfy-UI#1. Merge/release and application workflow pin adoption are still required before this changes live builds.

kiyi added 1 commit

2026-09-19 16:58:02 -05:00

feat(security): reuse signed ClamAV image evidence for seven days

Workflow acceptance / acceptance (pull_request) Successful in 1m38s

Details

Library checks / tests (pull_request) Successful in 3m16s

Details

Repository security / security-1 (pull_request) Failing after 9m7s

Details

Repository security / security (pull_request) Failing after 0s

Details

62ec99ac22

gitchegumi approved these changes

2026-09-19 17:05:42 -05:00

Dismissed

kiyi added 1 commit

2026-09-19 17:09:19 -05:00

fix(security): retain HTTPS exception at moved uploader line

Repository security / security-1 (pull_request) Successful in 2m47s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 3m11s

Details

Workflow acceptance / acceptance (pull_request) Successful in 7m45s

Details

5e273af2fe

kiyi dismissed gitchegumi's review

2026-09-19 17:09:19 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

kiyi commented

2026-09-19 17:09:53 -05:00

Author

Member

Fixed the run 271 blocker in 5e273af2fe. The unchanged HTTPS uploader moved from line 189 to 192; its exact exception fingerprint is now rebound to that call. Reason, controls and expiry are unchanged. Added a regression test tying all three affected HTTP-call exceptions to their current source locations. All 19 security unit tests pass; fetched commit author/committer are kiyi and its tree matches the tested patch. New hosted checks are running (security run 276). The repository automatically dismissed the earlier approval after this corrective commit.

Fixed the run 271 blocker in 5e273af2fedcb9fad0f9852089c0fb3657dd5bd2. The unchanged HTTPS uploader moved from line 189 to 192; its exact exception fingerprint is now rebound to that call. Reason, controls and expiry are unchanged. Added a regression test tying all three affected HTTP-call exceptions to their current source locations. All 19 security unit tests pass; fetched commit author/committer are kiyi and its tree matches the tested patch. New hosted checks are running (security run 276). The repository automatically dismissed the earlier approval after this corrective commit.

gitchegumi approved these changes

2026-09-19 17:22:44 -05:00