From 8e49b857dde6116de575ca3977c9f74644863bce Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 18 Jul 2026 04:43:49 +0200 Subject: [PATCH] Complete RC6 supply chain gate --- CHANGELOG.md | 5 ++++ docs/CODEX_EXECUTION_LOG.md | 43 ++++++++++++++++++++++++++++ docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md | 15 ++++++++-- docs/TODO.md | 2 +- 4 files changed, 62 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e99ae02..aa624bb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,11 @@ dependency audits, a digest-pinned container scan and an SPDX SBOM. - Added a hashed Linux/Python 3.11 GIS/dev lock with an enforced input fingerprint while keeping PyTorch and Ultralytics out of base CI. +- Completed live SBOM and vulnerability-policy evidence for the configured AI + image. The final runtime replaces the Postgres base image's Go `gosu` + executable with an audited `setpriv` wrapper; the complete report still + retains the shadowed base-layer findings while the executable policy gate + reports zero reachable fixed HIGH/CRITICAL vulnerabilities. - Folded fresh-install, upgrade, rollback and runtime proof into RC-5 and RC-11 instead of creating a separate RC-12 phase. - Added a read-only release-evidence manifest command with Git, migration, diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md index 9aaa0298..ad0c9740 100644 --- a/docs/CODEX_EXECUTION_LOG.md +++ b/docs/CODEX_EXECUTION_LOG.md @@ -10473,3 +10473,46 @@ Validation: console errors or warnings. - RC-3 is complete. RC-4 national and maritime coverage contracts are the active roadmap phase. + +## 2026-07-18 - Belgium/North Sea RC-6 supply-chain gate + +Implemented: + +- Replaced smoke-only automation with equivalent Gitea and GitHub release + workflows covering readiness, offline Alembic SQL, Compose resolution, + Python/npm audits, immutable image build, SPDX SBOM and container scan. +- Added hash-pinned Linux/Python 3.11 runtime and CI locks with verified input + fingerprints. Optional PyTorch, torchvision and Ultralytics remain outside + the base and CI locks. +- Added timeboxed, machine-validated Starlette advisory exceptions with + request-target and form-content compensating controls. +- Replaced the final runtime `gosu` path with a minimal `setpriv` exec wrapper + and upgraded packaged setuptools/wheel metadata. +- Fixed the Trivy policy wrapper so its generated ignore policy is mounted + read-only into the scanner. The policy pass excludes the shadowed Go + executable path only; the complete report preserves every base-layer + finding for review. + +Validation: + +- Local readiness passed backend compilation, 1,005 backend tests, the + 124-route contract audit, Alembic head `202607160001`, frontend typecheck + and production build. +- Python dependency policy passed with seven explicitly documented Starlette + aliases ignored through 2026-08-31; frontend npm audit reported zero + vulnerabilities. +- Immutable AI image + `geointel-all-in-one:6a22fcd1f87fbf4921e16b1baa9367c6e24dc8a3-ai` + deployed healthy and passed live PostGIS 3.6 migration plus browser proxy + verification. +- Tower retained `artifacts/geointel-ai-sbom.spdx.json` (25,653,538 bytes) + and the complete Trivy JSON report. The executable policy pass reported + zero reachable fixed HIGH/CRITICAL findings. +- Direct runtime proof returned PostgreSQL UID `999` through the final + `/usr/local/bin/gosu` wrapper. Runtime packaging reports setuptools + `83.0.0` and wheel `0.47.0`. + +Decision: + +- RC-6 is complete. RC-7 critical API response typing and OpenAPI validation + is active. diff --git a/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md b/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md index 765ccb74..8509faac 100644 --- a/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md +++ b/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md @@ -149,8 +149,8 @@ editions and licences must still pass source-specific probes before activation. | RC-3 | complete | temporal detection/QA correctness and observability | | RC-4 | complete | national/maritime scope and provider coverage contracts | | RC-5 | complete | deployment, secrets, configuration, fresh install and rollback | -| RC-6 | in progress | complete CI, dependency and supply-chain gates | -| RC-7 | pending | critical API envelope typing and contract validation | +| RC-6 | complete | complete CI, dependency and supply-chain gates | +| RC-7 | in progress | critical API envelope typing and contract validation | | RC-8 | pending | frontend and browser E2E release journeys | | RC-9 | pending | loading, accessibility and performance hardening | | RC-10 | pending | retention, cleanup and national data operations | @@ -376,6 +376,17 @@ are aligned, and all operator-owned settings are editable in Unraid. ## RC-6 - CI and supply-chain gates +**State: complete.** Equivalent Gitea and GitHub workflows now enforce the +complete readiness gate, offline migrations, Compose resolution, dependency +audits, immutable container build, SPDX SBOM and Trivy policy. Linux/Python +3.11 runtime and CI locks are hash-pinned and optional AI dependencies remain +separate. The live AI image passed the container policy with zero reachable +fixed HIGH/CRITICAL findings; its complete report and 25.7 MB SBOM are retained +on Tower. The report deliberately preserves two timeboxed Starlette findings +and fifteen shadowed base-layer `gosu` findings. Runtime evidence proves that +the final `gosu` path is the audited `setpriv` wrapper running as PostgreSQL +UID 999. + ### Work - make CI run backend compile/tests, frontend typecheck/build, readiness, diff --git a/docs/TODO.md b/docs/TODO.md index 01d5eb45..d851c6f9 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -24,7 +24,7 @@ maritieme zones. Wallonie, Brussel en de Belgische Noordzee via golden areas operationaliseren. - [x] RC-5: secrets/configuratie/uploadlimieten/immutable deploy en rollback bewijzen. -- [ ] RC-6: volledige CI, dependency-audit, containerscan en SBOM toevoegen. +- [x] RC-6: volledige CI, dependency-audit, containerscan en SBOM toevoegen. - [ ] RC-7: kritieke API-routes concrete responsemodellen geven. - [ ] RC-8: echte frontend- en browser-E2E-releaseflows toevoegen. - [ ] RC-9: loading, toegankelijkheid, widescreen/mobile en performance afronden.