fix(release): renew image advisories for v0.25.0 - #813
Merged
Conversation
The application layer DiffID moves with every build and a baseline binds its exposure assertions to exact layer IDs, so the first candidate of a release always trips them. Candidate run 32574081507 stopped on that, as v0.22, v0.23, and v0.24 each did before it. Rebind the four baselines to the official v0.25.0 candidate images built from 130136a, and move the live pins in the checker test to match. Security review notes (release provenance): - Evidence is regenerated from the exact candidate images in their private packages, with the scanner versions the candidate workflow pins: syft v1.45.1, grype v0.114.0, crane v0.21.2. No digest is carried over from a different candidate and none is hand-invented. - The 21 pinned base layers are unchanged on all four images and remain the exact ordered prefix of the candidates' rootfs.diff_ids, so only the application layer moved. runtime.image still resolves to the same pinned distroless base. - runtime.config is byte-equal to each candidate's OCI process contract: user, entrypoint, command, working_dir, environment, healthcheck, args_escaped, exposed_ports, and stop_signal all match. Image labels are the three OCI identity labels plus the fixed uid/gid pair. - Every asserted file digest was taken from Syft and confirmed against the exported rootfs. The four base libraries are byte-identical to what was already recorded; only /usr/local/bin/<service> moved. - The four accepted risks were re-verified against these binaries, not carried forward. CVE-2026-5450: Discovery imports no scanf entry point; Evidence, Mint, and Relay reach sscanf at exactly two call sites whose recovered format strings are %lu and %lx, with no allocating conversion and no unresolved site. CVE-2026-5928: no wide-character input symbol is imported. CVE-2026-5435: only __res_init is imported, none of the deprecated resolver-printing helpers. CVE-2026-14456: no OpenSSL library is linked or named for dynamic loading; TLS is rustls over aws-lc-rs. This is a rebind of an unchanged judgement, not a new acceptance. - check-advisory-baselines.py now reports invalid=0 for all four services against the regenerated evidence, and the focused test suite passes. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b68c0356d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The application layer DiffID moves with every build, and an advisory baseline
binds its exposure assertions to exact layer IDs. The first candidate of every
release therefore trips them. Candidate run
32574081507for v0.25.0 stopped at"Verify and scan exact candidate images" with:
This is the routine per-release renewal, not a regression. Precedent: v0.22
(
d9a278a55), v0.23 (730cc8417), v0.24 (56caa3c5d).What moved
Rebinds the four baselines to the official v0.25.0 candidate images built from
130136a2b20ad10d359849ac111316a2fb1cb39e, and moves the live pins inrelease/scripts/test_check_advisory_baselines.pyto match./usr/local/bin/<svc>sha256:8901d3f3c52a1781…9c34752fe979…→7ae58ef941e4…beb9eb94306e…→89381bc650f6…sha256:607e0797fec9273d…07112d7cf975…→e2e804985721…11089b72a1b6…→0fa7d38cc671…sha256:01e025a12f410fb9…87f6c179626b…→a788f7502c8e…628e429a1ada…→d598a23ca43b…sha256:e36610df8906a7ba…c36dc82eab12…→7c3e77123161…2a8f45dc3c70…→34cf762f9b36…Nothing else in these files changes: the diff is confined to
application_layer_ids,definition_digest,runtime_definition_digest,reference_image_digest,reference_source_revision, the one moved filedigest per assertion, and the release number named in each rationale.
Security review notes (release provenance)
Evidence regenerated from the exact candidate images in their private
packages, with the scanner versions
.github/workflows/release-candidate.ymlpins: syft v1.45.1, grype v0.114.0, crane v0.21.2. Pulled through the daemon,
which is what makes the scan admissible. No digest is carried over from a
different candidate and none is hand-invented.
Base unchanged. The 21 pinned base layers are identical on all four
images and remain the exact ordered prefix of the candidates'
rootfs.diff_ids, so only the application layer moved.runtime.imagestillresolves to the same pinned distroless base.
Process contract unchanged.
runtime.configis equal to each candidate'sOCI process configuration across
user,entrypoint,command,working_dir,environment,healthcheck,args_escaped,exposed_ports,and
stop_signal. Labels are the three OCI identity labels plus the fixeduid=65532/gid=65532pair.File digests double-sourced. Every asserted digest was taken from Syft and
confirmed against the exported rootfs; zero disagreements. The four base
libraries are byte-identical to what was already recorded. Only
/usr/local/bin/<service>moved.Rationales re-verified against these binaries, not carried forward.
CVE-2026-5450(allocating scanf conversions): Discovery imports noscanf-family entry point at all. Evidence, Mint, and Relay reach
__isoc23_sscanfat exactly two call sites each; the format string at eachsite was recovered by disassembly and is
%luor%lx. Zero allocatingconversions, zero unresolved sites.
CVE-2026-5928(wide-character input): noungetwc,getwc,fgetws,wscanf,mbrtowc, orfwideimport on any of the four.CVE-2026-5435(deprecated resolver printing): Discovery imports no glibcresolver symbol; the other three import only
__res_init.CVE-2026-14456(OpenSSL QUIC server queue):NEEDEDis onlylibgcc_s.so.1,libm.so.6,libc.so.6, and the interpreter. Nolibssl.so/libcrypto.soname to load dynamically. TheOPENSSL_*stringspresent are AWS-LC statics (
aws_lc_0_44_0_OPENSSL_*) besideaws-lc-rsand
rustls.This is a rebind of an unchanged judgement, not a new acceptance.
Verification
The single skip is
test_real_glibc_definition_passes_but_importing_dependency_fails,skipped locally as "requires a Linux glibc toolchain"; it runs in CI.
After merge
Re-request the v0.25.0 candidate against the new
main, then tag and publish.