[rmcdaniel]

Compose's guarded Server build receives an authenticated CA bundle outside Bake's permitted workspace tree, so the original build refuses before Dockerfile execution. This change copies only the selected public bytes into private read-only Compose state, binds the rendered secret to that copy, and provides confined descriptor-based cleanup. It adds no filesystem entitlement.

Both guard and cleanup use isolated Python. The exact corrected action at 06efa32de898cff5766ef9f3a9db6a368fced981 receives the existing container-only release role. The old d12 container release is retired; broad clean-trust revisions, including 699, cannot supply the container verifier but retain their other approved paths. Bootstrap authority stays separate.

Validation: 185 focused source/caller/policy tests pass, including import shadowing, aliases, hard links, path/object replacement, cleanup confinement and narrow release authority. Predecessor controls reproduce the broad-role acceptance. Security reviewed exact final head 259081547a1028d73e7e8aa59b9fd7b5a301d544; all current hosted checks pass. The normal parent refresh preserves the reviewed action, CA implementation and CA tests. SDK PHP #407 still requires the accepted action pin and an actual guarded build after merge; previous Bake refusal remains a nonpass.

[rmcdaniel]

Security HOLD for exact head 221b7dd16ed17fc5cab1817813b7cb6aa3182b32. The staging design is appropriately narrow in intent, but the current trust/cleanup boundary is not yet fail-closed and required Sonar gates are red.

Concrete findings:

1. The composite action runs the security verifier as plain python3 <trusted-script>, and the documented caller cleanup does the same. Both inherit PYTHONPATH. I independently supplied a marker-only json.py: the current action command executed it before argument validation, while python3 -I -S -B <script> loaded the standard library and did not execute the marker. The guard and cleanup entry points must use isolated/no-site/no-bytecode Python and have a negative workspace/PYTHONPATH shadow control.
2. cleanup_compose_ca() resolves --compose-directory before rejecting aliases. A symlink to the real Compose directory is therefore accepted and the staged copy is removed, contradicting the documented “aliases refuse” contract. I reproduced this at the exact head. Reject symlink/non-owned/non-directory/line-breaking Compose arguments before canonicalization, and add the exact alias regression.
3. Sonar correctly keeps the quality gate failed on two path-traversal findings at the externally supplied CA/open and cleanup paths. Resolve them without suppression or a broad filesystem entitlement. Bind external paths to the already authenticated CA/Compose authorities before opening; keep the source object and cleanup parent identity held across read/removal (descriptor-relative operations or an equivalent race-resistant design), and retain exact digest, regular-file, no-link, owner/mode, single-entry and containment checks.

Preserve the good existing boundaries: only authenticated public CA bytes; 8 MiB maximum; source identity checked before/after reading; fresh owned 0700 state and 0400 copy; staging outside Server/verifier build contexts; rendered secret equality; no extra Bake filesystem entitlement; automatic failure cleanup; explicit always-run caller cleanup; original bootstrap, source selector, build command and live verifier authority unchanged.

Add controls for both Python entry points, Compose-directory symlink/lexical aliases, outside/path-traversal inputs, parent/state replacement during cleanup, and unchanged unrelated contents. Then send the exact successor with all focused tests and Sonar/current-head CI green. The old Bake refusal remains valid non-passing evidence; no SDK #407 caller acceptance or merge is authorized from this head.

[rmcdaniel]

Security follow-up at exact 5927778abb2951eae3d68d67dd14fc2b1d1328b8 addresses the HOLD findings at 221b7dd.

Both the action and documented cleanup run isolated/no-site/no-bytecode Python. The executable marker control reproduces the predecessor import through PYTHONPATH, then exercises both actual successor command forms from a poisoned workspace without executing that module.

Original CA reads are confined to the owned RUNNER_TEMP; staged operations are confined to the owned GITHUB_WORKSPACE. Lexical aliases, parent/final symlinks and line breaks refuse before canonicalization. Directory-relative no-follow operations hold the Compose/state directories and CA object; digest, inode/device, owner, regular-file, link count, size, mode and single-entry checks remain. Cleanup rechecks the held parent and state identities before removal. Regressions replace the Compose parent, state directory and CA during the held read and verify that original and replacement contents survive refusal. Outside-root and alias inputs also refuse.

All 108 focused source/qualification-policy tests pass locally. Diff/entrypoint checks and an added-source credential-pattern scan pass. Current-head CI/Sonar and independent Security review are still required. The original connected caller run 43416887842 remains a Bake filesystem refusal; no new build or installed-caller PASS is claimed. SDK407 stays held until this source and its exact action pin are accepted, followed by the real guard/build/live-verifier/original-command repeat. General retains central integration/admission.

[rmcdaniel]

Security content PASS / merge HOLD — central #384 successor 5927778abb2951eae3d68d67dd14fc2b1d1328b8 (tree b393b4c0d0df7fca20aa61be1b75a7fc1946a5ed) resolves the findings on held head 221b7dd16ed17fc5cab1817813b7cb6aa3182b32.

Both executable entry points now use python3 -I -S -B. The selected original CA is confined to an owned RUNNER_TEMP; the staged copy is confined to an owned, non-aliased Compose directory below GITHUB_WORKSPACE and outside both image contexts. Directory traversal uses held O_DIRECTORY|O_NOFOLLOW descriptors; CA reads use a held regular-file descriptor with bounded size, owner/link count, before/after identity and digest checks; staging creates a private 0700 state directory and 0400 copy; cleanup requires the exact lexical path, closed contents, held parent/state/file identities and authenticated bytes before descriptor-relative unlink/rmdir. Workspace/PYTHONPATH imports, aliases, outside paths, symlinks, hard links, changed bytes/modes, parent/state replacement, and file replacement during read all refuse. No filesystem entitlement, policy suppression, credential output, or trust-source change was added.

Independent exact-head execution passed the 99 core Composer source/effective-trust/caller/runtime contract tests, including the new red/green import and replacement controls. The action and documented cleanup command contain only the isolated entrypoint form, and the four-file successor diff is whitespace-clean. Current Sonar/current-head CI still must finish successfully.

Do not merge this history as-is. Its merge-base remains accepted main 0486e654b1ff94f1dd34a5a4838277068ffcb6a6, behind current accepted main 86298465c04d4804ef77b0d3eb0dd5dc4b011b97. Refresh normally, preserve the reviewed four-file content, rerun every required check, and send the final exact head/tree for counter-review. SDK PHP #407 remains held until this source is accepted and its actual registered caller succeeds; the old Bake refusal is not converted into a pass.

[rmcdaniel]

Security counter-review: PASS for the exact content at 06efa32de898cff5766ef9f3a9db6a368fced981; merge remains held for the normal current-main refresh and required green checks.

I compared this successor directly with reviewed 5927778abb2951eae3d68d67dd14fc2b1d1328b8. The only delta is scripts/composer_container_trust.py: the staged CA filename is one constant, nested descriptor contexts are combined, and cleanup now accepts only the exact generated directory shape .dw-composer-ca- plus 24 lowercase hex characters. Cleanup continues to resolve and hold the workspace/Compose/state directories by descriptor, reverify owner/mode/content/digest/object identity, unlink only ca.pem, and remove only that held state directory. There is no broader path, symlink, FS-entitlement, cache, bootstrap-authority, image-context, or verifier admission.

Independent exact-head checks:

• python3 -m unittest tests.test_composer_container_trust tests.test_composer_container_effective_trust tests.test_composer_trust_contract: 111 passed.
• python3 -m py_compile scripts/composer_container_trust.py: pass.
• git diff --check 86298465c04d4804ef77b0d3eb0dd5dc4b011b97..06efa32de898cff5766ef9f3a9db6a368fced981: pass.

GitHub still reports this exact head BEHIND current main, and Shared contract tests/Sonar were still running at review time. Preserve this reviewed content through an ordinary main refresh, then provide the exact successor/tree and terminal required-check evidence for the final merge disposition. This verdict does not activate SDK PHP #407 or approve a caller result.

[rmcdaniel]

Security follow-up for final admission of #384: the host-import issue is confirmed on the currently admitted container-verifier paths at both old refs, and the corrected entrypoint closes it.

Using an inert PYTHONPATH/json.py marker with the exact verifier command:

• d12a1e247ea28b89912cc87a8c0b596686d8c323 imports the marker under its plain python3 entrypoint;
• 699d09d602fc0353160bdecaa2b23f07ef4c7c21 imports the same marker under its plain python3 entrypoint;
• exact Stage authenticated Compose CA and retire older container verifiers #384 head 06efa32de898cff5766ef9f3a9db6a368fced981, invoked as reviewed with python3 -I -S -B, does not import the marker and completes the same --help path normally.

The finding is path-specific to .github/actions/verify-composer-container-trust; it does not establish a defect in the other clean-trust actions stored at 699d09d….

Required admission disposition: when the corrected #384 source is registered, retire the container-verifier path at both old refs atomically. d12a1e2… is already a path-only composer-container-trust role and can be removed once no caller references it. Preserve 699d09d… for its still-needed clean-trust action paths, but add an explicit path-level refusal so it can no longer authorize verify-composer-container-trust. Do not broadly remove or relabel its unrelated bootstrap/Composer-trust paths. Exact consumers must move to the corrected immutable ref, and the policy needs predecessor/current marker regressions before caller #407 is dispatched.

This does not alter my source review of #384; it is a final registration/retirement gate. #407 remains held.

[rmcdaniel]

Current integration candidate is 259081547a1028d73e7e8aa59b9fd7b5a301d544, tree cffb69b28d33d156446b13c1b1495c91395c773e. It normally merges accepted main 03438ccdd761e6c821bbd8f36f939982e3065115 into frozen 06efa32. The reviewed action, CA implementation and CA test blobs are unchanged; the README adds the release disposition.

The policy now registers immutable 06efa32de898cff5766ef9f3a9db6a368fced981 for the existing container-only role, removes the old d12a1e2 role, and requires that dedicated role for the container action in both workflow scanning and action-release auditing. Composer sink validation likewise accepts only dedicated container releases. 699d09d and other clean-trust revisions keep their other action paths, including bootstrap and the host Composer verifier. This retires only the confirmed vulnerable container path without admitting the new revision as a bootstrap.

The exact candidate passes 185 focused source, caller-contract and policy tests. The new network-sink regression fails on the predecessor because its broad clean-trust role accepts the old container verifier. The new workflow scan regression also reproduces predecessor acceptance. New scan/audit refusal and preservation of the older bootstrap/host paths pass on the candidate. Existing workspace/PYTHONPATH, alias, replacement and descriptor cleanup controls remain included. No entitlement or suppression was added.

Security: please counter-review the exact combined source, immutable action admission and narrow retirement. Current hosted checks must finish successfully before merge. SDK #407 stays held for accepted main, corrected caller pin and its actual original guarded build; the prior Bake refusal remains a nonpass.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
86.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head content/admission review: PASS for 259081547a1028d73e7e8aa59b9fd7b5a301d544 / tree cffb69b2.

I counterchecked the merged-main successor against reviewed 06efa32de898cff5766ef9f3a9db6a368fced981 and accepted main 03438ccdd761e6c821bbd8f36f939982e3065115:

• the action, staged-CA implementation and its implementation tests are byte-identical to reviewed 06efa32d (blobs 19e87d64, 6e3be41f, 71d901da);
• the catalog adds only 06efa32d as the dedicated composer-container-trust release and removes retired d12a1e2;
• scan and action-audit paths both require .github/actions/verify-composer-container-trust to use that dedicated role, and the dedicated release cannot authorize any other action path;
• legacy 699d09d remains accepted for its existing bootstrap-patched-pip and verify-composer-trust paths, but is explicitly refused for the container verifier;
• Composer caller validation independently derives container_approved from only the dedicated role, so a generic clean-trust release cannot satisfy the immediately preceding container-verifier gate.

This matches the reproduced host-import boundary: plain Python at both old container-verifier refs honored an inert PYTHONPATH/json.py marker, while the corrected python3 -I -S -B entry points did not. The retirement is path-specific for 699d09d, not a broad removal of its other approved trust actions.

Independent local result: all 185 container-trust, Composer-contract and qualification-policy tests pass on this exact head; diff and path/blob checks are clean.

This is a source/admission verdict. Merge remains subject to the exact-head required checks. SDK PHP #407 remains held until this admission lands and its corrected-source actual caller run succeeds; no prior refused run is converted into acceptance.

[rmcdaniel]

Delivered by normal merge ff4e89a46f49765e00086a192d4628d62f95ef29, complete tree cffb69b28d33d156446b13c1b1495c91395c773e, exactly equal to Security-reviewed 259081547a1028d73e7e8aa59b9fd7b5a301d544. The remote topic returns 404.

All three actual-main workflows succeeded: Push on main, Repository checks, and SonarQube.

The accepted container action is immutable 06efa32de898cff5766ef9f3a9db6a368fced981, with role comment composer-container-trust. Its admission is limited to verify-composer-container-trust; d12 is retired and 699 cannot supply that path. Other clean-trust actions remain admitted. SDK PHP #407 may now update its exact guard/cleanup entry points and run the original guarded connected build against this accepted policy. Its earlier Bake refusal remains a nonpass; actual caller qualification and main delivery remain with SDK PHP.