.github/workflows/build-image.yml

@@ -101,6 +101,14 @@ jobs:
       #
       # Asserted on BOTH architectures, because a package that resolves on amd64
       # and not on arm64 would otherwise reach half the nodes unnoticed.
+      #
+      # openssl and jq were added after this check already existed and still
+      # missed them: the release tag gate shells out to both to verify the
+      # Control Plane's signed quorum verdict, and their absence surfaced as
+      # "verdict not signed" / "signature FAILED verification" rather than as a
+      # missing tool, blocking v0.0.134 and v0.0.135. The list only covers what
+      # someone remembered to add, so add to it whenever a gate grows a new
+      # shell dependency.
       - name: Verify the image still contains the toolchain the gates need
         if: ${{ steps.meta.outputs.push == 'true' }}
         run: |
@@ -119,6 +127,8 @@ jobs:
               command -v make     >/dev/null && echo "make=ok"     || echo "make=MISSING"
               command -v curl     >/dev/null && echo "curl=ok"     || echo "curl=MISSING"
               command -v tar      >/dev/null && echo "tar=ok"      || echo "tar=MISSING"
+              command -v openssl  >/dev/null && echo "openssl=ok"  || echo "openssl=MISSING"
+              command -v jq       >/dev/null && echo "jq=ok"       || echo "jq=MISSING"
               [ -x "$(git --exec-path)/git-http-backend" ] \
                 && echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
             ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }

Dockerfile

@@ -38,6 +38,19 @@ USER root
 # curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
 # make     -> zegit Makefile targets
 # ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
+# openssl  -> the release tag gate verifies the Control Plane's SIGNED quorum
+#             verdict (Ed25519 DSSE) with `openssl pkeyutl -verify -rawin`.
+#             Absent, that command failed "command not found" and the gate's
+#             `|| { echo ...; exit 1; }` reported it as "Quorum verdict
+#             signature FAILED verification" -- a TOOLING gap narrated as a
+#             SECURITY verdict, pointing the investigation at a perfectly
+#             valid signed approval instead of at this image. It blocked
+#             v0.0.134 and v0.0.135 on 2026-08-31.
+# jq       -> the same story one step earlier: the gate parsed that envelope
+#             with `jq -e`, and a missing jq was reported as "not a signed
+#             DSSE envelope". jq is the reflex tool for JSON in shell steps,
+#             so its absence keeps resurfacing as a misleading failure in
+#             whichever step reaches for it next.
 # gcc,musl-dev -> C toolchain for cgo; `go test -race` (the Makefile test
 #             target) requires cgo, which needs a C compiler + libc headers
 #             (musl on Alpine)
@@ -60,7 +73,9 @@ RUN apk add --no-cache \
       gcc \
       musl-dev \
       python3 \
-      py3-yaml
+      py3-yaml \
+      openssl \
+      jq
 
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000