access-engine/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json

{
  "scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied",
  "checked_at": "2026-11-01",
  "candidate": {
    "repository": "forgejo.coulomb.social/coulomb/flex-auth",
    "tag": "main-2de0f86",
    "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
    "revision_label": "2de0f862f9875f344f090b633813239a33d63426",
    "platform": "linux/amd64",
    "built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode"
  },
  "policy_file": {
    "path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
    "file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
    "equals_source_at": "2de0f86",
    "package": "informed-decision.compact-sitting",
    "version": "v14",
    "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
    "package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)",
    "image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass"
  },
  "rollback_policy_in_same_image": {
    "path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
    "version": "v13",
    "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873"
  },
  "registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)",
  "offline_verify_requests": {
    "verify-self-approval.request.json": {
      "v14": "deny self_approval_refused",
      "v13": "deny unknown_class"
    },
    "verify-missing-action.request.json": {
      "v14": "deny approval_action_not_admitted",
      "v13": "deny unknown_class"
    },
    "note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused"
  },
  "scan": {
    "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
    "severities": [
      "HIGH",
      "CRITICAL"
    ],
    "candidate": {
      "image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
      "vulnerabilities": 8,
      "findings": [
        {
          "target": "usr/local/bin/access-engine",
          "id": "CVE-2026-111943",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.10, 1.27.3",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/access-engine",
          "id": "CVE-2026-78667",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/access-engine",
          "id": "CVE-2026-78669",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/access-engine",
          "id": "CVE-2026-97031",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-111943",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.10, 1.27.3",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-78667",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-78669",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-97031",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        }
      ]
    },
    "in_force_6c6dc263": {
      "image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e",
      "vulnerabilities": 4,
      "findings": [
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-111943",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.10, 1.27.3",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-78667",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-78669",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        },
        {
          "target": "usr/local/bin/flex-auth",
          "id": "CVE-2026-97031",
          "pkg": "stdlib",
          "installed": "v1.26.7",
          "fixed": "1.26.9, 1.27.2",
          "severity": "HIGH"
        }
      ]
    },
    "assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides."
  }
}