Repository navigation
fix(ci): verify prepared native OCI execution identity (RUST-CI-045) - #57
Merged
Merged
Conversation
added 2 commits
November 12, 2026 06:53
…-045) Hash-check config bytes and validate classic and containerd local identities against the attested native manifest before probing or packaging. Refs: emulebb/emulebb-rust#302
Exercise the shared identity verifier against the existing pinned Alpine mirror on both native CPUs before publishing prepared compiler images. Keep Docker out of normal local pytest and retain bounded failure evidence. Refs: emulebb/emulebb-rust#302
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docker 29 with the containerd image store can report a manifest identity in
image inspect .Id. Treating that value as the OCI configuration digest rejects the prepared Linux builder before compilation. Resolve and hash-verify the attested index, native CPU manifest and configuration, then pull, inspect, probe and package through the same immutable native manifest reference.Validate typed classic/config and containerd/manifest identities, descriptor metadata, CPU/OS, source and recipe labels, all configuration labels and rootfs diff IDs. Record the verified configuration digest separately from the local storage identity and retain bounded public mismatch evidence without configuration environments. Existing attestation, source, non-root, read-only and provenance guards remain in force.
Add a read-only native AMD64/ARM64 Docker 29.6.1/containerd conformance job using the existing pinned Alpine mirror, ahead of image publication. Ordinary local pytest remains mock-only.
Validation: 105 focused Python tests passed locally; one existing Linux-only GNU timeout process-group test skipped on Windows. Normal privacy, hygiene, actionlint and direct-test hooks passed. All exact-head GitHub checks passed, including both Windows baselines and native Linux tests. Real Docker conformance on AMD64 and ARM64 independently verified the manifest/config distinction, matching native descriptor and rootfs, and actual non-root execution on each CPU. No local Docker, Cargo or heavy platform validation ran.
Parent-coordinated workstream
prepared-image-identity. A newly produced, attested compiler image from the merged Build source and Rust consumer packaging qualification remain required. No producer dispatch, source pin refresh or merge was performed here.Refs: emulebb/emulebb-rust#302 (RUST-CI-045)