mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
381ed2a91f
* feat: add Admiral Hardened Build channel and business assurance surfaces Introduce Studio Saelix entitlement-backed Hardened Build switching, a single-flight image operation coordinator, Recovery Vault naming, Admiral Account settings, and typed Fleet update failures while preserving Community custom-repo and targetless pull-current updates. * fix: harden image-op paths and clear CI CodeQL/pilot flake Validate operation IDs before filesystem use, use hostname checks in Fleet fetch mocks, sanitize registry probe logs, and swallow expected TCP teardown errors in the pilot reverse-route post-handshake test. * fix: sanitize image-op docker config write and probe logs Allowlist-copy registry host keys and base64 auth before writing the temp DOCKER_CONFIG, and log registry probe failures with a fixed message so CodeQL no longer flags network-to-file and log-injection mediums. * fix: address Admiral Hardened Build audit blockers Expose imageChannel so hardened Fleet peers still POST for typed rejection, claim community updates before 202, terminalize helper failures, gate Hardened on paid, and align support/docs/e2e wording. * fix: terminalize image ops on helper survival and aborted claims * fix: prevent recreating persist from overwriting helper-exit failure * test: assert helper-exit failure lands before recreating persist * fix: keep current pointer when acknowledging a stale image operation
29 lines
1.5 KiB
Markdown
29 lines
1.5 KiB
Markdown
# Hardened Build publish policy
|
|
|
|
> Do not create `Studio-Saelix/sencho-hardened` until explicit authorization is given.
|
|
|
|
## Publish prerequisites
|
|
|
|
1. Build from an approved immutable source revision.
|
|
2. Pin all base images by digest and retain the resolved lockfile.
|
|
3. Produce the required architecture images before creating the manifest.
|
|
4. Scan each architecture image and evaluate findings against the approved OpenVEX policy.
|
|
5. Block publication when a known critical or high finding is exploitable and lacks an approved remediation decision.
|
|
6. Generate and attach SBOM and provenance records.
|
|
7. Sign the immutable manifest digest with Cosign.
|
|
8. Publish the matching AGPLv3 corresponding source notice with the release metadata.
|
|
|
|
## Advisory and remediation
|
|
|
|
An advisory can be recommended, cautionary, blocked, or unavailable. A blocked advisory prevents a new published tag. A newly disclosed issue in an already published image is triaged, recorded in OpenVEX where appropriate, remediated in a new immutable build, and communicated through the advisory channel.
|
|
|
|
Rollback repoints the supported tag to a prior signed digest only after confirming that its advisory state is suitable for use. Rollback does not overwrite an existing immutable digest.
|
|
|
|
## Evidence retained per publication
|
|
|
|
- Source revision, dependency lockfile digest, and base-image digests
|
|
- Scanner reports and OpenVEX version
|
|
- SBOM and provenance attestations
|
|
- Cosign signature verification output
|
|
- Publication timestamp, manifest digest, and advisory decision
|