Checked against netork's first signed images (main-142912c): cosign verify
on the tag succeeds, verify-attestation on it finds only the signature,
because BuildKit pushes even one platform as an index with its provenance
manifest. The CIS result and SBOM are on the linux/amd64 image.
netork's release joins an arm64 image to the amd64 one its dev build
already signed and attested, under a new index. ATTEST_PLATFORMS (the sign
action's attest-platforms) signs the new index and every platform behind
it, and attests only the ones named.
Moving bump.py from base-os took its tests up to the one that checks
base-os's own dependents.toml and cut everything after it: an odd new
reference, a repo without the file yet, a dependent without a workflow, a
compose pin with the registry variable, a repo the bot may not see. They
are back; base-os's list check stays in base-os.
- image_tools/bump.py from base-os, with an action. base-python used it from
a pinned checkout of base-os, with the bot's token; one place serves both.
A dependent whose workflow does not exist (netork's ui-nightly.yml, on
2026-10-22) is named and the others go on; the run fails at the end, as
for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
${BASE_OS}, which its nightly sets, and copies CPython from Docker's
python:3.12-slim, which is not signed with netOrk's key.
base-os's nightly asks netOrk's matcher whether a rebuild improves on the
pin (image_tools/verify.py). As an action, a workflow needs nothing of this
repository but the pinned commit: no install, no checkout. A verdict that
could not be reached fails the step, as it does in base-os since the two
nights with an empty NETORK_LICENSE_KEY.
The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived
in NetOrk/base-os, the head of the chain. Every link below it -- base-python,
engine, ui, satellite, the service images -- needs the same, so the tools
move here, and every image repository pins them by commit.
- image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The
image's own repository holds its cis.toml and packages.allow; both default
to the working directory.
- bin/sign.sh signs whatever platforms a reference holds: base-os's index of
amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest
(image_tools/platforms.py).
- bin/verify-base.sh checks every FROM image of a Dockerfile against
cosign.pub before a build; one without a digest is refused
(image_tools/dockerfile.py).
- bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners,
checked against the release checksums.
- actions/verify-base, judge, sign wrap them for the workflows.
- cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret,
the key rotated on 2026-10-22.
Christian Manivong