Repository navigation
Integrate Ubuntu backports and BuildKit packaging for v0.13.34 - #19
Merged
Merged
Conversation
Integrate only existing runtime packages and preserve raw scans, native OpenVEX, producer checksum verification and strict vulnerability policy. Shared OCI producer: 59f4ec1f31e510361c4635023c08fcf2a2b2133c. OCI completion and final-image gates remain pending; this source commit does not publish a release.
README only. Preserve runtime and verification source exactly from 9231f1b. Describe the release version without obsolete candidate or previous-release notes.
Builder only: official v0.38.1 source with x/net v0.60.0 and go-archive v0.3.0, using the reviewed shared Go 1.27.3 recipe. Bind the actual binary, packages/files, four canonical inputs and native package check before exact two-daemon native VEX. Preserve original complete raw reports and every unrelated finding. Runtime/provider/app/ledger policies remain unchanged.
chen21019
changed the title
chen21019
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v0.13.34 Linux runtime installs the qualified Ubuntu 26.04 backports only for packages already present, preserving its coreutils provider and package set. It retains producer-bound manifests and installation receipts, preserves the original raw Trivy report, and applies the bundle’s exact-version OpenVEX through native Trivy before the existing runtime policy.
Dapper packaging now builds Buildx v0.38.1-pasturestack.1 from the pinned official v0.38.1 source with only the official x/net v0.60.0 and go-archive v0.3.0 security updates. Actual compiled source inventories and native package-mode govulncheck bind its two daemon-code-absence statements to this single ELF. A native VEX scan of that same ELF is strictly verified and joined back to the complete original records; other targets, UIDs, severities, and unknown findings remain unchanged. Existing Python, header, builder, and runtime gates remain enforced.
The shared OCI is pinned to sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a (original producer 59f4ec1f31e510361c4635023c08fcf2a2b2133c; signed completion run 40140357669 succeeded).
Full setuptools in the builder and test dependency pins uses the official 84.1.0 fix. The pip-vendored 70.3.0 metadata receives a separate module-absence determination only after exact live/wheel file inventory and native SBOM validation. Three additional Buildx findings are handled as per-ID compiled-source code-absence qualifications bound to the original binary and whole finding records; these do not expand the original four-ID native govulncheck claim or report the legacy modules as fixed.
Validation: all three required CodeQL checks passed at bc895e9. The sole exact-head owning run https://github.com/PastureStack/node-agent/actions/runs/40148577856 passed complete CI, packaging, reproducibility, source/product/runtime/builder scans, native isolated-ELF VEX, producer-bound runtime metadata, and the existing full vulnerability policies. Focused join, additional Go scope, pip-slice and builder policy controls passed. Prior failed runs and original reports remain preserved. No deployment.