Harden the base image and add a gated weekly base refresh - #99

Merged

Pyronewbic merged 22 commits into

mainfrom

base/hardening-and-refresh

Jul 23, 2026

Commits on Jul 23, 2026

fix(base): vendor the Wolfi signing key, drop the TOFU fetch and duplicate curl
Pyronewbic
committed
feat(base): drop shadow from the base image after its build-time use
Pyronewbic
committed
test(structure): pin the PATH-append and /home/node symlink claims
Pyronewbic
committed
security(verify): fail closed on a failed base signature, announce a lost digest pin
Pyronewbic
committed
fix(verify): accept publish-base signatures from main as well as version tags
Pyronewbic
committed
feat(scripts): base-scan-gate compare script with a canned-fixture unit suite
Pyronewbic
committed
feat(ci): weekly gated refresh of the published base :latest
Pyronewbic
committed
chore(base): OCI source and revision labels on the base stage
Pyronewbic
committed
fix(ci): the refresh gate scans the images, not the sluice SBOM
Pyronewbic
committed
fix(scan-gate): count real findings, fold off-list severities, compare purl sets
Pyronewbic
committed
fix(ci): publish the evaluated digest, refuse a tag-ref dispatch
Pyronewbic
committed
fix(verify): surface cosign's failure reason, drop the bypass advice
Pyronewbic
committed
fix(base): re-strip setuid in the project stage so a re-added package can't smuggle it
Pyronewbic
committed
fix(verify): clean the context on a fatal digest resolve; harden + isolate the tests
Pyronewbic
committed
fix(egress): render byte totals with %.0f, not %d, so mawk can't truncate at 2^31
Pyronewbic
committed
fix(build): in pin mode, verify and build the SAME pinned digest
Pyronewbic
committed
fix(scan-gate): reject multi-document JSON inputs instead of smuggling them past the guards
Pyronewbic
committed
docs(threat-model): correct the setuid guarantee for shadow removal + project-stage sweep
Pyronewbic
committed
docs(readme): note the weekly :latest base refresh in the supply-chain summary
Pyronewbic
committed
style(dockerfile): condense comments to one line of intent, keep the security why
Pyronewbic
committed
test(ci): mark the public-key SHA256 pin gitleaks:allow (false positive)
Pyronewbic
committed
ci: allowlist the public-key checksum pin in .gitleaks.toml
Pyronewbic
committed