From 4898c9b7641e93aa50965ff0f8c95f660fad7d57 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 21:46:31 +0200 Subject: [PATCH] Pin lifecycle policy proposal to verified Forgejo build Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- deploy/lifecycle/README.md | 6 +++++- deploy/lifecycle/policy.candidate.yaml | 2 +- deploy/lifecycle/review-policy.candidate.yaml | 2 +- .../2026-10-04-lifecycle-release/manifest.json | 4 ++-- .../2026-10-04-lifecycle-release/policy-scan.json | 13 ++++++++----- 5 files changed, 17 insertions(+), 10 deletions(-) diff --git a/deploy/lifecycle/README.md b/deploy/lifecycle/README.md index bad3f91..ae63a87 100644 --- a/deploy/lifecycle/README.md +++ b/deploy/lifecycle/README.md @@ -6,7 +6,7 @@ humans and system:serviceaccount:state-hub:state-hub. **Not deployed.** | Artifact | Immutable reference | | --- | --- | | Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d | -| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37 | +| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 | | Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 | | Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db | @@ -94,3 +94,7 @@ Both artifact scans contain zero HIGH/CRITICAL findings. Actual evaluator tests cover first-audience collaboration across revisions and verify unchanged package pins; authentication custody in those tests is synthetic. Native activation and broader browser packet/binding profiles remain explicit workplan tasks. + +The final Access Engine pin is the Forgejo image built from commit d2d0b6f +(run https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316). +It supersedes the locally built candidate for the proposed deployment. diff --git a/deploy/lifecycle/policy.candidate.yaml b/deploy/lifecycle/policy.candidate.yaml index 193e6b5..c094cea 100644 --- a/deploy/lifecycle/policy.candidate.yaml +++ b/deploy/lifecycle/policy.candidate.yaml @@ -128,7 +128,7 @@ spec: type: RuntimeDefault containers: - name: flex-auth - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37 + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 imagePullPolicy: IfNotPresent args: - serve diff --git a/deploy/lifecycle/review-policy.candidate.yaml b/deploy/lifecycle/review-policy.candidate.yaml index 324795a..cf682aa 100644 --- a/deploy/lifecycle/review-policy.candidate.yaml +++ b/deploy/lifecycle/review-policy.candidate.yaml @@ -128,7 +128,7 @@ spec: type: RuntimeDefault containers: - name: flex-auth - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37 + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 imagePullPolicy: IfNotPresent args: - serve diff --git a/docs/evidence/2026-10-04-lifecycle-release/manifest.json b/docs/evidence/2026-10-04-lifecycle-release/manifest.json index f402f69..84fc724 100644 --- a/docs/evidence/2026-10-04-lifecycle-release/manifest.json +++ b/docs/evidence/2026-10-04-lifecycle-release/manifest.json @@ -10,10 +10,10 @@ "deploy/lifecycle/admission.candidate.json": "e3054aebb2338146b912121198eba0232973574b9f045710abc802e524fe43f6", "deploy/lifecycle/intake-submitters.json": "58ba5ef87ecfd40bc7f0eaf2beb5e50f0c1f0e47315e79dbfa9e06411a17eba9", "deploy/lifecycle/lifecycle-callers.json": "0b66382a64bdf81ee75d14a70ba3b19290084922a1e0bc8a873af0f039dc7041", - "deploy/lifecycle/policy.candidate.yaml": "e08fcb494d8d29f45b5fbce949246ce2de28e73a56efd2064f42dbfee8f3d11f", + "deploy/lifecycle/policy.candidate.yaml": "850d96aa7807b0e81e28278d380543770012a006b5dc3ebb06a5a8f5fcb43c4a", "deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e", "deploy/lifecycle/review-groups.json": "1d61d2b82230981130936651a7fc4230e06ecaa51416a8a1be2bb2eb6ec4c353", - "deploy/lifecycle/review-policy.candidate.yaml": "6c49a9d520a553778935555351c70b3823b72dd0f1ed3a5383d5a4fc0e5e7998", + "deploy/lifecycle/review-policy.candidate.yaml": "1f680eb1184c4a26ae2638b7e0829e5df42237ee09550e7554a3e965edbc8674", "deploy/lifecycle/service.candidate.json": "bf36ecb0160bf893a60fe059a3baf27a63668e2bb7b9f17c9582d6de8e842545" } } diff --git a/docs/evidence/2026-10-04-lifecycle-release/policy-scan.json b/docs/evidence/2026-10-04-lifecycle-release/policy-scan.json index 6462967..0e377b6 100644 --- a/docs/evidence/2026-10-04-lifecycle-release/policy-scan.json +++ b/docs/evidence/2026-10-04-lifecycle-release/policy-scan.json @@ -1,17 +1,20 @@ { "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", "scanner_version": "0.74.0", - "scanned_at": "2026-10-04T19:35:45.454792771Z", - "artifact": "flex-auth:wp0007-candidate", - "image_id": "sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37", + "scanned_at": "2026-10-04T19:45:06.255864835Z", + "artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-d2d0b6f", + "image_id": "sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99", "severities": [ "HIGH", "CRITICAL" ], "vulnerabilities": 0, - "full_report_sha256": "e41d19c961f0e0d3a4051362c6769edc3069b4286612239861818d403c16ee6a", + "full_report_sha256": "a3f2cefbef113ea150072efacfefbe9d6f0195bb7cf728776eac136fc8995466", "warnings": [ "vendor severity selection" ], - "scope": "candidate artifact scan; not a general security attestation" + "scope": "candidate artifact scan; not a general security attestation", + "source_commit": "d2d0b6feeb", + "build_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316", + "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99" }