coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep overlay module readable by the inherited service user
Some checks failed
Publish exact advisory-purpose overlay candidate / publish-candidate (push) Failing after 5s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 03:17:58 +02:00
parent f66de505b3
commit acecad8873
2 changed files with 39 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
deploy/purpose-overlay/Containerfile
View file

@ -4,4 +4,4 @@ LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \
org.opencontainers.image.base.digest="sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" \
social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \
social.coulomb.release.scope="INFD-WP-0009-T04/purpose-overlay-v1"
COPY policy.py /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py
COPY --chmod=0644 policy.py /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py

38
docs/evidence/2026-10-11-purpose-publication-preparation/publication-run-1-failure-and-mode-refinement.json Normal file
View file

@ -0,0 +1,38 @@
{
"observed_at": "2026-10-11T01:17:34.808990+00:00",
"proposal": "INFD-WP-0009-T04/purpose-overlay-v1",
"failed_source_revision": "f66de505b301c03d2fddfa90fd18a53347c62858",
"native_job": {
"task": 11482,
"run": 1,
"status": "failure",
"url": "https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/1"
},
"log_sha256": "ffc84bedba4dfc4df64a77cb6d52403ad54258bcd53267fd24cfc35f343e2519",
"safe_error_excerpt": [
"2026-10-11T01:15:12.9474490Z PermissionError: [Errno 13] Permission denied: '/opt/venv/lib/python3.12/site-packages/informed_decision/policy.py'",
"2026-10-11T01:15:13.1707722Z \ud83c\udfc1 Job failed",
"2026-10-11T01:15:13.1708584Z Job 'publish-candidate' failed"
],
"failure": "CI umask077 creates root-owned mode0600 copied policy module; inherited runtime UID10001 cannot read it",
"publication_succeeded": false,
"refinement": "COPY --chmod=0644 explicitly sets non-secret source-module readability; no user/config/source-content/dependency/base changes",
"local_regression": {
"context_policy_mode": "0600",
"installed_policy_mode": "0644",
"runtime_uid": 10001,
"runtime_gid": 10001,
"installed_policy_uid": 0,
"installed_policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
"installed_image_purpose_variants": 10,
"binding_forms_allowed": 2,
"advisory_or_malformed_refused": 8,
"synthetic_only": true,
"native_provider": false,
"image_index": "sha256:f3d8e478c4e25b0c24a7df1b598a1e415946445d6940600b062b9804b85abf8d",
"local_only": true,
"published": false
},
"native_workload_changed": false,
"native_backup_restore_executed": false
}