Prepare independently reviewed zlib-only image candidate

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

.forgejo/workflows/zlib-overlay-image.yaml

@@ -0,0 +1,71 @@
+name: Publish exact zlib-only remediation candidate
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".forgejo/workflows/zlib-overlay-image.yaml"
+      - "deploy/zlib-overlay/**"
+      - "tools/zlib_overlay/**"
+  workflow_dispatch:
+concurrency:
+  group: informed-decision-zlib-overlay
+  cancel-in-progress: false
+permissions:
+  contents: read
+env:
+  REGISTRY: forgejo.coulomb.social
+  IMAGE_NAME: coulomb/informed-decision
+  DOCKER_HOST: tcp://127.0.0.1:2375
+jobs:
+  publish-candidate:
+    runs-on: container-build
+    steps:
+      - name: Verify and publish zlib-only candidate
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          umask 077
+          REF="${GITHUB_SHA:?exact source revision required}"
+          echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
+          test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
+          if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
+            echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2
+            exit 2
+          fi
+          BUILD_ROOT="$(mktemp -d)"
+          export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
+          cleanup() { rm -rf "${BUILD_ROOT}"; }
+          trap cleanup EXIT
+          mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin"
+          wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
+          CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay"
+          for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do
+            cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}"
+            chmod 0644 "${BUILD_ROOT}/context/${INPUT}"
+          done
+          echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47  ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c -
+          echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5  ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c -
+          echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a  ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c -
+          echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15  ${BUILD_ROOT}/context/Containerfile" | sha256sum -c -
+          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
+          export PATH="${HOME}/bin:${PATH}"
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a"
+          docker pull "${BASE}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}"
+          docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context"
+          docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json"
+          docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json"
+          docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py"
+          docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
+          OUTPUT="$(docker push "${IMAGE}")"
+          printf '%s\n' "${OUTPUT}"
+          DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
+          printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
+          echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
+          echo "source_revision=${REF}"
+          echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
+          echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required"