This commit is contained in:
jason.woltje committed
commit
a7a433e271
15 files changed
+259
-12
No files matched your search
@@ -1886,3 +1886,6 @@ are never rewritten or removed; corrections are new entries.
|
||||
2026-10-28 | Vikunja-19 | FIX-156 isolated legacy worker per-run mounts on work/vikunja-19-156-q284-worker-mounts at exact09a847e | Source/test/docs review-ready; focused18/18 plus prompt/syntax/diff checks green, no native/full gate or commit/push/PR/API; parent owns integration and CI.
|
||||
2026-10-28 | Vikunja-19 | FIX-156 atomic-control continuation on same uncommitted branch/base | Replaced inode-pinning processing file launch bind with narrow read-only control-directory view; source RED10/11 then GREEN19/19 plus syntax/diff checks, native/container CI still required and parent-owned.
|
||||
2026-10-29 | Vikunja-19 | FIX-156 R3 repair on published ee151685e without commit/amend | Replaced worker-writable session-fork bind with bounded no-follow current-run write-once snapshot; disposed F2-F4 and I1-I8, RED18/5 then focused23/23, #660/native/review gates remain parent-owned.
|
||||
2026-10-29T03:33:00.640624+00:00 | Sage | Q284 #470 patched Node base source | Digest pin and official metadata prepared; no build, CI, commit, PR, merge or live action.
|
||||
|
||||
2026-10-29 | Sage | #470 independent-review repair | M1 binds preparation/verification baseDigest to exactly one literal digest-pinned Containerfile FROM; stale cached tag metadata cannot be substituted. Focused fixture TDD: 0/3 RED then 3/3 GREEN, fake build/inspection only, no Docker command or image operation. L1 docs corrected. L2 additive registry config hash/version binding retained; prior metadata receipt preserved with correction. Earlier no-commit statement describes initial source session; Mos then published PR1837. #660 admitted runner and fresh independent review remain required; frozen H1/packets unchanged.
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"at": "2026-10-29T05:31:41.106Z",
|
||||
"source": "https://registry-1.docker.io/v2/library/node/blobs/sha256:9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44",
|
||||
"method": "public registry config metadata only; anonymous pull-scoped authorization kept in memory",
|
||||
"bytes": 6707,
|
||||
"sha256": "9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44",
|
||||
"configDigest": "sha256:9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44",
|
||||
"manifest": "linux-amd64.json",
|
||||
"declaredNodeVersion": "24.22.2",
|
||||
"platform": "linux/amd64",
|
||||
"correction": "Earlier RECEIPT.json method mentions config reads; that earlier step fetched manifests only. This additive record binds the config now; earlier evidence is unchanged.",
|
||||
"binaryVersionObserved": false,
|
||||
"imagePullBuildRun": false
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
# Q284 / #470 — patched Node worker base
|
||||
|
||||
The worker base is Node24.22.2 Bookworm slim, pinned to the official Docker
|
||||
Library Node multi-platform index digest. The previous mutable Node24 tag
|
||||
could resolve to, or reuse a cached copy of, an older vulnerable release.
|
||||
|
||||
The Node project identifies the October2026 Brotli decoder memory corruption
|
||||
as CVE-2026-111497, fixed in24.22.1. Version24.22.2 was released on2026-10-28.
|
||||
Primary release/advisory sources:
|
||||
|
||||
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
|
||||
- https://nodejs.org/en/blog/release/v24.22.2
|
||||
|
||||
`index.json` is the exact official registry response read2026-10-29T03:30:27Z.
|
||||
Its SHA256 equals the registry Docker-Content-Digest and the Containerfile pin.
|
||||
The included Linux amd64 manifest is selected by its platform and independently
|
||||
matches its own digest. `RECEIPT.json` gives both identities plus config/layers.
|
||||
Only registry metadata was fetched: no layer pull, image build, binary, test,
|
||||
container, native or privileged operation was performed for this source change.
|
||||
|
||||
This does not establish an installed/deployed version, binary provenance beyond
|
||||
the selected official registry asset, a full-CI result, or a completed #470
|
||||
image rebuild. The retained #470 runtime measurements name other deployed
|
||||
api/orchestrator/web images; no binding from those images to this worker was
|
||||
observed. Each existing deployment still needs its repository's authorized CI,
|
||||
current runtime readbacks and separate operating approval.
|
||||
|
||||
The apt inputs and tag-only production activation receipts remain #714.
|
||||
The Pi/Undici dependency correction remains #713. This base pin does not replace
|
||||
either fix or modify any frozen #660/#678/#683 evidence.
|
||||
|
||||
Independent-review follow-up: `linux-amd64-config.json` is the exact 6,707-byte
|
||||
registry config blob selected by the saved manifest. Its SHA256 is
|
||||
`9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44`, and its
|
||||
image environment declares `NODE_VERSION=24.22.2`. `CONFIG-RECEIPT.json` records
|
||||
the later public metadata read and corrects the earlier receipt's imprecise
|
||||
"manifest/config reads" wording; the earlier receipt itself is preserved.
|
||||
This is a declared config/version binding, not execution of `node --version`.
|
||||
|
||||
The image-preparation helper now records the one digest-pinned Containerfile
|
||||
FROM reference directly. A well-formed receipt naming a stale mutable-tag image
|
||||
refuses before image inspection. The helper does not inspect an unrelated local
|
||||
base tag. Frozen #660 packets and running H1 inputs are unchanged; this is only
|
||||
a future source candidate. The dedicated runner must admit and validate the
|
||||
exact joined candidate before any merge or image use.
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"at": "2026-10-29T03:30:27.241Z",
|
||||
"method": "public registry manifest/config reads only; no image pull/build/execution",
|
||||
"repo": "library/node",
|
||||
"tag": "24.22.2-bookworm-slim",
|
||||
"rows": [
|
||||
{
|
||||
"name": "index.json",
|
||||
"ref": "24.22.2-bookworm-slim",
|
||||
"status": 200,
|
||||
"bytes": 3929,
|
||||
"sha256": "c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c",
|
||||
"digest": "sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c",
|
||||
"mediaType": "application/vnd.oci.image.index.v1+json"
|
||||
},
|
||||
{
|
||||
"name": "linux-amd64.json",
|
||||
"ref": "sha256:a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0",
|
||||
"status": 200,
|
||||
"bytes": 1929,
|
||||
"sha256": "a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0",
|
||||
"digest": "sha256:a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0",
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json"
|
||||
}
|
||||
],
|
||||
"selected": {
|
||||
"digest": "sha256:a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0",
|
||||
"platform": {
|
||||
"architecture": "amd64",
|
||||
"os": "linux"
|
||||
},
|
||||
"configDigest": "sha256:9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44",
|
||||
"layerDigests": [
|
||||
"sha256:3c5439d0ae62993af4cc4e21b8c777297e81bc40e200d4633c85a3e0f977a3bc",
|
||||
"sha256:71cba37e8e979730332c9470b41e1d978d0fa9253c78769c62916bf084227639",
|
||||
"sha256:c82672318514ade64c9d9475b8887e67ae5ec0e018566b79795c23c22542e486",
|
||||
"sha256:e95aa4763e735fd31ba05431a12c6b7ec236a771aa6bda23f4be91af7c10b1c3",
|
||||
"sha256:fc18cf7369573eeb5968534eb64b13d045bc5ca15d698ae3ef86d7e763138183"
|
||||
],
|
||||
"note": "metadata binding only; binaries and runtime unobserved"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
{"manifests":[{"annotations":{"com.docker.official-images.bashbrew.arch":"amd64","org.opencontainers.image.base.digest":"sha256:a3bba7dc7dbcc1f37c2856c51fc9a7fac96608f50cb87b1b4e4d8b8c85ae988e","org.opencontainers.image.base.name":"debian:bookworm-slim","org.opencontainers.image.created":"2026-10-28T20:55:58Z","org.opencontainers.image.revision":"e994dfe115899a82684caa7533380aa7d439aae1","org.opencontainers.image.source":"https:\/\/github.com\/nodejs\/docker-node.git#e994dfe115899a82684caa7533380aa7d439aae1:24\/bookworm-slim","org.opencontainers.image.url":"https:\/\/hub.docker.com\/_\/node","org.opencontainers.image.version":"24-bookworm-slim"},"digest":"sha256:a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0","mediaType":"application\/vnd.oci.image.manifest.v1+json","platform":{"architecture":"amd64","os":"linux"},"size":1929},{"annotations":{"com.docker.official-images.bashbrew.arch":"amd64","vnd.docker.reference.digest":"sha256:a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0","vnd.docker.reference.type":"attestation-manifest"},"digest":"sha256:6f551b5567b5479a82dd248f8c8fafcbb51745bcfdf3db5d7a4e17a7479efcd6","mediaType":"application\/vnd.oci.image.manifest.v1+json","platform":{"architecture":"unknown","os":"unknown"},"size":841},{"annotations":{"com.docker.official-images.bashbrew.arch":"arm64v8","org.opencontainers.image.base.digest":"sha256:7ccb8b5b60c7654f5b795d94ee7d751cd0811500803f0b09cefcd555e755a55a","org.opencontainers.image.base.name":"debian:bookworm-slim","org.opencontainers.image.created":"2026-10-28T20:55:43Z","org.opencontainers.image.revision":"e994dfe115899a82684caa7533380aa7d439aae1","org.opencontainers.image.source":"https:\/\/github.com\/nodejs\/docker-node.git#e994dfe115899a82684caa7533380aa7d439aae1:24\/bookworm-slim","org.opencontainers.image.url":"https:\/\/hub.docker.com\/_\/node","org.opencontainers.image.version":"24-bookworm-slim"},"digest":"sha256:e80dee4ed3709cf1f8004e34ecfb90df71b7eac8ba0d7d6222ba238a823d1eea","mediaType":"application\/vnd.oci.image.manifest.v1+json","platform":{"architecture":"arm64","os":"linux","variant":"v8"},"size":1931},{"annotations":{"com.docker.official-images.bashbrew.arch":"arm64v8","vnd.docker.reference.digest":"sha256:e80dee4ed3709cf1f8004e34ecfb90df71b7eac8ba0d7d6222ba238a823d1eea","vnd.docker.reference.type":"attestation-manifest"},"digest":"sha256:73b8f2bfa2a316cbc6da625364f1b714e978e96edf03381d9a260d92620b4ed6","mediaType":"application\/vnd.oci.image.manifest.v1+json","platform":{"architecture":"unknown","os":"unknown"},"size":841},{"annotations":{"com.docker.official-images.bashbrew.arch":"ppc64le","org.opencontainers.image.base.digest":"sha256:197ef431a1e3c2086f70d65bf5c7d47217c2c25e8591c9a31e86a5b926077971","org.opencontainers.image.base.name":"debian:bookworm-slim","org.opencontainers.image.created":"2026-10-28T21:20:08Z","org.opencontainers.image.revision":"e994dfe115899a82684caa7533380aa7d439aae1","org.opencontainers.image.source":"https:\/\/github.com\/nodejs\/docker-node.git#e994dfe115899a82684caa7533380aa7d439aae1:24\/bookworm-slim","org.opencontainers.image.url":"https:\/\/hub.docker.com\/_\/node","org.opencontainers.image.version":"24-bookworm-slim"},"digest":"sha256:6baef4d2f00c27c530d270dc1a4b76d04113c378a4fc3bd3b242bd35d6ac7f18","mediaType":"application\/vnd.oci.image.manifest.v1+json","platform":{"architecture":"ppc64le","os":"linux"},"size":1931},{"annotations":{"com.docker.official-images.bashbrew.arch":"ppc64le","vnd.docker.reference.digest":"sha256:6baef4d2f00c27c530d270dc1a4b76d04113c378a4fc3bd3b242bd35d6ac7f18","vnd.docker.reference.type":"attestation-manifest"},"digest":"sha256:1c0f17fca393ddff67c244d9f15bd671636f8466fd360616f149e43a37e6a1ff","mediaType":"application\/vnd.oci.image.manifest.v1+json","platform":{"architecture":"unknown","os":"unknown"},"size":841}],"mediaType":"application\/vnd.oci.image.index.v1+json","schemaVersion":2}
|
||||
@@ -0,0 +1 @@
|
||||
{"architecture":"amd64","config":{"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","NODE_VERSION=24.22.2","YARN_VERSION=1.22.22"],"Entrypoint":["docker-entrypoint.sh"],"Cmd":["node"]},"created":"2026-10-28T20:56:52.2122198Z","history":[{"created":"2026-10-27T00:00:00Z","created_by":"# debian.sh --arch 'amd64' out/ 'bookworm' '@1793059200'","comment":"debuerreotype 0.17"},{"created":"2026-10-28T20:56:22.171664505Z","created_by":"RUN /bin/sh -c groupadd --gid 1000 node \u0026\u0026 useradd --uid 1000 --gid node --shell /bin/bash --create-home node # buildkit","comment":"buildkit.dockerfile.v0"},{"created":"2026-10-28T20:56:40.262042355Z","created_by":"ENV NODE_VERSION=24.22.2","comment":"buildkit.dockerfile.v0","empty_layer":true},{"created":"2026-10-28T20:56:40.262042355Z","created_by":"RUN /bin/sh -c ARCH= OPENSSL_ARCH= \u0026\u0026 dpkgArch=\"$(dpkg --print-architecture)\" \u0026\u0026 case \"${dpkgArch##*-}\" in amd64) ARCH='x64' OPENSSL_ARCH='linux-x86_64';; ppc64el) ARCH='ppc64le' OPENSSL_ARCH='linux-ppc64le';; arm64) ARCH='arm64' OPENSSL_ARCH='linux-aarch64';; *) echo \"unsupported architecture\"; exit 1 ;; esac \u0026\u0026 set -ex \u0026\u0026 apt-get update \u0026\u0026 apt-get install -y ca-certificates curl wget gnupg dirmngr xz-utils libatomic1 --no-install-recommends \u0026\u0026 rm -rf /var/lib/apt/lists/* \u0026\u0026 export GNUPGHOME=\"$(mktemp -d)\" \u0026\u0026 for key in 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 CC68F5A3106FF448322E48ED27F5E38D5B0A215F 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C 108F52B48DB57BB0CC439B2997B01419BD92F80A 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD A363A499291CBBC940DD62E41F10027AF002F8B0 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } ; done \u0026\u0026 curl -fsSLO --compressed \"https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz\" \u0026\u0026 curl -fsSLO --compressed \"https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc\" \u0026\u0026 gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \u0026\u0026 gpgconf --kill all \u0026\u0026 rm -rf \"$GNUPGHOME\" \u0026\u0026 grep \" node-v$NODE_VERSION-linux-$ARCH.tar.xz\\$\" SHASUMS256.txt | sha256sum -c - \u0026\u0026 tar -xJf \"node-v$NODE_VERSION-linux-$ARCH.tar.xz\" -C /usr/local --strip-components=1 --no-same-owner \u0026\u0026 rm \"node-v$NODE_VERSION-linux-$ARCH.tar.xz\" SHASUMS256.txt.asc SHASUMS256.txt \u0026\u0026 find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name \"$OPENSSL_ARCH\" -exec rm -rf {} \\; \u0026\u0026 apt-mark auto '.*' \u003e /dev/null \u0026\u0026 find /usr/local -type f -executable -exec ldd '{}' ';' | awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); print so }' | sort -u | xargs -r dpkg-query --search | cut -d: -f1 | sort -u | xargs -r apt-mark manual \u0026\u0026 apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \u0026\u0026 ln -s /usr/local/bin/node /usr/local/bin/nodejs \u0026\u0026 node --version \u0026\u0026 npm --version \u0026\u0026 rm -rf /tmp/* # buildkit","comment":"buildkit.dockerfile.v0"},{"created":"2026-10-28T20:56:40.262042355Z","created_by":"ENV YARN_VERSION=1.22.22","comment":"buildkit.dockerfile.v0","empty_layer":true},{"created":"2026-10-28T20:56:52.190825843Z","created_by":"RUN /bin/sh -c set -ex \u0026\u0026 savedAptMark=\"$(apt-mark showmanual)\" \u0026\u0026 apt-get update \u0026\u0026 apt-get install -y ca-certificates curl wget gnupg dirmngr --no-install-recommends \u0026\u0026 rm -rf /var/lib/apt/lists/* \u0026\u0026 export GNUPGHOME=\"$(mktemp -d)\" \u0026\u0026 for key in 6A010C5166006599AA17F08146C2130DFD2497F5 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } ; done \u0026\u0026 curl -fsSLO --compressed \"https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz\" \u0026\u0026 curl -fsSLO --compressed \"https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc\" \u0026\u0026 gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \u0026\u0026 gpgconf --kill all \u0026\u0026 rm -rf \"$GNUPGHOME\" \u0026\u0026 mkdir -p /opt \u0026\u0026 tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \u0026\u0026 ln -s /optLine truncated
|
||||
@@ -0,0 +1,46 @@
|
||||
{
|
||||
"schemaVersion": 2,
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"config": {
|
||||
"mediaType": "application/vnd.oci.image.config.v1+json",
|
||||
"digest": "sha256:9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44",
|
||||
"size": 6707
|
||||
},
|
||||
"layers": [
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
|
||||
"digest": "sha256:3c5439d0ae62993af4cc4e21b8c777297e81bc40e200d4633c85a3e0f977a3bc",
|
||||
"size": 28247437
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
|
||||
"digest": "sha256:71cba37e8e979730332c9470b41e1d978d0fa9253c78769c62916bf084227639",
|
||||
"size": 3315
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
|
||||
"digest": "sha256:c82672318514ade64c9d9475b8887e67ae5ec0e018566b79795c23c22542e486",
|
||||
"size": 51082629
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
|
||||
"digest": "sha256:e95aa4763e735fd31ba05431a12c6b7ec236a771aa6bda23f4be91af7c10b1c3",
|
||||
"size": 1713038
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
|
||||
"digest": "sha256:fc18cf7369573eeb5968534eb64b13d045bc5ca15d698ae3ef86d7e763138183",
|
||||
"size": 449
|
||||
}
|
||||
],
|
||||
"annotations": {
|
||||
"com.docker.official-images.bashbrew.arch": "amd64",
|
||||
"org.opencontainers.image.base.digest": "sha256:a3bba7dc7dbcc1f37c2856c51fc9a7fac96608f50cb87b1b4e4d8b8c85ae988e",
|
||||
"org.opencontainers.image.base.name": "debian:bookworm-slim",
|
||||
"org.opencontainers.image.created": "2026-10-28T20:55:58Z",
|
||||
"org.opencontainers.image.revision": "e994dfe115899a82684caa7533380aa7d439aae1",
|
||||
"org.opencontainers.image.source": "https://github.com/nodejs/docker-node.git#e994dfe115899a82684caa7533380aa7d439aae1:24/bookworm-slim",
|
||||
"org.opencontainers.image.url": "https://hub.docker.com/_/node",
|
||||
"org.opencontainers.image.version": "24-bookworm-slim"
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user