Repository navigation
Fix supply chain vulnerabilities in CI/CD and liboqs advisory checks - #136
Merged
Merged
Conversation
…qs minimal build; 0.4.112 - Trivy reads a saved image or the registry by digest, never the Docker socket; the GHCR login comes after the scan (BUGSVULNS 110). - release.yml runs the suite first (reusable tests.yml), scans its image, attests an SBOM, and leaves :latest to ci.yml; the zipapp is attached with gh instead of a third-party action (BUGSVULNS 111). - base-image.yml publishes from main only and attests the base; every job uses a published image only once gh attestation verify proves it, by digest, else builds the base (.github/scripts, BUGSVULNS 112). - repo-checks.yml: zizmor on the workflows, gitleaks over the whole history, hadolint and Trivy misconfiguration rules on the Dockerfiles. - CycloneDX SBOM attested beside provenance for ci and release images. - Dependabot cooldown of 7 days on every ecosystem. - Harden-Runner (audit) on the publishing jobs. - liboqs built with ML-KEM-768 and ML-DSA-65 only: LMS/XMSS and hazardous signing off, removing the code two 0.16.0 advisories land in; audit.yml checks liboqs's own advisories against the lock (BUGSVULNS 113). - Container running as root recorded as open (BUGSVULNS 114). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrYW4X7e3ouazLWKRRnimK
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…UB_ENV; 0.4.113 CodeQL (actions) flagged the scripts' output written to $GITHUB_ENV: a value with a newline in it would define whatever variable its second line names. The scripts now print only a plain lowercase reference (name and digest, or name and tag) and refuse anything else; the workflows hand it to later steps in $RUNNER_TEMP/<name>.ref. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrYW4X7e3ouazLWKRRnimK
Owner
Author
|
@copilot resolve the merge conflicts in this pull request |
…kq3xn # Conflicts: # BUGSVULNS.MD Co-authored-by: fnyaker <76814730+fnyaker@users.noreply.github.com>
Contributor
Resolved by merging |
main took BUGSVULNS 110 and 111 (the base-image race moved to 111), so this branch's entries are 112-116 and every reference follows. Version moves past main's 0.4.113. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrYW4X7e3ouazLWKRRnimK
… 0.4.114 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrYW4X7e3ouazLWKRRnimK
Owner
Author
|
@copilot restart the checks, the "test" check does not seems to report anything |
Copilot stopped work on behalf of
fnyaker due to an error
October 15, 2026 11:53
Branch protection requires the status check `test` by name. The reusable tests.yml made it report as `test / test`, so the PR stayed blocked with every check green. The steps now live in .github/actions/suite, which the `test` job of ci.yml and of release.yml runs; zizmor and the pin checks cover the action too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrYW4X7e3ouazLWKRRnimK
Owner
Author
|
The Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the CI/CD supply chain and closes a gap nothing watched: liboqs's own advisories. Published images are used only once their provenance is verified, no CI tool gets the Docker socket, releases publish only what the suite passed, and liboqs is built with only the two schemes a node uses.
Key Changes
Supply chain (BUGSVULNS 112–114)
.github/scripts/pull-verified.shand.github/scripts/provide-base.shuse a published image only oncegh attestation verifyproves which workflow onmainbuilt it, then by that digest; otherwise the base is built locally. The reference they print is checked to be a plain image reference and passed between steps through a file in$RUNNER_TEMP, never$GITHUB_ENV.docker savefile (--input) or the registry by digest.:latest.base-image.ymlpublishes frommainonly, with a provenance attestation.tests.yml), builds on a verified base, scans its image, attests an SBOM, leaves:latesttoci.yml, and attaches the zipapp with the runner's ownghinstead of a third-party action.liboqs (BUGSVULNS 115)
scripts/build_liboqs.shnow builds only ML-KEM-768 and ML-DSA-65 (OQS_MINIMAL_BUILD), with stateful signatures and hazardous signing off; the library goes from about 26 MB to 600 KB.tests/tools/liboqs_advisories.py, run byaudit.ymlon every change and weekly, checks liboqs's own advisories against the lock; exceptions live inscripts/liboqs.acceptedwith their reason.Repository checks
repo-checks.yml: zizmor (workflows), gitleaks (whole history), hadolint and Trivy misconfiguration rules (Dockerfiles). Exceptions with reasons in.github/zizmor.yml,.gitleaksignore,.hadolint.yaml,.trivyignore.cooldown); security updates are not held.auditmode on the publishing jobs.$/.github/workflows/tests.yml(self-repository form).Open
/dataownership, the documented/root/.sshmount and fleet's Docker socket, so it is its own change. Trivy's DS-0002 is set aside until then.Tests
tests/test_ci_scripts.py,tests/test_liboqs_advisories.py,TestWhatIsCompiledintests/test_liboqs_lock.py, and new invariants intests/test_workflows_pinned.py(no socket, scan before login, nodocker pulloutside the verifying scripts, release waits for the suite, no image reference through$GITHUB_ENV, Dependabot cooldown).Documentation
BUGSVULNS.MD112–116,TEST.md,SECURITY.md,Docs/Setup/guide,Docs/Architecture/gotchas.md,AGENTS.md. Version 0.4.114.🤖 Generated with Claude Code
https://claude.ai/code/session_01VrYW4X7e3ouazLWKRRnimK