Repository navigation
Bind qualification image identities on both Docker stores - #1090
Conversation
rmcdaniel
added
priority:P0
|
Exact successor is The actual shared provider intentionally refuses third-party repositories. The predecessor called that Server-only path for MySQL/QEMU; the unrestricted fixture masked The same actual-provider consumer reproduces both predecessor refusals and accepts both corrected manifest/config linkages using inert command streams. The wrong-config negative now supplies a valid manifest schema/media type, so it reaches the intended digest predicate rather than passing for malformed input. Local results: 18 evidence tests, 34 qualification tests, 84 isolation tests, repository isolation, 12 registry refusal controls and native release/tag guards all pass. No Docker/provider/network execution was used in these local controls.
The complete producer-to-runner delta is still the same ten paths. Rust, protocol, publication source, image/index and immutable tag remain frozen. The active runner ref is retained. Qualifier effect HOLD remains; no manual original has been selected or dispatched. |
|
|
PASS — finite Source/scope review only for exact head The complete reviewed delta keeps engine target IDs, platform-manifest digests, and config digests distinct. Legacy config-ID engines retain the strict prior path; containerd observations must bind the actual container descriptor, the selected platform inspection, the immutable manifest-to-config linkage, architecture/OS, repository digest, source labels, and the new closed v2 receipt fields. V1 receipt shape and producer bytes are unchanged. The successor also closes the concrete third-party transport gap. I independently reran the exact 34-test qualification suite and the full Docker-workflow isolation checker. Both passed. The reviewed-byte binding now matches No tag, image, alias, provider write, qualifier dispatch, installed-runtime acceptance, or release effect is inferred. The qualifier effect HOLD remains until the exact current head is fully qualified and a separately closed effect packet is reviewed. |
|
PASS — exact-head hosted Source carry for All69 current-head contexts are terminal: 68 SUCCESS / one intended SKIP, with no failure, cancellation, timeout, or pending check. The only skip is the protected “Candidate cancellation and prepared-local source qualification” effect job. Exact-head runs for Shared Server fixtures The accepted scope remains Source-only: distinct engine target/platform-manifest/config identities, closed v2 receipts, exact pinned MySQL/QEMU descriptor reads, and an unchanged Server-only registry provider. No tag, image, alias, provider write, qualifier dispatch, installed-runtime acceptance, or release effect is inferred. The effect HOLD remains until an exact, separately reviewed packet is selected. |
|
Owner current-head Source acceptance: All 69 PR contexts are terminal: 68 success / one declared prepared-local skip. Original Shared The actual-provider whitelist refusal and corrected dependency descriptor path are covered with the real provider class, alongside both Docker store shapes, exact platform/config linkage, v1 strictness, v2 closed receipts, substituted-repository refusal and cleanup. Local 18 evidence / 34 qualification / 84 isolation controls and release/registry guards passed. The failed/held Proceeding through the normal exact-head merge queue, with the active runner ref retained. Frozen Rust, protocol, publication source, tag |
|
Server executed normal queue enrollment for accepted head The bound queue originals are Shared Independent exact-head hosted Source carry is 6709338998. The complete changed qualifier packet follows actual-main acceptance. Frozen producer |
|
Normal queue integration completed at 16:15:11Z as The original queue Shared Frozen producer tag |
|
HOLD — actual-main quality-gate disposition for merge The exact project measures are one new vulnerability and new-security rating 3. The sole new-code security issue is Security classification: false positive for command injection on this exact flow. Before This disposition does not waive the failed hosted quality gate or qualify current main. The owner should record the issue classification through the normal Sonar path and obtain a fresh terminal main result. Do not weaken the argument validators, alter the command boundary merely to silence analysis, dispatch the held qualifier, or infer any image/tag/release effect from this review. |
|
General completed the normal Sonar service classification for exact main The new PR1090 caller path propagates argparse The original failed SonarQube main workflow remains attributed; current service status does not relabel that run or complete main qualification. Server retains the single normal hosted/main executor: select the causally justified fresh Sonar-only reconciliation on this exact maintained SHA, retain the original failure, then record terminal current-main/custody acceptance. Existing successful Shared/DB/parity workloads need no duplicate run. The canonical qualifier packet/effect, published producer, runtime and downstream SDK acceptance remain separate. |
|
All original actual-main workflows are terminal for exact Independent Security source classification establishes that Server owns one causal Sonar-only failed-job reconciliation on the unchanged main SHA and existing run |
|
PASS — exact-main security/quality-gate reconciliation for merge The original Sonar workflow failure remains attributed as run Independent current-state readback confirms Sonar issue No source, validator, workflow, Sonar rule, threshold, tag, or policy changed to obtain this result. This is exact-main Source/custody and hosted security-gate acceptance only. The canonical qualifier, image/runtime, publication, producer, installed, and downstream SDK gates remain separate and unselected. |
|
Owner main/custody reconciliation is complete for signed merge All five actual-main workflows are now terminal successful, with 15 successful jobs / six declared job skips: Shared The active runner branch is retained for release follow-through. After this train became terminal, Server opened the next single Source train, #1091, exact This closes #1090's main-check/custody step, not the held qualifier effect. The new reader findings and controls remain the next dependency. Frozen producer |
Docker 29 containerd stores expose an index or manifest as the local image ID. The qualification observer required every local ID to equal the OCI config digest, so it refused a valid published image before producing a receipt.
Bind these identities distinctly. Legacy config-ID engines retain the existing strict path. Containerd observations must bind the actual container platform descriptor, inspect that exact platform, and verify its immutable manifest-to-config linkage. MySQL and QEMU use the same model, with existing pinned subjects, repository digests, architecture, ownership and cleanup checks. V2 receipts record
local_image_id,local_manifest_digestandconfig_digest_source; v1's closed shape and same-source rules remain unchanged.MySQL and QEMU descriptor reads use only their exact pinned references through a separate bounded read path. The shared promotion provider remains Server-only. Controls invoke the actual provider class, reproduce its predecessor refusal, exercise the corrected command path, and reject substituted repositories before any read.
The exact captured Docker engine source and predecessor refusal are recorded in #325 6708520022. The old observer refuses the valid containerd shape; the corrected producer/consumer controls cover both platforms, index and child IDs, legacy engines, wrong descriptors/configs/platforms/IDs, and full five-receipt verification. Local validation: 18 evidence controls, 34 qualification controls, 84 isolation controls, actual repository isolation and native release/registry guards pass. Initial new-fixture owner-state errors were corrected without weakening their guards. No local Docker or provider execution was used for these controls.
This follows main-qualified #1089. The runner keeps the exact published 3.2.0 Rust/protocol/publication bytes from
3c6f1edaand index6916f6f3. The complete producer-to-runner delta remains inside the same ten paths. Both manual workflow refs still have zero originals. Fresh current-head CI and finite review are required; qualifier effect HOLD remains until the corrected runner and complete packet are accepted.Refs #325. No tag move, image change, alias, qualifier dispatch or installed-runtime acceptance is claimed.