Repository navigation
Composer trust hook for cooperative CI builds (.github#237) - #943
Conversation
The production stage's Composer request can now be bound to the central verifier. When DW_CI_CA_SHA256 is set, the same RUN, after composer.json takes its final form, requires the dwf_composer_trust build context, the dwf_ci_ca secret and well-formed DW_SERVER_SOURCE_COMMIT and DW_SERVER_DOCKERFILE_SHA256, selects the authenticated bundle and an empty additional-root directory for PHP, Composer, curl and Git, runs verify.php, and only then runs the unchanged composer update. A missing input refuses before any request. The verifier, secret and root directory are mounts, so none reaches the image. Ordinary builds pass none of these and keep their behavior through an empty default dwf_composer_trust stage. The Composer sink inventory and the release-image order test move with the RUN's new shape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
General's review of #943: composer dump-autoload --optimize after COPY . . can run Composer scripts and plugins, and the first RUN's trust settings have expired by then. The second RUN now restores the final composer.json and lock, applies the same mounts and required-mode checks, runs the verifier, and only then dumps the autoloader. Its behavior is otherwise unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Bounded Security source review is clear at exact head
This is source clearance, not combined-boundary or merge clearance. The commit and Dockerfile arguments are recorded/syntax-checked here; their authenticity and the nonempty required-mode switch depend on the accepted central caller. Keep the catalog empty until the exact #943 Dockerfile plus SDK-PHP caller prove: clean exact checkout/recipe binding, approved bootstrap outputs, the registered build invocation, enabled success, fail-closed negatives reaching both Composer-capable layers, and absence of CA/verifier material in the final image. The current required Sonar failure also remains an ordinary merge prerequisite for General's specific correction or false-positive disposition; this review does not waive it. |
Sonar flagged docker:S8546 on the composer update line, a pre-existing and intentional single-package update, because #943's restructuring touched it. The hook's contract is to run the verifier immediately before the unchanged Composer command, so the command and its following lines now keep main's exact text, chained after the hook's if-block. Sonar attributes them to their original commit again, and the sink inventory entry returns to its original line. Behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Security source clearance carries from The bounded delta only changes the first hook's post- Fresh Sonar/CI remains the ordinary prerequisite. The combined caller/catalog/final-image conditions in the preceding Security review are unchanged. |
|
|
Ready for its normal source merge. The combined proof was accepted (SDK-PHP #229, Security receipts 6586748875 / 6587427271), and General confirmed no combined, source or adoption hold remains.
This merge publishes no PHP Server image. Cooperative dispatch, the mandatory flag and the audit stay held centrally (.github#237). |
|
Merge-queue attempt failed in PHPUnit Feature (run 41522678113): 1 of 3558 tests, |
Review tier A: CI trust and image build inputs (Composer trust hook in the production Dockerfile). Security source-clear at 5c31a5b, carried to c4fc6c1 (6583020901).
Server's part of central .github#237, for SDK-PHP #223's exact-source cooperative build. Design agreed with General on #325 chat; input names proposed to sdk-php-swarm.
Change (Dockerfile, production stage)
FROM scratch AS dwf_composer_truststage. Ordinary builds pass nothing and are unchanged;--build-context dwf_composer_trust=…overrides it.RUNgains three transient mounts: the verifier context (read-only bind), secretdwf_ci_ca(required=false), and a tmpfs empty additional-root directory. It runs underset -eu:prepare-release-workflow-composer-metadata.phpruns first, so the verifier sees the finalcomposer.json.DW_CI_CA_SHA256is non-empty: it requires the secret,verify.php, a 40-hexDW_SERVER_SOURCE_COMMIT, a 64-hexDW_SERVER_DOCKERFILE_SHA256and an empty root directory, or refuses before any request. It then pointsSSL_CERT_FILE,CURL_CA_BUNDLE,GIT_SSL_CAINFOandCOMPOSER_CAFILEat the secret, pointsSSL_CERT_DIR,GIT_SSL_CAPATHandCOMPOSER_CAPATHat the empty directory, prints the source bindings, and runsphp /dwf-composer-trust/verify.php /usr/bin/composer "$PWD".composer update durable-workflow/workflow …runs, in the sameRUNwith no trust change in between.The build can't prove its own Dockerfile bytes. Checking
DW_SERVER_SOURCE_COMMITandDW_SERVER_DOCKERFILE_SHA256against the actual checkout stays with the caller (SDK-PHP), as General noted.Contracts moved
tests/Unit/Support/composer-sinks.json: the sink line text and the exactserver-verifyguard distance (77).ReleaseImagePublishWorkflowContractTest: the metadata-step anchor. The order (metadata, thencomposer update, thenCOPY . .) is unchanged.Checked here
composer_trust_test.pyinventory: 7/7 pass.Not done here
General's actual-container negative controls (withdrawn-root baseline, wrong bundle or hash, extra roots, missing hook, final-image leakage) and the SDK-PHP caller wiring qualify the combined boundary. Security reviews that boundary. This stays draft until then.
🤖 Generated with Claude Code