security inventory: Docker base digest pinned and exact-head verified #9

Status

COMPLETED_BOUNDED / BASE_IMAGE_DIGEST_PINNED_AND_EXECUTED

Resolved identity

The Evaluation Kit base image is now bound by tag and digest:

node:20.11.0-bookworm-slim@sha256:ecc9a2581f8588014a49a523a9ed146d27963f6d988d11bd16bbdcb3598f5f98

The digest was observed in GitHub Actions run 30285959852, job 90043701088, using:

docker buildx imagetools inspect

The observation was made on the declared linux/amd64 / ubuntu-24.04 workflow surface.

Bound files in draft PR #13

• Dockerfile uses the tag plus exact digest.
• environment.lock.json records the platform, runner, checkout action, exact base digest, observation identity, and network dependency boundary.
• .github/workflows/evaluation-kit-runtime.yml fails closed unless:
  • the observed tag digest matches the environment-lock digest;
  • the Dockerfile contains that exact digest;
  • the environment-lock base-image name matches the observed subject.
• claim-ceiling.json and README.md preserve the remaining non-hermetic boundary.

Exact-head execution evidence

Draft head:

868341e2a26ae1ac912be170a2930034b06623ee

GitHub Actions run 30286309516, job 90044856022, completed successfully.

Observed successful steps include:

• base-image identity observation;
• environment-lock and Dockerfile identity match;
• required-file and registry validation;
• unsupported-command fail-closed test;
• digest-pinned Docker build;
• full Evaluation Kit execution;
• success-summary generation.

Remaining boundary

Closing this issue means only that the declared Docker base-image identity is digest-pinned and the exact draft head executed successfully under the observed conditions.

It does not establish offline or hermetic reproduction. apt-get and npm package acquisition remain network-bound, and registry freshness and verifier depth remain separate issues.

Non-claims

This issue does not establish certification, production readiness, external audit, independent reproduction, complete supply-chain isolation, complete AI safety, absolute security, or absence of defects.