Repository navigation
Conversation
…ries loft-enterprise now pins kine by tag and digest, and the digest wins: a bump of KINE_VERSION alone builds the old image under the new label. A check that the digest matches the tag would be wrong too, since a fork tag can point at the wrong build (v0.14.16.vcluster.4 holds upstream kine v0.13.5). The design's rule closes both: the digest's build provenance must name the fork's release workflow, the tag, and the tag's commit. image mode resolves the tag to its commit, runs gh attestation verify on the digest with signer workflow, signer and source digest, source ref and no self-hosted runners, then checks the fork commits like ref mode. binary mode downloads a release asset, compares its sha256, and verifies the asset's attestation the same way. Both fail closed on an unknown reference or a missing signer workflow. Checked against the registry with gh attestation verify: the kine digest loft-enterprise pins verifies under v0.16.5.vcluster.1 and is rejected under v0.17.2.vcluster.0; the live-image CI job repeats both cases. References DEVOPS-1740 Claude-Session: https://claude.ai/code/session_017edg9gFKBwMnmsAVXxEJzn
3 tasks
Product builds need vendor verification and attested image and binary checks together. Merging the stacked base prevents either path from losing its evidence or fail-closed behavior.
vcauesantos
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Step 4 inputs for the fork review check: container images pinned by digest and release binaries pinned by sha256. Stacked on #337.
loft-enterprise now pins kine by tag and digest (loft-sh/loft-enterprise#8958, #8959), and the digest wins: bumping
KINE_VERSIONalone builds the old image under the new label. Checking that the digest matches the tag would also be wrong, because a fork tag can point at the wrong build (v0.14.16.vcluster.4holds upstream kinev0.13.5). The design's rule covers both: the digest's provenance must name the fork's release workflow, the tag, and the tag's commit.Key Changes
imagemode:-image ghcr.io/<owner>/<name>:<fork-tag>@sha256:<digest>plus-signer-workflow <fork>=<workflow path>. Resolves the tag to S, runsgh attestation verify oci://IMAGE@DIGEST --owner ... --signer-workflow ... --signer-digest S --source-digest S --source-ref refs/tags/<tag> --deny-self-hosted-runners, then checks the fork commits likerefmode.binarymode:-url <release asset URL> -sha256 <hex>. Downloads, compares sha256, verifies the asset attestation the same way.live-imageCI job runsimagemode against the real registry for two cases.Evidence
gh attestation verifywith the flags above, run against the registry:kine:v0.16.5.vcluster.1@sha256:7e722818…(main pin)kine:v0.14.16.vcluster.4@sha256:4ed2cd65…(release-4.10 pin)kine:v0.17.2.vcluster.0@sha256:7e722818…(version-only bump)kine:v0.14.16.vcluster.4@sha256:0675df8b…(upstream build behind that tag)Dependencies
TODO
live-imagejob showsattestedfor the main pin andrejectedfor the version-only bump.References DEVOPS-1740
https://claude.ai/code/session_017edg9gFKBwMnmsAVXxEJzn