Prepare independently reviewed zlib-only image candidate
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
f0f89b6d1d
commit
9b4bb25d32
154 changed files with 29358 additions and 1 deletions
|
|
@ -0,0 +1,259 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"decision": "changes_requested",
|
||||
"scope": "same T08 exact66 lower-layer whiteout finding; initial/intermediate historical reviews retained; no native go",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8bc6da5507f4d9d1ff6d4439a82eb8b32098cc23fcec52bde4fecdcae939e384"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "b22c0e9c803a455d4235b70684fe05c655a8f9addb0b9836a2012d9904a93a09"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "99bd69d3898b6d79e32ed21664ad3659b5d8410db1a314b751a84daaf5579b65"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "2bb7a5352da28bad2c7cc2566d6bd19875d1310c1ac8f558bc546f3da6442b56"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f3639bbe5e962c839d55e67fdbc36341d23255df9341e797d3a4dff9cc471f40"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
import pathlib,json,hashlib
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
|
||||
entries=json.loads(m.read_text());assert len(entries)==58
|
||||
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
|
||||
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
|
||||
for e in old:
|
||||
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
|
||||
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
|
||||
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
|
||||
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
|
||||
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
|
||||
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-amended-readback','exec'),{})
|
||||
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
|
||||
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
|
||||
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
|
||||
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
|
||||
print('Exact amended source and directory metadata readback pass.')
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
|
||||
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,259 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"all58_hashes_verified": true,
|
||||
"all27_initial_archived_hashes_verified": true,
|
||||
"changed_initial_paths": [
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
|
||||
],
|
||||
"image_context_source_workflow_runtime_scan_unchanged": true,
|
||||
"new_source_tests_passed": 3,
|
||||
"directory_negative_mutations": 3,
|
||||
"optimized_tampered_before_read_refusal": true,
|
||||
"existing_actual_archives_directory_reaudit": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,464 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
from pathlib import Path
|
||||
import hashlib,io,json,tarfile,sys
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
|
||||
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
|
||||
def image(path):
|
||||
with tarfile.open(path) as archive:
|
||||
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
|
||||
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
|
||||
files={}
|
||||
for name in manifest[0]['Layers']:
|
||||
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
|
||||
for member in layer:
|
||||
path=member.name
|
||||
while path.startswith('./'):path=path[2:]
|
||||
path=path.lstrip('/');p=Path(path)
|
||||
if p.name=='.wh..wh..opq':
|
||||
folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/'
|
||||
files={key:value for key,value in files.items() if not key.startswith(prefix)};continue
|
||||
if p.name.startswith('.wh.'):
|
||||
removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue
|
||||
if member.isfile():
|
||||
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
|
||||
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
|
||||
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
|
||||
else:continue
|
||||
files[path]=value
|
||||
return config,hashlib.sha256(configbytes).hexdigest(),files
|
||||
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
|
||||
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
|
||||
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
|
||||
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
assert set(changed)<=expected,set(changed)
|
||||
a,b=base['config'].copy(),candidate['config'].copy()
|
||||
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
|
||||
a.pop('Image',None);b.pop('Image',None)
|
||||
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
|
||||
for key,value in defaults.items():
|
||||
a.setdefault(key,value);b.setdefault(key,value)
|
||||
assert a==b,(a,b)
|
||||
components=[]
|
||||
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
|
||||
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
|
||||
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
|
||||
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
|
||||
vulns=[]
|
||||
for name in ['base-trivy-full.json','trivy-full.json']:
|
||||
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
|
||||
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
|
||||
assert not vulns[1]
|
||||
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
|
||||
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"scope": "exact amended T05 source agreement; same T08; historical initial review retained; no publication or native go",
|
||||
"candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"initial_product_review_manifest_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
import pathlib,json,hashlib
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
|
||||
entries=json.loads(m.read_text());assert len(entries)==58
|
||||
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
|
||||
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
|
||||
for e in old:
|
||||
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
|
||||
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
|
||||
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
|
||||
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
|
||||
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
|
||||
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-amended-readback','exec'),{})
|
||||
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
|
||||
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
|
||||
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
|
||||
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
|
||||
print('Exact amended source and directory metadata readback pass.')
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
|
||||
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,259 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"all58_hashes_verified": true,
|
||||
"all27_initial_archived_hashes_verified": true,
|
||||
"changed_initial_paths": [
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
|
||||
],
|
||||
"image_context_source_workflow_runtime_scan_unchanged": true,
|
||||
"new_source_tests_passed": 3,
|
||||
"directory_negative_mutations": 3,
|
||||
"optimized_tampered_before_read_refusal": true,
|
||||
"existing_actual_archives_directory_reaudit": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
# Exact amended zlib candidate Product confirmation
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact amended local T05 source candidate preparation only
|
||||
manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
|
||||
comment: >-
|
||||
Same completed T08 preparation trial: work-record refinement was prepared
|
||||
before this formal exact acknowledgment. Initial Product agreement/manifest
|
||||
5f334 remains historical, including its bounded audit validation. This final
|
||||
confirmation covers the guard refinement, not publication/native approval,
|
||||
a second scored success or T05 completion.
|
||||
```
|
||||
|
||||
All58 final staged hashes verify; all27 initial candidate snapshots match
|
||||
immutable manifest8d345bb2. Actual initial-to-current diff changes only four
|
||||
existing paths: artifact checker, its comparison and local-validation receipts,
|
||||
and README. New audit tests/refinement record and original source archive are
|
||||
additions. No Containerfile/workflow, signed APK/index/pins/four-file context,
|
||||
package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source
|
||||
scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe
|
||||
contextc554 and actual retained DB03cacb remain exact. Original four-source-test
|
||||
and Product five negative-probe findings remain applicable, not needlessly rerun.
|
||||
|
||||
The artifact checker now refuses optimized Python before any archive/JSON read,
|
||||
so assertions cannot silently disappear. Directory mode/UID/GID metadata is
|
||||
included in final layer reconstruction and diff enforcement. Three new source
|
||||
tests pass: malformed archive under -O refuses explicitly before reads; identical
|
||||
directory metadata passes; each mode/UID/GID mutation refuses without a report.
|
||||
These fixtures are isolated synthetic source tests. Independent reread of actual
|
||||
existing local saved-image archives confirms equal directory counts and no
|
||||
directory metadata delta; the same two final changed files are libz and APK DB,
|
||||
nine base layers remain prefix and effective runtime config/SBOM/scan match.
|
||||
No new image build, container launch, scan, customer/native data or provider call
|
||||
was performed by this review.
|
||||
|
||||
Initial Product review and validation retain their exact bytes under
|
||||
`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`;
|
||||
original current review file remains the initial agreement, with this separate
|
||||
final acknowledgment carrying the refinement. Signature trust conclusions stay
|
||||
bounded to pinned signed artifacts/unchanged trust metadata, actual retained
|
||||
maker apk verify and enforced recipe; this acknowledgment does not claim fresh
|
||||
cryptographic execution. Zero findings remains specific to retained sameDB scan,
|
||||
not an estate risk grade or future safety assurance.
|
||||
|
||||
T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root
|
||||
source review/commit and admitted owner CI candidate publication, exact actual
|
||||
published registry provenance/package/full scan/SBOM, separate fresh native
|
||||
founder release acceptance and installedr1/runtime/full-rescan proof remain
|
||||
required. Existing approved R2 helper/journal, native image763, DB/config/PVC/
|
||||
identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and
|
||||
unimplemented. This technical acknowledgment grants no native action, human
|
||||
acceptance, credential capability or publication execution.
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,273 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
||||
|
||||
**Exact amended confirmation, same completed T08 preparation trial:** verified
|
||||
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
|
||||
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
|
||||
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
|
||||
remain identical. New3 artifact tests pass (optimized malformed input refused
|
||||
before reads; matching directories pass; directory mode/UID/GID drift refuse).
|
||||
Independent actual saved-image reread proves all directory metadata unchanged,
|
||||
with the same two final file changes. Initial Product manifest5f334/ack/validation
|
||||
are retained as historical source agreement, not new scored native success.
|
||||
This work-record refinement precedes final formal acknowledgment. No publication,
|
||||
native operation, credentials or owner edits. T05progress/WP0009active remains.
|
||||
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
[
|
||||
{
|
||||
"marker": "usr/.wh..wh..opq",
|
||||
"same_layer_new": "usr/new",
|
||||
"actual_names": [
|
||||
"usr"
|
||||
],
|
||||
"same_layer_new_preserved": false
|
||||
},
|
||||
{
|
||||
"marker": ".wh..wh..opq",
|
||||
"same_layer_new": "new",
|
||||
"actual_names": [],
|
||||
"same_layer_new_preserved": false
|
||||
},
|
||||
{
|
||||
"marker": "usr/.wh.child",
|
||||
"same_layer_new": "usr/child/new",
|
||||
"actual_names": [
|
||||
"usr"
|
||||
],
|
||||
"same_layer_new_preserved": false
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
import ast,tarfile,io,json,hashlib,tempfile
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen66-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns)
|
||||
def add(t,name,data):
|
||||
m=tarfile.TarInfo(name);m.mode=0o755
|
||||
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
|
||||
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
|
||||
def layer(entries):
|
||||
b=io.BytesIO()
|
||||
with tarfile.open(fileobj=b,mode='w') as t:
|
||||
for name,data in entries:add(t,name,data)
|
||||
return b.getvalue()
|
||||
results=[]
|
||||
for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]:
|
||||
base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')])
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
path=Path(tmp)/'image.tar'
|
||||
with tarfile.open(path,'w') as t:
|
||||
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over)
|
||||
_,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files))
|
||||
print(json.dumps(results,indent=2))
|
||||
assert all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
# Exact amended zlib candidate Product confirmation
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact amended local T05 source candidate preparation only
|
||||
manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
|
||||
comment: >-
|
||||
Same completed T08 preparation trial: work-record refinement was prepared
|
||||
before this formal exact acknowledgment. Initial Product agreement/manifest
|
||||
5f334 remains historical, including its bounded audit validation. This final
|
||||
confirmation covers the guard refinement, not publication/native approval,
|
||||
a second scored success or T05 completion.
|
||||
```
|
||||
|
||||
All58 final staged hashes verify; all27 initial candidate snapshots match
|
||||
immutable manifest8d345bb2. Actual initial-to-current diff changes only four
|
||||
existing paths: artifact checker, its comparison and local-validation receipts,
|
||||
and README. New audit tests/refinement record and original source archive are
|
||||
additions. No Containerfile/workflow, signed APK/index/pins/four-file context,
|
||||
package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source
|
||||
scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe
|
||||
contextc554 and actual retained DB03cacb remain exact. Original four-source-test
|
||||
and Product five negative-probe findings remain applicable, not needlessly rerun.
|
||||
|
||||
The artifact checker now refuses optimized Python before any archive/JSON read,
|
||||
so assertions cannot silently disappear. Directory mode/UID/GID metadata is
|
||||
included in final layer reconstruction and diff enforcement. Three new source
|
||||
tests pass: malformed archive under -O refuses explicitly before reads; identical
|
||||
directory metadata passes; each mode/UID/GID mutation refuses without a report.
|
||||
These fixtures are isolated synthetic source tests. Independent reread of actual
|
||||
existing local saved-image archives confirms equal directory counts and no
|
||||
directory metadata delta; the same two final changed files are libz and APK DB,
|
||||
nine base layers remain prefix and effective runtime config/SBOM/scan match.
|
||||
No new image build, container launch, scan, customer/native data or provider call
|
||||
was performed by this review.
|
||||
|
||||
Initial Product review and validation retain their exact bytes under
|
||||
`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`;
|
||||
original current review file remains the initial agreement, with this separate
|
||||
final acknowledgment carrying the refinement. Signature trust conclusions stay
|
||||
bounded to pinned signed artifacts/unchanged trust metadata, actual retained
|
||||
maker apk verify and enforced recipe; this acknowledgment does not claim fresh
|
||||
cryptographic execution. Zero findings remains specific to retained sameDB scan,
|
||||
not an estate risk grade or future safety assurance.
|
||||
|
||||
T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root
|
||||
source review/commit and admitted owner CI candidate publication, exact actual
|
||||
published registry provenance/package/full scan/SBOM, separate fresh native
|
||||
founder release acceptance and installedr1/runtime/full-rescan proof remain
|
||||
required. Existing approved R2 helper/journal, native image763, DB/config/PVC/
|
||||
identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and
|
||||
unimplemented. This technical acknowledgment grants no native action, human
|
||||
acceptance, credential capability or publication execution.
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
# Exact66 zlib audit whiteout Product finding
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: changes_requested
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact66 local candidate artifact-audit source refinement
|
||||
manifest_sha256: 3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0
|
||||
comment: >-
|
||||
Same completed T08; work record prepared before this formal finding.
|
||||
No actual candidate-image failure or new scored/native trial. Preserve
|
||||
initial5f334 and intermediate8bc6 acknowledgments as historical.
|
||||
```
|
||||
|
||||
All66 staged hashes independently verify. Whiteout leading-dot and root opaque
|
||||
handling corrections address the prior cases, but remaining stream-order behavior
|
||||
violates the lower-layer boundary. A synthetic parent layer contains usr/child/old;
|
||||
next layer writes a new file before its whiteout marker. Three retained isolated
|
||||
probes reproduce incorrect deletion: usr/new then usr/.wh..wh..opq, root new then
|
||||
.wh..wh..opq, and usr/child/new then usr/.wh.child. Actual parsed sets lose the
|
||||
same-layer new file in every case. Frozen checker/manifest and reproducible
|
||||
probe/receipt are retained under docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/.
|
||||
|
||||
[OCI layer specification](https://github.com/opencontainers/image-spec/blob/main/layer.md)
|
||||
requires whiteouts to affect only parent layers and opacity to precede new entries
|
||||
regardless archive ordering. Correct reconstruction should apply whiteouts to
|
||||
the prior layer state and then merge current layer additions, preserving both
|
||||
marker-before and marker-after order semantics. Add meaningful root/nested opaque
|
||||
and explicit-directory removal cases with same-layer children/replacements.
|
||||
The existing four no-new-sibling cases cannot establish this boundary.
|
||||
|
||||
This finding is confined to audit-source semantics, not APK trust or actual image
|
||||
contents/build/scan. Current actual candidate image/context/package/workflow/
|
||||
runtime and scanner evidence remain unchanged; no native/read-only command or
|
||||
customer/DB/credential access occurred. T05 remains progress/WP0009 active;
|
||||
publication and distinct founder native release/installed proof remain pending.
|
||||
A corrected exact frozen packet needs final technical confirmation.
|
||||
|
|
@ -0,0 +1,288 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
||||
|
||||
**Exact amended confirmation, same completed T08 preparation trial:** verified
|
||||
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
|
||||
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
|
||||
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
|
||||
remain identical. New3 artifact tests pass (optimized malformed input refused
|
||||
before reads; matching directories pass; directory mode/UID/GID drift refuse).
|
||||
Independent actual saved-image reread proves all directory metadata unchanged,
|
||||
with the same two final file changes. Initial Product manifest5f334/ack/validation
|
||||
are retained as historical source agreement, not new scored native success.
|
||||
This work-record refinement precedes final formal acknowledgment. No publication,
|
||||
native operation, credentials or owner edits. T05progress/WP0009active remains.
|
||||
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Exact66 whiteout follow-through, same completed T08 preparation:** independently
|
||||
verified manifest3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0
|
||||
and all66 hashes. New source correction preserves leading whiteout dots/root
|
||||
parent handling, but three Product synthetic probes find same-layer new files
|
||||
incorrectly removed by subsequent nested/root opaque or explicit descendant
|
||||
whiteouts. OCI requires whiteouts affect only lower layers and preserve same-layer
|
||||
additions regardless archive order. Completed source assessment changes_requested
|
||||
before formal entry: apply whiteouts only previous layers then merge current
|
||||
layer additions, with both archive orders covered. No actual candidate failure
|
||||
or image/sourcecontext/scan change is inferred. Initial5f334 and intermediate
|
||||
8bc6 reviews/evidence remain historical, not rewritten; same T08/no new trial.
|
||||
No owner edits, native operation, publication or credentials.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md.
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
from pathlib import Path
|
||||
import json,hashlib,subprocess
|
||||
S=Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=Path('/tmp/infd-zlib-product-complete-ack-stage');H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
m=Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec';entries=json.loads(m.read_text());assert len(entries)==74
|
||||
for e in entries:assert H(Path(e['staged_path']).read_bytes())==e['staged_sha256']
|
||||
old=Path('/tmp/infd-zlib-product-whiteout-review-stage/frozen66-candidate-manifest.json');oldentries=json.loads(old.read_text());changed=[]
|
||||
for e in oldentries:
|
||||
p=S/e['path'];assert p.exists()
|
||||
if H(p.read_bytes())!=e['staged_sha256']:changed.append(e['path'])
|
||||
assert all(p.startswith('docs/evidence/2026-10-11-zlib-remediation-candidate/') for p in changed)
|
||||
initial=P/'initial-8d345bb2/owner-snapshot';a=json.loads((initial/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text());b=json.loads((P/'local-candidate-verification.json').read_text())
|
||||
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert a[k]==b[k]
|
||||
(O/'frozen74-verify_local_artifacts.py').write_bytes((P/'verify_local_artifacts.py').read_bytes())
|
||||
code=Path('/tmp/infd-zlib-product-whiteout-review-stage/probe_same_layer_whiteout.py').read_text().replace('frozen66-verify_local_artifacts.py','frozen74-verify_local_artifacts.py').replace("all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'","all(r['same_layer_new_preserved'] for r in results),'same-layer addition lost'")
|
||||
(O/'probe_corrected_same_layer_whiteout.py').write_text(code)
|
||||
r=subprocess.run(['python3',str(O/'probe_corrected_same_layer_whiteout.py')],capture_output=True,text=True);assert r.returncode==0,r.stderr;(O/'corrected-probe-receipt.json').write_text(r.stdout)
|
||||
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-complete-ack-stage')/'independent-final-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-final74-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-final-artifact-comparison.json').read_text());official=json.loads((P/'artifact-comparison.json').read_text())
|
||||
for k in ['final_changed_files','directory_count_base','directory_count_candidate','directory_metadata_delta','base_layers_preserved','sbom_only_delta']:assert proof[k]==official[k]
|
||||
assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} and not proof['directory_metadata_delta']
|
||||
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all74_hashes_verified=True,changed_from66=changed,source_recipe_workflow_context_image_scan_unchanged=True,new_audit_tests_passed=5,whiteout_semantic_cases=12,additional_product_original_counterexamples_now_preserved=3,actual_saved_archive_reaudit_pass=True,directory_count_base=proof['directory_count_base'],directory_count_candidate=proof['directory_count_candidate'],directory_metadata_delta={},sameT08=True,native_actions=False,publication=False),indent=2)+'\n')
|
||||
print('Exact74 and all original Product counterexamples now pass; existing actual image re-audit passes.')
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
[
|
||||
{
|
||||
"marker": "usr/.wh..wh..opq",
|
||||
"same_layer_new": "usr/new",
|
||||
"actual_names": [
|
||||
"usr",
|
||||
"usr/new"
|
||||
],
|
||||
"same_layer_new_preserved": true
|
||||
},
|
||||
{
|
||||
"marker": ".wh..wh..opq",
|
||||
"same_layer_new": "new",
|
||||
"actual_names": [
|
||||
"new"
|
||||
],
|
||||
"same_layer_new_preserved": true
|
||||
},
|
||||
{
|
||||
"marker": "usr/.wh.child",
|
||||
"same_layer_new": "usr/child/new",
|
||||
"actual_names": [
|
||||
"usr",
|
||||
"usr/child/new"
|
||||
],
|
||||
"same_layer_new_preserved": true
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
from pathlib import Path
|
||||
import hashlib,io,json,tarfile,sys
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
|
||||
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
|
||||
def image(path):
|
||||
with tarfile.open(path) as archive:
|
||||
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
|
||||
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
|
||||
files={}
|
||||
for name in manifest[0]['Layers']:
|
||||
additions={};removed=[];opaque=[]
|
||||
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
|
||||
for member in layer:
|
||||
path=member.name
|
||||
while path.startswith('./'):path=path[2:]
|
||||
path=path.lstrip('/');p=Path(path)
|
||||
if p.name=='.wh..wh..opq':
|
||||
parent=p.parent.as_posix();opaque.append('' if parent=='.' else parent+'/');continue
|
||||
if p.name.startswith('.wh.'):
|
||||
removed.append((p.parent/p.name[4:]).as_posix());continue
|
||||
if member.isfile():
|
||||
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
|
||||
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
|
||||
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
|
||||
else:continue
|
||||
additions[path]=value
|
||||
# OCI whiteouts mask lower-layer entries only; same-layer additions survive
|
||||
# independently of where the marker appeared in the layer tar stream.
|
||||
files={key:value for key,value in files.items() if not any(key.startswith(prefix) for prefix in opaque) and not any(key==target or key.startswith(target+'/') for target in removed)}
|
||||
files.update(additions)
|
||||
return config,hashlib.sha256(configbytes).hexdigest(),files
|
||||
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
|
||||
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
|
||||
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
|
||||
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
assert set(changed)<=expected,set(changed)
|
||||
a,b=base['config'].copy(),candidate['config'].copy()
|
||||
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
|
||||
a.pop('Image',None);b.pop('Image',None)
|
||||
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
|
||||
for key,value in defaults.items():
|
||||
a.setdefault(key,value);b.setdefault(key,value)
|
||||
assert a==b,(a,b)
|
||||
components=[]
|
||||
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
|
||||
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
|
||||
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
|
||||
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
|
||||
vulns=[]
|
||||
for name in ['base-trivy-full.json','trivy-full.json']:
|
||||
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
|
||||
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
|
||||
assert not vulns[1]
|
||||
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
|
||||
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
import ast,tarfile,io,json,hashlib,tempfile
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen74-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns)
|
||||
def add(t,name,data):
|
||||
m=tarfile.TarInfo(name);m.mode=0o755
|
||||
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
|
||||
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
|
||||
def layer(entries):
|
||||
b=io.BytesIO()
|
||||
with tarfile.open(fileobj=b,mode='w') as t:
|
||||
for name,data in entries:add(t,name,data)
|
||||
return b.getvalue()
|
||||
results=[]
|
||||
for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]:
|
||||
base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')])
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
path=Path(tmp)/'image.tar'
|
||||
with tarfile.open(path,'w') as t:
|
||||
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over)
|
||||
_,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files))
|
||||
print(json.dumps(results,indent=2))
|
||||
assert all(r['same_layer_new_preserved'] for r in results),'same-layer addition lost'
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"exact_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"all74_hashes_verified": true,
|
||||
"changed_from66": [
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
|
||||
],
|
||||
"source_recipe_workflow_context_image_scan_unchanged": true,
|
||||
"new_audit_tests_passed": 5,
|
||||
"whiteout_semantic_cases": 12,
|
||||
"additional_product_original_counterexamples_now_preserved": 3,
|
||||
"actual_saved_archive_reaudit_pass": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sameT08": true,
|
||||
"native_actions": false,
|
||||
"publication": false
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
import pathlib,json,hashlib
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
|
||||
entries=json.loads(m.read_text());assert len(entries)==58
|
||||
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
|
||||
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
|
||||
for e in old:
|
||||
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
|
||||
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
|
||||
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
|
||||
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
|
||||
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
|
||||
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-amended-readback','exec'),{})
|
||||
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
|
||||
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
|
||||
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
|
||||
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
|
||||
print('Exact amended source and directory metadata readback pass.')
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
|
||||
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,259 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"all58_hashes_verified": true,
|
||||
"all27_initial_archived_hashes_verified": true,
|
||||
"changed_initial_paths": [
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
|
||||
],
|
||||
"image_context_source_workflow_runtime_scan_unchanged": true,
|
||||
"new_source_tests_passed": 3,
|
||||
"directory_negative_mutations": 3,
|
||||
"optimized_tampered_before_read_refusal": true,
|
||||
"existing_actual_archives_directory_reaudit": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,464 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
from pathlib import Path
|
||||
import hashlib,io,json,tarfile,sys
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
|
||||
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
|
||||
def image(path):
|
||||
with tarfile.open(path) as archive:
|
||||
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
|
||||
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
|
||||
files={}
|
||||
for name in manifest[0]['Layers']:
|
||||
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
|
||||
for member in layer:
|
||||
path=member.name
|
||||
while path.startswith('./'):path=path[2:]
|
||||
path=path.lstrip('/');p=Path(path)
|
||||
if p.name=='.wh..wh..opq':
|
||||
folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/'
|
||||
files={key:value for key,value in files.items() if not key.startswith(prefix)};continue
|
||||
if p.name.startswith('.wh.'):
|
||||
removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue
|
||||
if member.isfile():
|
||||
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
|
||||
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
|
||||
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
|
||||
else:continue
|
||||
files[path]=value
|
||||
return config,hashlib.sha256(configbytes).hexdigest(),files
|
||||
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
|
||||
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
|
||||
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
|
||||
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
assert set(changed)<=expected,set(changed)
|
||||
a,b=base['config'].copy(),candidate['config'].copy()
|
||||
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
|
||||
a.pop('Image',None);b.pop('Image',None)
|
||||
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
|
||||
for key,value in defaults.items():
|
||||
a.setdefault(key,value);b.setdefault(key,value)
|
||||
assert a==b,(a,b)
|
||||
components=[]
|
||||
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
|
||||
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
|
||||
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
|
||||
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
|
||||
vulns=[]
|
||||
for name in ['base-trivy-full.json','trivy-full.json']:
|
||||
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
|
||||
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
|
||||
assert not vulns[1]
|
||||
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
|
||||
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"scope": "exact amended T05 source agreement; same T08; historical initial review retained; no publication or native go",
|
||||
"candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"initial_product_review_manifest_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
import pathlib,json,hashlib
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8'
|
||||
entries=json.loads(m.read_text());assert len(entries)==58
|
||||
for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256']
|
||||
oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[]
|
||||
for e in old:
|
||||
original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256']
|
||||
if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path'])
|
||||
assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']}
|
||||
r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text())
|
||||
for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k]
|
||||
code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-amended-readback','exec'),{})
|
||||
a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text())
|
||||
for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k]
|
||||
assert a['directory_metadata_compared'] and not a['directory_metadata_delta']
|
||||
(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n')
|
||||
print('Exact amended source and directory metadata readback pass.')
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"owner": "informed-decision",
|
||||
"scope": "exact local T05 source candidate only; no native go/publication or task completion",
|
||||
"candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"files": [
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md",
|
||||
"original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8",
|
||||
"staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,259 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"all58_hashes_verified": true,
|
||||
"all27_initial_archived_hashes_verified": true,
|
||||
"changed_initial_paths": [
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py"
|
||||
],
|
||||
"image_context_source_workflow_runtime_scan_unchanged": true,
|
||||
"new_source_tests_passed": 3,
|
||||
"directory_negative_mutations": 3,
|
||||
"optimized_tampered_before_read_refusal": true,
|
||||
"existing_actual_archives_directory_reaudit": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
import pathlib,json,hashlib,copy,importlib.util,tarfile
|
||||
S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json')
|
||||
H=lambda b:hashlib.sha256(b).hexdigest()
|
||||
assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66'
|
||||
for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256']
|
||||
E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text())
|
||||
for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h
|
||||
spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
||||
a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36
|
||||
mutations=['appfile','keys','world','network','provider']
|
||||
for field in mutations:
|
||||
c=copy.deepcopy(b)
|
||||
if field=='appfile':c['app_file_sha256']['policy.py']='0'*64
|
||||
elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64
|
||||
elif field=='world':c['apk_world_sha256']='0'*64
|
||||
elif field=='network':c['network_accessed']=True
|
||||
else:c['provider_or_customer_data_used']=True
|
||||
try:cmp.compare(a,c)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError(field)
|
||||
# Read local image archives, source verifier operations are limited to these public local artifacts.
|
||||
code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text")
|
||||
exec(compile(code,'product-local-artifact-readback','exec'),{})
|
||||
proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']:
|
||||
assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key]
|
||||
# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline.
|
||||
for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']:
|
||||
with tarfile.open(S/'deploy/zlib-overlay'/n) as t:
|
||||
signs=[x.name for x in t if x.name.startswith('.SIGN.')]
|
||||
assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs
|
||||
assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256']
|
||||
base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text())
|
||||
assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44
|
||||
assert base_scan['Metadata']['OS']==scan['Metadata']['OS']
|
||||
assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])]
|
||||
container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container
|
||||
result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False}
|
||||
(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.')
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"all27_staged_hashes_verified": true,
|
||||
"evidence_hashes_verified": true,
|
||||
"existing_source_tests": 4,
|
||||
"existing_source_negative_mutations": 8,
|
||||
"additional_product_negative_mutations": [
|
||||
"appfile",
|
||||
"keys",
|
||||
"world",
|
||||
"network",
|
||||
"provider"
|
||||
],
|
||||
"saved_image_fs_and_layer_runtime_readback": true,
|
||||
"sbom_only_zlib_delta": true,
|
||||
"scan44_packages_zero_at_retained_db": true,
|
||||
"signed_archive_named_key_matches_unchanged_baseline_truststore": true,
|
||||
"signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.",
|
||||
"native_actions": false,
|
||||
"candidate_published": false
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
# Exact amended zlib candidate Product confirmation
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact amended local T05 source candidate preparation only
|
||||
manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
|
||||
comment: >-
|
||||
Same completed T08 preparation trial: work-record refinement was prepared
|
||||
before this formal exact acknowledgment. Initial Product agreement/manifest
|
||||
5f334 remains historical, including its bounded audit validation. This final
|
||||
confirmation covers the guard refinement, not publication/native approval,
|
||||
a second scored success or T05 completion.
|
||||
```
|
||||
|
||||
All58 final staged hashes verify; all27 initial candidate snapshots match
|
||||
immutable manifest8d345bb2. Actual initial-to-current diff changes only four
|
||||
existing paths: artifact checker, its comparison and local-validation receipts,
|
||||
and README. New audit tests/refinement record and original source archive are
|
||||
additions. No Containerfile/workflow, signed APK/index/pins/four-file context,
|
||||
package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source
|
||||
scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe
|
||||
contextc554 and actual retained DB03cacb remain exact. Original four-source-test
|
||||
and Product five negative-probe findings remain applicable, not needlessly rerun.
|
||||
|
||||
The artifact checker now refuses optimized Python before any archive/JSON read,
|
||||
so assertions cannot silently disappear. Directory mode/UID/GID metadata is
|
||||
included in final layer reconstruction and diff enforcement. Three new source
|
||||
tests pass: malformed archive under -O refuses explicitly before reads; identical
|
||||
directory metadata passes; each mode/UID/GID mutation refuses without a report.
|
||||
These fixtures are isolated synthetic source tests. Independent reread of actual
|
||||
existing local saved-image archives confirms equal directory counts and no
|
||||
directory metadata delta; the same two final changed files are libz and APK DB,
|
||||
nine base layers remain prefix and effective runtime config/SBOM/scan match.
|
||||
No new image build, container launch, scan, customer/native data or provider call
|
||||
was performed by this review.
|
||||
|
||||
Initial Product review and validation retain their exact bytes under
|
||||
`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`;
|
||||
original current review file remains the initial agreement, with this separate
|
||||
final acknowledgment carrying the refinement. Signature trust conclusions stay
|
||||
bounded to pinned signed artifacts/unchanged trust metadata, actual retained
|
||||
maker apk verify and enforced recipe; this acknowledgment does not claim fresh
|
||||
cryptographic execution. Zero findings remains specific to retained sameDB scan,
|
||||
not an estate risk grade or future safety assurance.
|
||||
|
||||
T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root
|
||||
source review/commit and admitted owner CI candidate publication, exact actual
|
||||
published registry provenance/package/full scan/SBOM, separate fresh native
|
||||
founder release acceptance and installedr1/runtime/full-rescan proof remain
|
||||
required. Existing approved R2 helper/journal, native image763, DB/config/PVC/
|
||||
identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and
|
||||
unimplemented. This technical acknowledgment grants no native action, human
|
||||
acceptance, credential capability or publication execution.
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Bounded zlib candidate Product owner review
|
||||
|
||||
```yaml
|
||||
reviewer: informed-decision-owner (agent informed-decision, codex)
|
||||
decision: approved
|
||||
work_item: INFD-WP-ADHOC-2026-10-11-T08
|
||||
scope: exact local zlib-only source candidate technical preparation
|
||||
manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66
|
||||
comment: >-
|
||||
Informed-decision intent requires human binding and preserved evidence; this
|
||||
candidate changes only a native compression dependency while preserving
|
||||
application authorization/presentation behavior. T08 review work record was
|
||||
completed first. This is technical source agreement, not native go, publication
|
||||
receipt, founder acceptance or T05 completion.
|
||||
```
|
||||
|
||||
All27 staged hashes and retained evidence-file hashes independently verify.
|
||||
Independent saved-image archive readback confirms all nine exact763 base diff_ids
|
||||
as prefix, equal effective runtime configuration with only explicitly normalized
|
||||
empty/false/null defaults, and final filesystem changes exactly
|
||||
`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent.
|
||||
Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL
|
||||
and UID/GID10001 remain equal. Root build identity returns to10001:10001.
|
||||
No service values, namespace, DB, customer data, config, PVC, schema, audience,
|
||||
policy pins, protected helper or existing release journal is changed.
|
||||
|
||||
Package/index bytes match pinned official HTTPS download hashes. Both signed
|
||||
archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present
|
||||
in unchanged baseline trust metadata. Retained actual maker apk verify success
|
||||
against exact763 installed keys is the execution evidence; this review separately
|
||||
checks archive signatures' metadata, bytes and trust identity, without claiming
|
||||
a new signature-verification execution. Containerfile requires digest checks and
|
||||
`apk verify` success before offline named-package upgrade; no allow-untrusted or
|
||||
keys-dir override. Existing trusted keys are not replaced.
|
||||
[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd)
|
||||
defines integrity/signature checking and nonzero failure.
|
||||
Upgrade selects only zlib from retained local signed index, disables network,
|
||||
preupgrade and logging, and removes temporary public artifacts.
|
||||
|
||||
Both full CycloneDX/Trivy artifacts independently show44 packages and only
|
||||
zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM
|
||||
CVE-2026-85091; candidate has zero findings at the retained same database
|
||||
03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917.
|
||||
No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning
|
||||
and actual38 OS/6 Python detector coverage remain disclosed. This is bounded
|
||||
scan improvement at that snapshot, not estate risk grading or future safety.
|
||||
Local daemon image78bfdcc and saved OCI config625d are distinct disclosed
|
||||
representations; neither is a published registry digest or native image proof.
|
||||
|
||||
Four existing source tests pass, covering eight mutations; five additional Product
|
||||
mutations of app source, trust keys, APK world, network and provider/data flags
|
||||
refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt.
|
||||
Retained four compression vectors/three malformed refusals/crypto/JWT/waitress
|
||||
and ten installed purpose variants are local synthetic checks, not live PDP
|
||||
or customer/native-data testing. No new container or native execution by reviewer.
|
||||
|
||||
Workflow publishes only a source-bound candidate through existing admitted owner
|
||||
registry capability after root source review/commit: exact40hex source revision,
|
||||
fixed owner archive, four input hashes/contextc554, exact763 base, no-network
|
||||
bounded build, unchanged runtime comparison and purpose checks before push.
|
||||
It has no kubectl, Argo, DB/admin, namespace or runtime deployment action.
|
||||
The workflow is unexecuted; source review does not attest CI credentials, actual
|
||||
publication or published artifact equivalence. Root must retain actual CI/source
|
||||
revision and registry descriptor/layer/config/package/signature/context readback,
|
||||
then full published scan/SBOM and scoped candidate release preparation. Only
|
||||
distinct exact informed-decision founder native approval followed by installedr1,
|
||||
runtime/purpose and full-rescan proof can close T05. Future image-only rollback
|
||||
to763 preserves latest DB; no historical snapshot restore.
|
||||
|
||||
T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic
|
||||
controller is implied. T04/c96 accepted outcome and original uncertain journals
|
||||
remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted.
|
||||
No new native authority, owner checkout write, credential/login, deployment or
|
||||
customer-data access occurred in this review.
|
||||
|
|
@ -0,0 +1,273 @@
|
|||
---
|
||||
id: INFD-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Application-owner catalogue facts review"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: planning
|
||||
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
|
||||
---
|
||||
|
||||
## Review exact one-application catalogue facts
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
|
||||
```
|
||||
|
||||
Completed informed-decision application-owner source review under INTENT.md
|
||||
Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
|
||||
and Layer Placement. Read actual owner OIDC, requester and policy-request
|
||||
code, governing Staff/PEP-shaped declaration, User Engine model, and existing
|
||||
value-free native registration/Ingress/preflight receipts. Exact canonical
|
||||
facts agree. Browser client is distinct from create-only requester.
|
||||
|
||||
Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
|
||||
Canonical facts SHA-256:
|
||||
`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
|
||||
Reviewed refined nine-file executor manifest SHA-256:
|
||||
`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
|
||||
|
||||
This task completes the application-facts source review only. It grants no
|
||||
maintenance exception, native dry-run/apply/recovery, IAM permission, image
|
||||
release or human disposition. Existing User Engine native acceptance work
|
||||
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
|
||||
created by this bounded review. No tests were needed for this evidence-only
|
||||
review; no native, credential or login action occurred.
|
||||
|
||||
## Independently review purpose overlay release preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed same-role informed-decision-owner technical review of frozen36-path
|
||||
purpose release manifest SHA-256
|
||||
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
|
||||
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
|
||||
Source candidates and captured candidate Deployment differ only in the image.
|
||||
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
|
||||
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
|
||||
sealed native read-only preflight support preparation, not native deployment.
|
||||
|
||||
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
|
||||
binding forms across register, replay, publish, annotate and revise. Each
|
||||
refusal preserves every domain table, records a truthful invalid-decision
|
||||
observation and leaves the same idempotency key reusable after restoring a
|
||||
canonical enforcement response. These are synthetic source tests only.
|
||||
Test: tests/test_purpose_owner_mutation_negatives.py.
|
||||
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
|
||||
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
|
||||
|
||||
This bounded review grants no native backup/export/restore, image rollout,
|
||||
credentials, login, human disposition or vulnerability acceptance. Existing
|
||||
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
|
||||
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
|
||||
|
||||
## Confirm amended purpose release custody and preflight gates
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
|
||||
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
|
||||
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
|
||||
and both image-only source candidates unchanged. Prior50 source lifecycle
|
||||
mutation/idempotency negatives remain applicable and were not repeated.
|
||||
|
||||
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
|
||||
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
|
||||
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
|
||||
equality distinguished from legitimate concurrent live commits. Revised20-doc
|
||||
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
|
||||
Native schema gate, backup/export/restore/release and founder disposition remain
|
||||
unperformed; T04/T05 obligations and temporary vulnerability review persist.
|
||||
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
|
||||
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
|
||||
receipt remain unchanged. No new residual or authority is created by this review.
|
||||
|
||||
## Reconcile Staff evidence source declaration and current guarantees
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
|
||||
class definitions, transactional recording, heartbeat/reconciliation scheduling,
|
||||
existing component-test assertions and native count/receipt evidence. Reconciled
|
||||
stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
|
||||
finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
|
||||
NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
|
||||
source intake for remaining class-specific declaration/verification gaps,
|
||||
origin INFD-WP-0007. No residual implementation or native action occurred.
|
||||
|
||||
Source evidence reconciliation:
|
||||
docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
|
||||
Formal source review:
|
||||
docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
|
||||
Existing Staff/PEP-shaped classification, three load-bearing class classifications,
|
||||
compromised-source and commitment/content availability limits remain unchanged.
|
||||
|
||||
## Independently review supervised purpose actuator product boundaries
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Same informed-decision-owner reviewed exact23-path helper manifest
|
||||
`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,
|
||||
all staged hashes and embedded source bundle/plan. Product evidence/schema5,
|
||||
private snapshot custody, confined offline UID0 initialization followed by
|
||||
UID10001 pre/post-admin verification, independent failed-candidate rollback
|
||||
and all-phase start deadline are technically agreed as source preparation.
|
||||
|
||||
No purpose-policy or candidate image change. Retained helper16 synthetic tests
|
||||
and platform5 independent recovery negatives are mechanism proof; prior50
|
||||
product policy negatives remain applicable. No new test run was needed for this
|
||||
unchanged-source review. Native-provider acceptance remains distinct from the
|
||||
installed10 synthetic purpose forms; T04 is not complete. Before first human
|
||||
post, amend exact20-document packet to hash-bind helper/plan, four render inputs,
|
||||
initializer/recovery/deadline refinements and preserved full scan provenance.
|
||||
Exact combined packet acknowledgement remains a separate review gate.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md.
|
||||
No native reads/backups/export/restore/release, credentials, human disposition,
|
||||
founder approval or phase authority was exercised by this review.
|
||||
|
||||
## Prepare separately gated provider-derived denial mechanism probe
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Prepared source-only readonly lifecycle.search provider-derived mechanism probe
|
||||
with truthful informed-decision/review SERVICE and no human/StateHub attributes.
|
||||
Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a
|
||||
canonical real DENY is required; no claims are invented to obtain ALLOW.
|
||||
One actual provider response will remain in Pod memory; ten transformed
|
||||
noncanonical purpose copies test installed consumer refusal without further
|
||||
provider calls, DB/admin or act effects. This is a denial/binding mechanism
|
||||
proof candidate, not actual authorized lifecycle or full T04 acceptance.
|
||||
|
||||
Source: docs/evidence/2026-10-11-purpose-provider-probe/.
|
||||
Ten synthetic source tests pass; no actual provider, credential, runtime config,
|
||||
DB, native data or live action was accessed. Posted frozen112 packet/helper
|
||||
remain unchanged. Exact separate founder go for this newly prepared probe and
|
||||
its target must precede any execution; current memo has no acceptance and this
|
||||
new helper is not hash-bound in that submitted packet. T04 remains progress.
|
||||
|
||||
## Review exact existing-snapshot rescue version2 preparation
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7
|
||||
under the same informed-decision-owner role. Actual original backupCOMPLETE/copy
|
||||
UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1
|
||||
require fresh founder acceptance. Immutable reads are bounded to proven frozen
|
||||
closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose.
|
||||
Independent existing26 mocked tests plus41 subtests pass, and10 new product scope
|
||||
guards pass (including eight refusal mutations and a frozen initial packet check).
|
||||
No native command, DB open, credentials or rescue operation occurred.
|
||||
|
||||
Initial review decision changes_requested: proposal.json misleadingly names old
|
||||
f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed;
|
||||
label it original/historical and refreeze all dependent packet hashes. Correct
|
||||
current bundle/plan digests already exist. The normalized test fixture is not an
|
||||
owner edit or approval. Initial review/failure must remain after correction;
|
||||
exact amended confirmation is still required before newhuman submission/execution.
|
||||
|
||||
Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md.
|
||||
Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/.
|
||||
T04 remains progress; original version1 approval is not newversion2 authority.
|
||||
|
||||
**Amended source confirmation, same T07 trial:** exact134-path manifest
|
||||
`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d`
|
||||
corrects only the historical helper provenance label and dependent packet hashes;
|
||||
original66 source and initial changes-requested review remain retained. Current
|
||||
helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1
|
||||
and20documents validate:173469packetbytes/240451revisionbytes. Eight scope
|
||||
mutations and three packet mutations independently refuse. Final technical
|
||||
source acknowledgement approved; no new human acceptance or native rescue.
|
||||
Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md.
|
||||
|
||||
|
||||
**Actual-outcome assessment preparation, same completed T07 trial:** independently
|
||||
verified original receipt-byte hashes and source consumer path after approved
|
||||
source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover
|
||||
backup/private copy matches live post-release counts16/56/0, delivered336,
|
||||
confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001
|
||||
checks pass. Actual post-rollout authenticated provider-backed outcomes readback
|
||||
is separate from installed ten synthetic purpose forms (2allow/8refuse).
|
||||
Completed source-only assessment supports T04 done, T05 todo and WP0009 active.
|
||||
Original failed copy and verifier UNCERTAIN remain preserved, with no replay or
|
||||
helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission
|
||||
handling correction; no implementation, native action or authority grant.
|
||||
This work-record preparation precedes the formal actual-outcome review entry.
|
||||
Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md.
|
||||
Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/.
|
||||
|
||||
|
||||
## Independently review bounded zlib-only T05 source candidate
|
||||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-11-T08
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Completed informed-decision Product source review of exact27-path candidate
|
||||
manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66.
|
||||
All staged/evidence hashes verify. Independently reread local saved base/candidate
|
||||
image archives, effective runtime config, nine base layer prefix, two final file
|
||||
changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs;
|
||||
44 packages/base1MED to candidate0 at retained same scanner database.
|
||||
Signed APK/index named key matches unchanged base trust metadata; enforced
|
||||
apk verify against existing keys retained, no allow-untrusted or truststore override.
|
||||
Four existing source tests pass (eight refusal mutations), plus five independent
|
||||
appfile/trustkeys/world/network/provider metadata mutations refuse.
|
||||
Purpose/backend checks remain local and synthetic, not actual PDP or data proof.
|
||||
Technical source preparation agreement only: local image78bfdcc is unpublished,
|
||||
T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and
|
||||
new native founder approval/installed proof are still required. Current763/native
|
||||
DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010
|
||||
is unpromoted/unimplemented. No native actions, credentials or owner source writes.
|
||||
This completed work record is prepared before the formal review entry.
|
||||
Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md.
|
||||
Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/.
|
||||
|
||||
|
||||
**Exact amended confirmation, same completed T08 preparation trial:** verified
|
||||
final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8
|
||||
and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs
|
||||
change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB
|
||||
remain identical. New3 artifact tests pass (optimized malformed input refused
|
||||
before reads; matching directories pass; directory mode/UID/GID drift refuse).
|
||||
Independent actual saved-image reread proves all directory metadata unchanged,
|
||||
with the same two final file changes. Initial Product manifest5f334/ack/validation
|
||||
are retained as historical source agreement, not new scored native success.
|
||||
This work-record refinement precedes final formal acknowledgment. No publication,
|
||||
native operation, credentials or owner edits. T05progress/WP0009active remains.
|
||||
Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md.
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
[
|
||||
{
|
||||
"marker": "usr/.wh..wh..opq",
|
||||
"same_layer_new": "usr/new",
|
||||
"actual_names": [
|
||||
"usr"
|
||||
],
|
||||
"same_layer_new_preserved": false
|
||||
},
|
||||
{
|
||||
"marker": ".wh..wh..opq",
|
||||
"same_layer_new": "new",
|
||||
"actual_names": [],
|
||||
"same_layer_new_preserved": false
|
||||
},
|
||||
{
|
||||
"marker": "usr/.wh.child",
|
||||
"same_layer_new": "usr/child/new",
|
||||
"actual_names": [
|
||||
"usr"
|
||||
],
|
||||
"same_layer_new_preserved": false
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
import ast,tarfile,io,json,hashlib,tempfile
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen66-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns)
|
||||
def add(t,name,data):
|
||||
m=tarfile.TarInfo(name);m.mode=0o755
|
||||
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
|
||||
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
|
||||
def layer(entries):
|
||||
b=io.BytesIO()
|
||||
with tarfile.open(fileobj=b,mode='w') as t:
|
||||
for name,data in entries:add(t,name,data)
|
||||
return b.getvalue()
|
||||
results=[]
|
||||
for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]:
|
||||
base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')])
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
path=Path(tmp)/'image.tar'
|
||||
with tarfile.open(path,'w') as t:
|
||||
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over)
|
||||
_,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files))
|
||||
print(json.dumps(results,indent=2))
|
||||
assert all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# Separate T05 zlib-only candidate — local verified, unpublished/unapproved
|
||||
|
||||
Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical.
|
||||
|
||||
Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed.
|
||||
|
||||
Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues.
|
||||
|
||||
T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits.
|
||||
|
||||
Platform audit refinement (same T05 proposal): the checker now refuses optimized Python before artifact reads and compares directory mode, UID and GID. The actual existing image passed the expanded audit with no directory changes and the same two changed files. Three synthetic tests cover optimization and three directory drift cases. Original 27-file source/manifest and actual scan receipts are retained in `initial-8d345bb2/`; this was a source guard correction, not an original candidate failure. Recipe, four-file build context, image78 and full scan bytes are unchanged.
|
||||
|
||||
Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Four semantic fixtures pass. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 manifest and changed evidence bytes are retained separately; the existing candidate did not fail.
|
||||
|
||||
Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Twelve semantic fixtures pass, including reversed tar-order same-layer additions/replacements. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 and 3e41ab39 manifests and changed evidence bytes are retained separately; the existing candidate did not fail.
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false,
|
||||
"candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs."
|
||||
}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
{
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"same_trial": true,
|
||||
"original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1",
|
||||
"reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail",
|
||||
"changes": [
|
||||
"Explicit optimized Python refusal before any archive/JSON read",
|
||||
"Filesystem audit includes final directory mode/UID/GID metadata",
|
||||
"Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses",
|
||||
"Preserve OCI whiteout leading dots and clear root/nested descendants correctly; four semantic fixtures cover removal and opacity",
|
||||
"Whiteouts mask lower layers only; merge same-layer additions after masking. Eight root/nested opacity, sibling and replacement tar-order fixtures added"
|
||||
],
|
||||
"actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files",
|
||||
"candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"registry_publication": false,
|
||||
"native_changes": false,
|
||||
"checker_sha256": "d727f60edd004184c79903c20619643033fac68afbecfb1990cce855cdb924e3",
|
||||
"tests_sha256": "12ba4ce8c082450241118d73139c59e06b3a337b152e3364918a5b2850f2dc47",
|
||||
"comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89",
|
||||
"verification_sha256": "efbb173dcb9358b58bd703a18e63c6c25805167d5a14856ed095d05be4309709",
|
||||
"intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"whiteout_refinement_note": "Conservative incorrect effective-rootfs modeling in the intermediate checker, not failure of the actual candidate",
|
||||
"layer_order_review_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1 @@
|
|||
{"Id":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","RepoTags":["informed-decision:zlib-r1-local-20261011"],"RepoDigests":["informed-decision@sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31"],"Created":"2026-10-11T09:29:32.511197114+02:00","Config":{"User":"10001:10001","ExposedPorts":{"8080/tcp":{},"8081/tcp":{}},"Env":["PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","LANG=C.UTF-8","GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305","PYTHON_VERSION=3.12.14","PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a","PYTHONDONTWRITEBYTECODE=1","PYTHONUNBUFFERED=1"],"Entrypoint":["informed-decision-container"],"WorkingDir":"/app","Labels":{"org.opencontainers.image.base.digest":"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a","org.opencontainers.image.revision":"uncommitted-T05-local-preparation","social.coulomb.release.scope":"INFD-WP-0009-T05/zlib-85091-r1","social.coulomb.source.context.sha256":"c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d","social.coulomb.source.policy.sha256":"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"}},"Architecture":"amd64","Os":"linux","Size":31557919,"RootFS":{"Type":"layers","Layers":["sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c","sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd","sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366","sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe","sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1","sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c","sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59","sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02","sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3","sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007","sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e"]},"Metadata":{"LastTagTime":"2026-10-11T07:29:32.766526483Z"},"Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","size":2752}}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"files": {
|
||||
".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a",
|
||||
"Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15",
|
||||
"zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
|
||||
"APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"zlib-1.3.2-r1.apk": {
|
||||
"url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk",
|
||||
"sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
|
||||
"bytes": 56210
|
||||
},
|
||||
"APKINDEX.tar.gz": {
|
||||
"url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz",
|
||||
"sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5",
|
||||
"bytes": 528370
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
{
|
||||
"original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"files": [
|
||||
{
|
||||
"original_path": ".forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/zlib-overlay/.dockerignore",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/zlib-overlay/Containerfile",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/zlib-overlay/pins.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
|
||||
},
|
||||
{
|
||||
"original_path": "tools/zlib_overlay/check_build_inputs.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"original_path": "tools/zlib_overlay/check_runtime.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"original_path": "tools/zlib_overlay/compare_runtime.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"original_path": "tools/zlib_overlay/test_candidate.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"original_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,191 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
name: Publish exact zlib-only remediation candidate
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- ".forgejo/workflows/zlib-overlay-image.yaml"
|
||||
- "deploy/zlib-overlay/**"
|
||||
- "tools/zlib_overlay/**"
|
||||
workflow_dispatch:
|
||||
concurrency:
|
||||
group: informed-decision-zlib-overlay
|
||||
cancel-in-progress: false
|
||||
permissions:
|
||||
contents: read
|
||||
env:
|
||||
REGISTRY: forgejo.coulomb.social
|
||||
IMAGE_NAME: coulomb/informed-decision
|
||||
DOCKER_HOST: tcp://127.0.0.1:2375
|
||||
jobs:
|
||||
publish-candidate:
|
||||
runs-on: container-build
|
||||
steps:
|
||||
- name: Verify and publish zlib-only candidate
|
||||
env:
|
||||
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
||||
run: |
|
||||
set -eu
|
||||
umask 077
|
||||
REF="${GITHUB_SHA:?exact source revision required}"
|
||||
echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
|
||||
test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
|
||||
if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
|
||||
echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2
|
||||
exit 2
|
||||
fi
|
||||
BUILD_ROOT="$(mktemp -d)"
|
||||
export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
|
||||
cleanup() { rm -rf "${BUILD_ROOT}"; }
|
||||
trap cleanup EXIT
|
||||
mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin"
|
||||
wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
|
||||
tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
|
||||
CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay"
|
||||
for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do
|
||||
cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}"
|
||||
chmod 0644 "${BUILD_ROOT}/context/${INPUT}"
|
||||
done
|
||||
echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c -
|
||||
echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c -
|
||||
echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c -
|
||||
echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15 ${BUILD_ROOT}/context/Containerfile" | sha256sum -c -
|
||||
wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
|
||||
export PATH="${HOME}/bin:${PATH}"
|
||||
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
||||
BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a"
|
||||
docker pull "${BASE}"
|
||||
IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}"
|
||||
docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context"
|
||||
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json"
|
||||
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json"
|
||||
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py"
|
||||
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
|
||||
OUTPUT="$(docker push "${IMAGE}")"
|
||||
printf '%s\n' "${OUTPUT}"
|
||||
DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
|
||||
printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
|
||||
echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
|
||||
echo "source_revision=${REF}"
|
||||
echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
|
||||
echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required"
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
*
|
||||
!.dockerignore
|
||||
!Containerfile
|
||||
!zlib-1.3.2-r1.apk
|
||||
!APKINDEX.tar.gz
|
||||
Binary file not shown.
|
|
@ -0,0 +1,17 @@
|
|||
FROM forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a
|
||||
ARG SOURCE_REVISION=uncommitted-T05-local-preparation
|
||||
ARG SOURCE_CONTEXT_SHA256
|
||||
USER 0:0
|
||||
COPY zlib-1.3.2-r1.apk APKINDEX.tar.gz /tmp/infd-zlib/x86_64/
|
||||
RUN echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \
|
||||
&& echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \
|
||||
&& apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \
|
||||
&& apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \
|
||||
&& apk info --exists 'zlib=1.3.2-r1' \
|
||||
&& rm -rf /tmp/infd-zlib
|
||||
USER 10001:10001
|
||||
LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \
|
||||
org.opencontainers.image.base.digest="sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" \
|
||||
social.coulomb.source.context.sha256="$SOURCE_CONTEXT_SHA256" \
|
||||
social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \
|
||||
social.coulomb.release.scope="INFD-WP-0009-T05/zlib-85091-r1"
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"files": {
|
||||
".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a",
|
||||
"Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15",
|
||||
"zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47",
|
||||
"APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"package_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk",
|
||||
"index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz",
|
||||
"package_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245",
|
||||
"package_signature": "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
|
||||
"status": "prepared-unpublished-unapproved"
|
||||
}
|
||||
Binary file not shown.
|
|
@ -0,0 +1,9 @@
|
|||
# Separate T05 zlib-only candidate — local verified, unpublished/unapproved
|
||||
|
||||
Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical.
|
||||
|
||||
Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed.
|
||||
|
||||
Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues.
|
||||
|
||||
T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits.
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false,
|
||||
"candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs."
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1 @@
|
|||
{"Id":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","RepoTags":["informed-decision:zlib-r1-local-20261011"],"RepoDigests":["informed-decision@sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31"],"Created":"2026-10-11T09:29:32.511197114+02:00","Config":{"User":"10001:10001","ExposedPorts":{"8080/tcp":{},"8081/tcp":{}},"Env":["PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","LANG=C.UTF-8","GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305","PYTHON_VERSION=3.12.14","PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a","PYTHONDONTWRITEBYTECODE=1","PYTHONUNBUFFERED=1"],"Entrypoint":["informed-decision-container"],"WorkingDir":"/app","Labels":{"org.opencontainers.image.base.digest":"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a","org.opencontainers.image.revision":"uncommitted-T05-local-preparation","social.coulomb.release.scope":"INFD-WP-0009-T05/zlib-85091-r1","social.coulomb.source.context.sha256":"c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d","social.coulomb.source.policy.sha256":"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"}},"Architecture":"amd64","Os":"linux","Size":31557919,"RootFS":{"Type":"layers","Layers":["sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c","sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd","sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366","sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe","sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1","sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c","sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59","sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02","sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3","sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007","sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e"]},"Metadata":{"LastTagTime":"2026-10-11T07:29:32.766526483Z"},"Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","size":2752}}
|
||||
File diff suppressed because one or more lines are too long
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue