coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0040-T07: v14 release candidate is the Go 1.26.10 image (main-f4c9f2b)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m39s
Details

Browse source 
Candidate image forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c
(revision label f4c9f2b). Read-only checks: v14 and v13 policy directories
byte-identical to source, package digests 8911458f (v14) and 31be5985 (v13),
in-image validate 46/46 and 32/32, offline verify requests answer
self_approval_refused / approval_action_not_admitted on v14, Trivy
HIGH/CRITICAL = 0 (same pinned scanner). Values, twin, pin test, runbook
(scan gate passed; informed-decision side ready at RELEASE_SHA 005709a3,
image ca75f0be, carrying 80ef840) and evidence move to this digest; the
154726d2 image is superseded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-11-01 11:55:27 +01:00
parent f4c9f2beeb
commit 4d5ae6e7ec
5 changed files with 227 additions and 167 deletions
Download patch file Download diff file Expand all files Collapse all files

348
docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json
View file

@ -1,155 +1,205 @@
{
"scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied",
"checked_at": "2026-11-01",
"candidate": {
"repository": "forgejo.coulomb.social/coulomb/flex-auth",
"tag": "main-2de0f86",
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
"revision_label": "2de0f862f9875f344f090b633813239a33d63426",
"platform": "linux/amd64",
"built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode"
"release_candidate": {
"checked_at": "2026-11-01",
"candidate": {
"repository": "forgejo.coulomb.social/coulomb/flex-auth",
"tag": "main-f4c9f2b",
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c",
"revision_label": "f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81",
"platform": "linux/amd64",
"built_by": ".forgejo/workflows/image.yaml (push to main: Containerfile/go.mod), tools/publish-runtime-images.sh legacy mode",
"change_from_first_candidate": "builder golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 and go.mod go 1.26.10 (f4c9f2b); policy sources unchanged since 2de0f86"
},
"policy_file": {
"path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
"file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
"directory": "byte-identical to examples/informed-decision-present-existing-review at f4c9f2b",
"package": "informed-decision.compact-sitting",
"version": "v14",
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
"image_validate": "valid; 46/46 Rego tests, fixtures pass"
},
"rollback_policy_in_same_image": {
"path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
"directory": "byte-identical to source",
"version": "v13",
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
"image_validate": "valid; 32/32 Rego tests, fixtures pass"
},
"offline_verify_requests": {
"verify-self-approval.request.json": {
"v14": "deny self_approval_refused",
"v13": "deny unknown_class"
},
"verify-missing-action.request.json": {
"v14": "deny approval_action_not_admitted",
"v13": "deny unknown_class"
}
},
"scan": {
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"severities": [
"HIGH",
"CRITICAL"
],
"image_id": "sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c",
"targets": [
{
"target": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c (debian 12.15)",
"vulnerabilities": 0
},
{
"target": "usr/local/bin/access-engine",
"vulnerabilities": 0
},
{
"target": "usr/local/bin/flex-auth",
"vulnerabilities": 0
}
],
"vulnerabilities": 0,
"result": "0 HIGH/CRITICAL: release bar met"
}
},
"policy_file": {
"path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
"file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
"equals_source_at": "2de0f86",
"package": "informed-decision.compact-sitting",
"version": "v14",
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
"package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)",
"image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass"
},
"rollback_policy_in_same_image": {
"path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
"version": "v13",
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873"
"first_candidate": {
"candidate": {
"repository": "forgejo.coulomb.social/coulomb/flex-auth",
"tag": "main-2de0f86",
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
"revision_label": "2de0f862f9875f344f090b633813239a33d63426",
"platform": "linux/amd64",
"built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode"
},
"policy_file": {
"path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
"file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
"equals_source_at": "2de0f86",
"package": "informed-decision.compact-sitting",
"version": "v14",
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
"package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)",
"image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass"
},
"scan": {
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"severities": [
"HIGH",
"CRITICAL"
],
"candidate": {
"image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
"vulnerabilities": 8,
"findings": [
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
}
]
},
"in_force_6c6dc263": {
"image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e",
"vulnerabilities": 4,
"findings": [
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
}
]
},
"assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides."
},
"status": "superseded: not to be released (four HIGH Go 1.26.7 stdlib CVEs); founder decision 2026-11-01 'bump Go and rebuild'"
},
"registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)",
"offline_verify_requests": {
"verify-self-approval.request.json": {
"v14": "deny self_approval_refused",
"v13": "deny unknown_class"
},
"verify-missing-action.request.json": {
"v14": "deny approval_action_not_admitted",
"v13": "deny unknown_class"
},
"note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused"
},
"scan": {
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"severities": [
"HIGH",
"CRITICAL"
],
"candidate": {
"image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
"vulnerabilities": 8,
"findings": [
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
}
]
},
"in_force_6c6dc263": {
"image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e",
"vulnerabilities": 4,
"findings": [
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
}
]
},
"assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides."
}
"offline_verify_note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused",
"in_force_6c6dc263_scan": "same four Go 1.26.7 stdlib HIGH CVEs as the first candidate"
}