Repository navigation
adopt anubis 1.28.1 and preserve its challenge assets - #83
Merged
Merged
Conversation
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The daily Container Security workflow stops before scanning because the maintained Anubis image is v1.27.0 while the latest stable release is v1.28.1. Adopt v1.28.1 with matching immutable source, annotated-tag verification, runtime-image digest, and source/version labels. This includes upstream's reverse-DNS verification fix and preserves the latest-stable compatibility guard.
Anubis 1.28 adds optional WASM challenges. Build their baseline/SIMD modules and JavaScript fallback with a digest-pinned Rust 1.99.0 stage, retain the patched Go 1.26.9/x/net pins, and use upstream's gRPC 1.84.0 and cel.dev/cel-go 0.32.0 versions. Upstream Rust/Go tests and Go vet run in the builder; compilers stay out of the runtime image. Challenge defaults, non-root/read-only operation, honeypot logging and bbolt behavior remain intact.
The smoke fixture now uses a 64-byte synthetic HMAC key to satisfy v1.28.1's startup validation. Manual deployments setting HS512_SECRET need exactly 64 bytes; installer-generated stacks do not set it. All prior runtime assertions remain, with new assertions for the embedded WASM and JavaScript fallback assets. The asset regression first failed on the old image.
Local verification: full build including upstream Rust/Go tests and Go vet; real runtime/auth-request/honeypot/restart smoke; both real installer-generated policy choices (allow/default and catch-all) with 401/403 behavior; all-severity vulnerability inventory and the MEDIUM/HIGH/CRITICAL gate without exceptions; Docker lint, codespell and clean diff pass. Native AMD64/ARM64 PR runtime and scan gates, NPMplus PR image scanning, CodeQL, and all applicable lint/test checks passed before merge.
Scope: Anubis Dockerfile, its smoke harness, README and changelog. No scan threshold, ignore file, NPMplus authentication code, or installer policy choice changes.
On merged develop
a66e725e, native runtime checks, vulnerability gates and publication, CodeQL, and Container Security against all four published images pass. Fresh analyses have no processing errors or warnings, and there are zero open CodeQL/Trivy alerts. The NPMplus image retains four previously reviewed, exact-package/version pip packaging exceptions expiring October 23; auxiliary-image gates use no exceptions.