fix(security): verify compressed child layers and replace finding fingerprints #60
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!60
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/fix-comfy-layer-archive"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Comfy-UI run 204 finished the two-base image build, then stopped at child-layer DiffID verification before source and malware scans. This change verifies the uncompressed tar digest for gzip child layers while retaining strict signed-parent and payload checks.
Finding reviews now use stable, explicit source rule/path/severity selectors or existing CVE selectors instead of build-dependent fingerprints. Duplicate source occurrences remain blocking. Package-secret reviews retain the exact package version and allowed wheel hashes without depending on the whole Dockerfile digest.
The library repository now scans its own PR checkout with this scanner and policy. Its prior pinned v1.4.3 self-scan rejected the new policy schema in run 370; the updated job keeps the sanitized report artifact.
Validation: 45 focused scanner tests and 11 workflow contract tests pass; workflow YAML parses. The full 203-test suite has 4 failures and 2 errors in the existing Windows
/tmpand Linux canary cases; no local Docker build was available. Release this asv1.21.0before updating callers.Run 370 failed before evaluating findings because this repository’s security caller used released scanner v1.4.3, which only accepts fingerprint mitigations. Commit
cc68ab9makes the library scan its own PR checkout with the current policy and retains the sanitized report artifact. The 11 workflow contract tests and YAML parse pass locally; the new CI run is pending.Run 374 found one contract-test mismatch: the new repository self-scan adds a seventh sanitized report upload, while
test_reporting.pystill expected six. Commit3365470updates the assertion to seven. The targeted reporting test and all 11 workflow-contract tests pass locally (12 total); the remaining reporting tests depend on Linux/writable temp paths on this Windows host.New commits pushed, approval review dismissed automatically according to repository settings
The self-scan still runs the security scanner and retains its reports; it uses this PR checkout because the released v1.4.3
security.ymlcannot parse the new selector policy. Commitc0412eerestores the branch-protection job identityRepository security / security-1without changing the protection rule. Local workflow-contract and report-upload tests pass (12 total). The new required check is queued on this PR and must pass before merge.