The toolchain check's own comment said the quiet part: "the list only covers what someone remembered to add." So the list was derived instead of remembered — every command invoked from a run: block across zegit's Gitea-executed workflows and composite actions was extracted and checked against this image.
Audit result: no missing apk package. Everything resolves to one of three sources — baked in here, provided by busybox/coreutils, or downloaded per-run and immediately version-checked (go via setup-go, buildctl, flux, cosign, syft, goreleaser). The download path needs nothing from this image beyond curl and tar, both already asserted.
What it did find: the busybox/coreutils layer was entirely unasserted. Dropping coreutils from the apk line would pass this check while base64, mktemp, seq and sort silently vanished — and on this repo's own history, their absence would be narrated as whatever the gate reaching for them happened to be doing. That is how openssl became "signature FAILED verification" and jq became "not a signed DSSE envelope".
Behaviour change: ten busybox/coreutils tools added to the per-architecture assertion. No Dockerfile change; no new package.
Risk: none to the image. Worst case is a false failure if a tool is genuinely unavailable on one architecture, which is the check working.
Verification: executed, not read. The inner script was extracted and run against a PATH with base64 deliberately absent — it printed base64=MISSING and the outer grep -q MISSING failed the build. Against a full PATH it reports zero MISSING.
Rollback: revert; the assertion returns to its previous list.
Assumptions & Decisions
Asserted rather than pinned. The alternative was apk add busybox-extras or explicit per-tool packages; coreutils is already installed and these are cheap to check, so the assertion is the smaller change.
Left the "add to it whenever a gate grows a new shell dependency" instruction in place. Deriving the list at build time would mean this repo reading zegit's workflows, which couples two repos to save one grep; the audit is recorded in the comment with its date instead so the next reader knows when it was last true.
The toolchain check's own comment said the quiet part: *"the list only covers what someone remembered to add."* So the list was **derived** instead of remembered — every command invoked from a `run:` block across zegit's Gitea-executed workflows and composite actions was extracted and checked against this image.
**Audit result: no missing apk package.** Everything resolves to one of three sources — baked in here, provided by busybox/coreutils, or downloaded per-run and immediately version-checked (`go` via setup-go, `buildctl`, `flux`, `cosign`, `syft`, `goreleaser`). The download path needs nothing from this image beyond `curl` and `tar`, both already asserted.
**What it did find:** the busybox/coreutils layer was entirely unasserted. Dropping `coreutils` from the apk line would pass this check while `base64`, `mktemp`, `seq` and `sort` silently vanished — and on this repo's own history, their absence would be narrated as whatever the gate reaching for them happened to be doing. That is how `openssl` became "signature FAILED verification" and `jq` became "not a signed DSSE envelope".
**Behaviour change:** ten busybox/coreutils tools added to the per-architecture assertion. No Dockerfile change; no new package.
**Risk:** none to the image. Worst case is a false failure if a tool is genuinely unavailable on one architecture, which is the check working.
**Verification:** executed, not read. The inner script was extracted and run against a PATH with `base64` deliberately absent — it printed `base64=MISSING` and the outer `grep -q MISSING` failed the build. Against a full PATH it reports zero MISSING.
**Rollback:** revert; the assertion returns to its previous list.
## Assumptions & Decisions
- Asserted rather than pinned. The alternative was `apk add busybox-extras` or explicit per-tool packages; `coreutils` is already installed and these are cheap to check, so the assertion is the smaller change.
- Left the "add to it whenever a gate grows a new shell dependency" instruction in place. Deriving the list at build time would mean this repo reading zegit's workflows, which couples two repos to save one grep; the audit is recorded in the comment with its date instead so the next reader knows when it was last true.
Agent-Session: c49e7dd9-2fb0-4501-8f80-264f8ef3a9b7
The toolchain check's own comment said the quiet part: "the list only covers what
someone remembered to add". So the list was derived instead of remembered — every
command invoked from a `run:` block across zegit's Gitea-executed workflows and
composite actions was extracted and checked against this image.
Result: no missing apk package. Everything resolves to one of three sources —
baked in here, provided by busybox/coreutils, or downloaded per-run and
immediately version-checked (go via setup-go, buildctl, flux, cosign, syft,
goreleaser). The download path needs nothing from this image beyond curl and tar,
both already asserted.
What the audit did find is that the busybox/coreutils layer was entirely
unasserted. Dropping `coreutils` from the apk line would pass this check while
base64, mktemp, seq and sort silently vanished — and on this repo's own history,
their absence would be narrated as whatever the gate reaching for them happened
to be doing, not as a missing tool. That is how openssl became "signature FAILED
verification" and jq became "not a signed DSSE envelope".
Verified by executing the assertion, not by reading it: extracted the inner
script and ran it against a PATH with base64 deliberately absent. It printed
base64=MISSING and the outer `grep -q MISSING` failed the build. Against a full
PATH it reports zero MISSING.
agent
marked the pull request as ready for review 2026-08-31 18:55:39 +00:00
markus
merged commit ad19f03297 into master2026-08-31 19:00:57 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The toolchain check's own comment said the quiet part: "the list only covers what someone remembered to add." So the list was derived instead of remembered — every command invoked from a
run:block across zegit's Gitea-executed workflows and composite actions was extracted and checked against this image.Audit result: no missing apk package. Everything resolves to one of three sources — baked in here, provided by busybox/coreutils, or downloaded per-run and immediately version-checked (
govia setup-go,buildctl,flux,cosign,syft,goreleaser). The download path needs nothing from this image beyondcurlandtar, both already asserted.What it did find: the busybox/coreutils layer was entirely unasserted. Dropping
coreutilsfrom the apk line would pass this check whilebase64,mktemp,seqandsortsilently vanished — and on this repo's own history, their absence would be narrated as whatever the gate reaching for them happened to be doing. That is howopensslbecame "signature FAILED verification" andjqbecame "not a signed DSSE envelope".Behaviour change: ten busybox/coreutils tools added to the per-architecture assertion. No Dockerfile change; no new package.
Risk: none to the image. Worst case is a false failure if a tool is genuinely unavailable on one architecture, which is the check working.
Verification: executed, not read. The inner script was extracted and run against a PATH with
base64deliberately absent — it printedbase64=MISSINGand the outergrep -q MISSINGfailed the build. Against a full PATH it reports zero MISSING.Rollback: revert; the assertion returns to its previous list.
Assumptions & Decisions
apk add busybox-extrasor explicit per-tool packages;coreutilsis already installed and these are cheap to check, so the assertion is the smaller change.Agent-Session: c49e7dd9-2fb0-4501-8f80-264f8ef3a9b7