noel/act-node-docker
Watch
1
0
Fork
You've already forked act-node-docker
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ci: seal Rust advisory database for offline source checks #18

Merged
noel merged 1 commit from fix/runner-go-osv-984 into main 2026-09-18 02:25:06 +00:00
Conversation 0 Commits 1 Files changed 6 +67 -63
noel commented 2026-09-18 02:23:28 +00:00
Owner

Program: noel/infra#984, control346. Replace the unadopted Go-only derivative with the crates.io snapshot required by the approved Rust workstation helper. This image contains advisory data, not a login session or new human credentials.

Parent remains 36ed662b60eac8f9ee826a88288ec88feb3cd07d4a057352ffcac77a25a38ce0; inherited binaries, PyPI snapshot and Cloudflare provider unchanged. Public snapshot generation1789673347021396, SHA2568769690412f34534beb1f66cd8e78906bf3d0e9fc90234ed762c61f03cc841f4, 3458261 bytes. Existing networkless sealed-input recipe and exact source/parent/database labels preserved.

Acceptance: 4 source tests passed (12 rejected source mutations and 11 installation cases); real OSV2.4.0 offline scanner detects time0.3.45/RUSTSEC-2026-0009, accepts0.3.55, and fails closed for missing/corrupt data (4 cases, exits1/0/127/127). Independent read-only review accepted; tree/history gitleaks and diff check passed. No workflow exists in this source repository. Not a published-image claim: Infra publication and installed UID1000 deny-egress scanner/supplychain proof are separate required gates before consumer adoption.

Program: noel/infra#984, control346. Replace the unadopted Go-only derivative with the crates.io snapshot required by the approved Rust workstation helper. This image contains advisory data, not a login session or new human credentials. Parent remains 36ed662b60eac8f9ee826a88288ec88feb3cd07d4a057352ffcac77a25a38ce0; inherited binaries, PyPI snapshot and Cloudflare provider unchanged. Public snapshot generation1789673347021396, SHA2568769690412f34534beb1f66cd8e78906bf3d0e9fc90234ed762c61f03cc841f4, 3458261 bytes. Existing networkless sealed-input recipe and exact source/parent/database labels preserved. Acceptance: 4 source tests passed (12 rejected source mutations and 11 installation cases); real OSV2.4.0 offline scanner detects time0.3.45/RUSTSEC-2026-0009, accepts0.3.55, and fails closed for missing/corrupt data (4 cases, exits1/0/127/127). Independent read-only review accepted; tree/history gitleaks and diff check passed. No workflow exists in this source repository. Not a published-image claim: Infra publication and installed UID1000 deny-egress scanner/supplychain proof are separate required gates before consumer adoption.
noel merged commit c6fd767b34 into main 2026-09-18 02:25:06 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
noel/act-node-docker!18
No description provided.