From 47d5342dc4e9b7aaf39a721e483db94933480ff8 Mon Sep 17 00:00:00 2001 From: agent Date: Mon, 31 Aug 2026 20:53:32 +0200 Subject: [PATCH] chore(ci): assert the busybox/coreutils layer, and record the derived audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The toolchain check's own comment said the quiet part: "the list only covers what someone remembered to add". So the list was derived instead of remembered — every command invoked from a `run:` block across zegit's Gitea-executed workflows and composite actions was extracted and checked against this image. Result: no missing apk package. Everything resolves to one of three sources — baked in here, provided by busybox/coreutils, or downloaded per-run and immediately version-checked (go via setup-go, buildctl, flux, cosign, syft, goreleaser). The download path needs nothing from this image beyond curl and tar, both already asserted. What the audit did find is that the busybox/coreutils layer was entirely unasserted. Dropping `coreutils` from the apk line would pass this check while base64, mktemp, seq and sort silently vanished — and on this repo's own history, their absence would be narrated as whatever the gate reaching for them happened to be doing, not as a missing tool. That is how openssl became "signature FAILED verification" and jq became "not a signed DSSE envelope". Verified by executing the assertion, not by reading it: extracted the inner script and ran it against a PATH with base64 deliberately absent. It printed base64=MISSING and the outer `grep -q MISSING` failed the build. Against a full PATH it reports zero MISSING. --- .github/workflows/build-image.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index fd3474f..150864f 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -109,6 +109,22 @@ jobs: # missing tool, blocking v0.0.134 and v0.0.135. The list only covers what # someone remembered to add, so add to it whenever a gate grows a new # shell dependency. + # + # DERIVED once, 2026-08-31, rather than remembered: every command invoked + # from a `run:` block across zegit's Gitea-executed workflows and its + # composite actions was extracted and checked against this list. Result: + # no missing apk package. Everything resolved to one of three sources — + # baked in here; provided by busybox/coreutils; or downloaded per-run and + # immediately version-checked (go via setup-go, buildctl, flux, cosign, + # syft, goreleaser). The download path needs nothing from this image + # beyond curl and tar, both already asserted. + # + # What the audit DID find is that the busybox/coreutils layer was entirely + # unasserted, so dropping `coreutils` from the apk line above would pass + # this check while base64, mktemp, seq and sort silently vanished — and by + # the history above, their absence would be narrated as whatever the gate + # using them happened to be doing. They are asserted below now. They are + # cheap to check and the failure they prevent is expensive to read. - name: Verify the image still contains the toolchain the gates need if: ${{ steps.meta.outputs.push == 'true' }} run: | @@ -129,6 +145,11 @@ jobs: command -v tar >/dev/null && echo "tar=ok" || echo "tar=MISSING" command -v openssl >/dev/null && echo "openssl=ok" || echo "openssl=MISSING" command -v jq >/dev/null && echo "jq=ok" || echo "jq=MISSING" + # busybox/coreutils layer: used across zegit's gates for base64 + # decoding of DSSE payloads, temp dirs, poll loops and sorting. + for t in base64 mktemp seq sort sed grep cut head wc uname date; do + command -v "$t" >/dev/null && echo "$t=ok" || echo "$t=MISSING" + done [ -x "$(git --exec-path)/git-http-backend" ] \ && echo "git-http-backend=ok" || echo "git-http-backend=MISSING" ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; } -- 2.54.0