feat: seal hermetic image build inputs #4

Merged

noel merged 1 commit from feat/sealed-hermetic-inputs into main

2026-08-12 14:31:41 +00:00

noel commented

2026-08-12 14:31:32 +00:00

Owner

Replace all network fetches inside the system hermetic Dockerfile with four read-only _build_inputs mounts. Every RUN is explicitly --network=none; versions and SHA-256 checks remain source-owned and mandatory. The infrastructure transaction will fetch and verify the exact files before BuildKit starts. No external Dockerfile frontend image is introduced.

Adds a source-owned contract test forbidding network fetchers/URL args and requiring four networkless sealed mounts. Validated with that contract, diff checks, and a redacted tree scan.

Replace all network fetches inside the system hermetic Dockerfile with four read-only `_build_inputs` mounts. Every `RUN` is explicitly `--network=none`; versions and SHA-256 checks remain source-owned and mandatory. The infrastructure transaction will fetch and verify the exact files before BuildKit starts. No external Dockerfile frontend image is introduced. Adds a source-owned contract test forbidding network fetchers/URL args and requiring four networkless sealed mounts. Validated with that contract, diff checks, and a redacted tree scan.

noel added 1 commit

2026-08-12 14:31:32 +00:00

feat: seal hermetic image build inputs 38256f2dce