fix(release): renew image advisories for v0.24.0 - #805
Merged
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b9d84f373
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Bind Discovery, Evidence, Mint, and Relay to the official v0.24.0 Linux AMD64 candidates built from d1a6c7b, and add the Discovery baseline the candidate workflow has expected since Discovery joined RELEASE_IMAGE_NAMES. Evidence regenerated from the private candidate packages with the scanner versions the candidate workflow pins (syft 1.45.1, grype 0.114.0, crane 0.21.2) and a daemon-backed pull, per release/OPERATIONS.md. The pinned distroless base is still the exact DiffID prefix of every candidate and the four reviewed base libraries are byte-identical to the v0.23.0 review, so only /usr/local/bin/<service> and the application layer moved. Each rationale was re-verified against the v0.24.0 binaries rather than carried forward, and two are now more precise: - CVE-2026-5450 states the sscanf call sites it relies on. Evidence, Mint, and Relay reach __isoc23_sscanf at exactly two fixed-format call sites, %lu and %lx. Discovery imports no scanf entry point at all. - CVE-2026-5435 names the resolver symbol actually imported, __res_init, instead of describing the path only by absence. CVE-2026-14456 holds for the same reason as before for Evidence, Mint, and Relay: no OpenSSL library is linked or named, and TLS terminates with rustls and aws-lc-rs. Discovery links no TLS stack at all, so its rationale says that instead of claiming a rustls terminator it does not have. expires_at stays 2026-09-03 so renewal does not silently extend the risk-acceptance window. Security-sensitive: these baselines are the release provenance gate that decides whether a candidate may publish with known unfixed advisories. Every exception is accepted_risk over a Debian no-DSA or postponed issue with no fixed Trixie version, and every assertion is re-pinned to the reviewed candidate digest, so a rebuilt or altered image fails closed. release/OPERATIONS.md gains the step this renewal needed and the procedure omitted: the live pins in test_check_advisory_baselines.py restate the reviewed evidence and must be moved forward by hand. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
The discovery-candidate package now exists, so it joins the exact cleanup allowlist and its pinned copy in the gate inventory. Listing an absent package fails closed, which is why it waited for the release that first published it. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
jeremi
force-pushed
the
release/renew-advisories-v0.24.0
branch
from
August 22, 2026 08:28
4b9d84f to
a5e339b
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5e339b95e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renews the image advisory fingerprints for the v0.24.0 release and adds the
Discovery baseline the candidate workflow has expected since Discovery joined
RELEASE_IMAGE_NAMES. Without this, candidate run #3 stops at the advisoryscan for all four images.
Evidence
Regenerated from the private candidate packages produced by candidate run
32558441544attempt 1, at sourced1a6c7b925faf35dbc5a9f3269991f0d5e722f92,following
release/OPERATIONS.mdwith the scanner versions the candidateworkflow pins: syft 1.45.1, grype 0.114.0, crane 0.21.2, plus the
daemon-backed
docker pull --platform linux/amd64that makes the scanadmissible. The grype DB was refreshed and Discovery re-scanned afterwards to
rule out a stale-DB confound; the match IDs were identical.
sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9beThe pinned distroless base is still the exact ordered DiffID prefix of every
candidate, and the four reviewed base libraries are byte-identical to the
v0.23.0 review. Only
/usr/local/bin/<service>and the application layermoved, so the v0.23.0 review of those library bytes carries over and is
re-pinned by digest.
Review surface
Each rationale was re-verified against the v0.24.0 binaries rather than
carried forward.
%lu,%lx__res_initonly%lu,%lx__res_initonly%lu,%lx__res_initonlyAll four declare exactly
libgcc_s.so.1,libm.so.6,libc.so.6, and theprogram interpreter as
DT_NEEDED.Two rationales are now more precise than the text they replace:
asserting absence. Note glibc 2.38+ routes C23 scanf semantics through
__isoc23_*aliases; a symbol scan that only looks for__isoc99_*reportsa false "no scanf imports".
__res_init,which is resolver initialisation rather than resolver printing, so the claim
holds and is now stated positively.
CVE-2026-14456 holds unchanged for Evidence, Mint, and Relay. Discovery
links no TLS stack at all, so its rationale says that rather than reusing the
rustls clause, which would have been false for it.
expires_atstays2026-09-03, so renewing does not silently extend therisk-acceptance window.
ownerstays@jeremi.Security-sensitive change
These baselines are the release provenance gate deciding whether a candidate
may publish with known unfixed advisories. Every exception is
accepted_riskover a Debian no-DSA or postponed issue with no fixed Trixie version, and none
is fixable; the generator refuses to write an exception whose finding has
become fixable. Every assertion is re-pinned to the reviewed candidate digest
and runtime definition digest, so a rebuilt or altered image fails closed.
Second commit:
discovery-candidatecleanupdiscovery-candidatejoins the exact cleanup allowlist incleanup-release-candidates.pyand its pinned copy in the gate inventory. Itwas deliberately withheld until the package existed, because listing an absent
package fails closed. The all-candidates cleanup test grows a matching fixture.
release/OPERATIONS.mdThe renewal procedure was missing a step this renewal needed: the live pins in
test_check_advisory_baselines.py(LIVE_REFERENCE_IMAGE_DIGESTS,LIVE_REFERENCE_SOURCE_REVISION,LIVE_REVIEW_EVALUATION_DATE, and for afirst-time service
LIVE_BASELINES,LIVE_REFERENCE_PROVENANCE,LIVE_EXECUTABLES) restate the reviewed evidence instead of reading it backout of the baselines, so a renewal that skips them fails that test. The stale
"Evidence and Mint" comment now names Discovery too.
Verification
release-candidate.ymlinvokes it, on allfour images against the regenerated evidence:
invalid=0, exit 0.python3 -m unittest release/scripts/test_check_advisory_baselines.py(46)python3 -m unittest release/scripts/test_cleanup_release_candidates.py(13)python3 -m unittest release/scripts/test_registry_release.pypython3 -m unittest release/scripts/test_release_workflow_structure.py(39)python3 -m unittest release/scripts/test_check_release_source_model.py(12)python3 release/scripts/check-gates-inventory.py(151 gates)release/scripts/registry-release validate release/manifests/registry-stack-beta-35.yamlThe JSON layout is preserved rather than reformatted: the baselines carry no
formatter config, and the serializer used here reproduces all three committed
files byte-for-byte from their own content before writing. The diff is 34
changed lines per renewed file, with no reordering.