diff --git a/docs/compact-sitting-v14-release-runbook.md b/docs/compact-sitting-v14-release-runbook.md index 9cee755..0db731e 100644 --- a/docs/compact-sitting-v14-release-runbook.md +++ b/docs/compact-sitting-v14-release-runbook.md @@ -5,7 +5,7 @@ **Owner note:** `docs/compact-sitting-v14-present-existing.md` ("Live steps") **Approval:** founder, 2026-11-01, relayed by the net-kingdom coordinator **Runs:** the founder, from an access-engine checkout at the commit carrying this file -**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json` +**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json` (`release_candidate` = the image in the table below) ## Coordinated with informed-decision (same window) @@ -29,6 +29,14 @@ is needed only for `service:nk-bind-executor` present-existing requests. Without are refused with `approval_action_not_admitted`; requests for requester `informed-decision` are unaffected by v14. +**informed-decision's side is ready** (2026-11-01, relayed by the net-kingdom coordinator): +RELEASE_SHA `005709a37228ba9e6d5a658aada0b62bf49649f5`, service image +`forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b` +(`main-c228583`), runbook `~/informed-decision/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md`. +That image carries the `approval_action` change (informed-decision commit `80ef840`). Its +step 3 runs "access-engine first, then informed-decision": its 3a is steps 0-2 of this +runbook, then its 3b pins v14; its rollback returns this release to revision 13. + ## Release candidate | Field | Value | @@ -36,20 +44,21 @@ are refused with `approval_action_not_admitted`; requests for requester | release / namespace | `flex-auth-informed-decision-sitting` / `flex-auth` | | chart | `charts/flex-auth` (this checkout) | | values | `values/informed-decision-sitting.yaml` (edited directly; twin `values/access-engine/informed-decision-sitting.yaml` regenerated, not deployed) | -| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` | -| image tag / source | `main-2de0f86`, OCI revision label `2de0f862f9875f344f090b633813239a33d63426` (CI `.forgejo/workflows/image.yaml`, push to main) | +| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c` | +| image tag / source | `main-f4c9f2b`, OCI revision label `f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81` (CI `.forgejo/workflows/image.yaml`, push to main); v14 policy from `2de0f86`, Go 1.26.10 builder | | policy | `/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md` (file sha256 `dcfae737…40141`, package digest verified from the image) | | registry | unchanged path `/opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json` (byte-identical to the present-existing copy) | -### Gate: image scan (founder decision) +### Gate: image scan (passed) -Trivy (HIGH/CRITICAL) finds four Go stdlib 1.26.7 CVEs in both binaries of the candidate -(CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031; fixed in Go 1.26.9 / -1.26.10). The image in force (`6c6dc263`) has **the same four**, so the candidate does not -regress, but the earlier release bar (zero HIGH/CRITICAL, FLEX-WP-0034) is not met. Either -accept for this release (no regression) or ask the owner for a Go toolchain bump and -rebuild first, which yields a new digest and requires re-running the checks in the evidence -file. Do not proceed without choosing. +The first candidate (`main-2de0f86`, `sha256:154726d2…4776`) carried four Go stdlib 1.26.7 +HIGH CVEs (CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031), as does the image +in force (`6c6dc263`). Founder decision 2026-11-01: bump Go and rebuild. Commit `f4c9f2b` +moved the builder to `golang:1.26.10-alpine` and `go.mod` to `go 1.26.10`; nothing else changed. +The rebuilt candidate above has **0 HIGH/CRITICAL** (same pinned Trivy, OS layer and both +binaries). Its v14 and v13 policy directories are byte-identical to the source, the package +digests are `8911458f…0fde` (v14) and `31be5985…3711873` (v13), and in-image `validate` +passes 46/46 (v14) and 32/32 (v13). The `154726d2` image must not be released. ## Image in force (source evidence) @@ -102,7 +111,7 @@ helm template $REL charts/flex-auth -n $NS -f values/informed-decision-sitting.y Expected diff, Deployment `flex-auth-informed-decision-sitting` only: -- image `@sha256:6c6dc263…168e` → `@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` +- image `@sha256:6c6dc263…168e` → `@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c` - `--policy` `…/informed-decision-lifecycle-review/policy.md` → `…/informed-decision-present-existing-review/policy.md` - memory request `32Mi` → `40Mi` (FLEX-WP-0038 right-sizing, already in the values file) - possibly two added args `--caller-audience` `flex-auth` (FLEX-WP-0038 saw this chart @@ -125,7 +134,8 @@ kubectl -n $NS rollout status deploy/$REL --timeout=2m ### 3. Pin the consumer (informed-decision, same window) -Per informed-decision's own runbook: set the review runtime's `policy` object to +Per informed-decision's own runbook (`RELEASE-INFD-WP-0010-T02.md`, step 3b, RELEASE_SHA +`005709a3…49f5`, image `ca75f0be…`): set the review runtime's `policy` object to `informed-decision.compact-sitting` / `v14` / `sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` and release it. Until then review requests fail closed. diff --git a/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json b/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json index 002c189..1f548e5 100644 --- a/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json +++ b/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json @@ -1,155 +1,205 @@ { "scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied", - "checked_at": "2026-11-01", - "candidate": { - "repository": "forgejo.coulomb.social/coulomb/flex-auth", - "tag": "main-2de0f86", - "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776", - "revision_label": "2de0f862f9875f344f090b633813239a33d63426", - "platform": "linux/amd64", - "built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode" + "release_candidate": { + "checked_at": "2026-11-01", + "candidate": { + "repository": "forgejo.coulomb.social/coulomb/flex-auth", + "tag": "main-f4c9f2b", + "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c", + "revision_label": "f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81", + "platform": "linux/amd64", + "built_by": ".forgejo/workflows/image.yaml (push to main: Containerfile/go.mod), tools/publish-runtime-images.sh legacy mode", + "change_from_first_candidate": "builder golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 and go.mod go 1.26.10 (f4c9f2b); policy sources unchanged since 2de0f86" + }, + "policy_file": { + "path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md", + "file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141", + "directory": "byte-identical to examples/informed-decision-present-existing-review at f4c9f2b", + "package": "informed-decision.compact-sitting", + "version": "v14", + "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde", + "image_validate": "valid; 46/46 Rego tests, fixtures pass" + }, + "rollback_policy_in_same_image": { + "path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md", + "directory": "byte-identical to source", + "version": "v13", + "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873", + "image_validate": "valid; 32/32 Rego tests, fixtures pass" + }, + "offline_verify_requests": { + "verify-self-approval.request.json": { + "v14": "deny self_approval_refused", + "v13": "deny unknown_class" + }, + "verify-missing-action.request.json": { + "v14": "deny approval_action_not_admitted", + "v13": "deny unknown_class" + } + }, + "scan": { + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "severities": [ + "HIGH", + "CRITICAL" + ], + "image_id": "sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c", + "targets": [ + { + "target": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c (debian 12.15)", + "vulnerabilities": 0 + }, + { + "target": "usr/local/bin/access-engine", + "vulnerabilities": 0 + }, + { + "target": "usr/local/bin/flex-auth", + "vulnerabilities": 0 + } + ], + "vulnerabilities": 0, + "result": "0 HIGH/CRITICAL: release bar met" + } }, - "policy_file": { - "path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md", - "file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141", - "equals_source_at": "2de0f86", - "package": "informed-decision.compact-sitting", - "version": "v14", - "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde", - "package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)", - "image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass" - }, - "rollback_policy_in_same_image": { - "path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md", - "version": "v13", - "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873" + "first_candidate": { + "candidate": { + "repository": "forgejo.coulomb.social/coulomb/flex-auth", + "tag": "main-2de0f86", + "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776", + "revision_label": "2de0f862f9875f344f090b633813239a33d63426", + "platform": "linux/amd64", + "built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode" + }, + "policy_file": { + "path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md", + "file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141", + "equals_source_at": "2de0f86", + "package": "informed-decision.compact-sitting", + "version": "v14", + "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde", + "package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)", + "image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass" + }, + "scan": { + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "severities": [ + "HIGH", + "CRITICAL" + ], + "candidate": { + "image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776", + "vulnerabilities": 8, + "findings": [ + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-111943", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.10, 1.27.3", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-78667", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-78669", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-97031", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-111943", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.10, 1.27.3", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78667", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78669", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-97031", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + } + ] + }, + "in_force_6c6dc263": { + "image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e", + "vulnerabilities": 4, + "findings": [ + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-111943", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.10, 1.27.3", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78667", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78669", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-97031", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + } + ] + }, + "assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides." + }, + "status": "superseded: not to be released (four HIGH Go 1.26.7 stdlib CVEs); founder decision 2026-11-01 'bump Go and rebuild'" }, "registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)", - "offline_verify_requests": { - "verify-self-approval.request.json": { - "v14": "deny self_approval_refused", - "v13": "deny unknown_class" - }, - "verify-missing-action.request.json": { - "v14": "deny approval_action_not_admitted", - "v13": "deny unknown_class" - }, - "note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused" - }, - "scan": { - "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", - "severities": [ - "HIGH", - "CRITICAL" - ], - "candidate": { - "image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776", - "vulnerabilities": 8, - "findings": [ - { - "target": "usr/local/bin/access-engine", - "id": "CVE-2026-111943", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.10, 1.27.3", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/access-engine", - "id": "CVE-2026-78667", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/access-engine", - "id": "CVE-2026-78669", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/access-engine", - "id": "CVE-2026-97031", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-111943", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.10, 1.27.3", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-78667", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-78669", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-97031", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - } - ] - }, - "in_force_6c6dc263": { - "image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e", - "vulnerabilities": 4, - "findings": [ - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-111943", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.10, 1.27.3", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-78667", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-78669", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - }, - { - "target": "usr/local/bin/flex-auth", - "id": "CVE-2026-97031", - "pkg": "stdlib", - "installed": "v1.26.7", - "fixed": "1.26.9, 1.27.2", - "severity": "HIGH" - } - ] - }, - "assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides." - } + "offline_verify_note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused", + "in_force_6c6dc263_scan": "same four Go 1.26.7 stdlib HIGH CVEs as the first candidate" } diff --git a/internal/policy/informed_decision_attribute_test.go b/internal/policy/informed_decision_attribute_test.go index 321e35b..e008c3c 100644 --- a/internal/policy/informed_decision_attribute_test.go +++ b/internal/policy/informed_decision_attribute_test.go @@ -103,10 +103,10 @@ func TestSittingImagePinMatchesRecordedBuild(t *testing.T) { text := string(raw) // values/informed-decision-sitting.yaml records the founder-approved // FLEX-WP-0040-T07 compact-sitting v14 release candidate (CI image of - // 2de0f86, docs/compact-sitting-v14-release-runbook.md). The FLEX-WP-0034 + // f4c9f2b, Go 1.26.10; docs/compact-sitting-v14-release-runbook.md). The FLEX-WP-0034 // v13 image (6c6dc263) is the rollback, kept in // values/informed-decision-lifecycle-review.candidate.yaml. - if !strings.Contains(text, "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776") { + if !strings.Contains(text, "sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c") { t.Fatal("sitting image digest differs from the recorded release candidate build") } if !strings.Contains(text, "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md") { diff --git a/values/access-engine/informed-decision-sitting.yaml b/values/access-engine/informed-decision-sitting.yaml index ba4a340..2f9d07f 100644 --- a/values/access-engine/informed-decision-sitting.yaml +++ b/values/access-engine/informed-decision-sitting.yaml @@ -2,7 +2,7 @@ name: access-engine-informed-decision-sitting image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 + digest: sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c args: - serve - --addr diff --git a/values/informed-decision-sitting.yaml b/values/informed-decision-sitting.yaml index 6cf60ae..afcb0a0 100644 --- a/values/informed-decision-sitting.yaml +++ b/values/informed-decision-sitting.yaml @@ -1,12 +1,12 @@ # FLEX-WP-0040-T07 release candidate (founder-approved 2026-11-01; NOT yet applied): # compact-sitting v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde, -# CI image main-2de0f86. Runbook: docs/compact-sitting-v14-release-runbook.md. +# CI image main-f4c9f2b (Go 1.26.10). Runbook: docs/compact-sitting-v14-release-runbook.md. # In force before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e, # exact values values/informed-decision-lifecycle-review.candidate.yaml (rollback). name: flex-auth-informed-decision-sitting image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 + digest: sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c args: - serve - --addr