4 Commits

Include renames

Author	SHA1	Message	Date
Christian Manivong	e0de85ba45	docs: the attestations are on the platform image, not the index ... Checked against netork's first signed images (main-142912c): cosign verify on the tag succeeds, verify-attestation on it finds only the signature, because BuildKit pushes even one platform as an index with its provenance manifest. The CIS result and SBOM are on the linux/amd64 image.	2026-10-22 18:48:49 +02:00
Christian Manivong	ae39af4665	feat: bump moves here, and verify-base takes images by name ... - image_tools/bump.py from base-os, with an action. base-python used it from a pinned checkout of base-os, with the bot's token; one place serves both. A dependent whose workflow does not exist (netork's ui-nightly.yml, on 2026-10-22) is named and the others go on; the run fails at the end, as for a repository the token cannot see. bump_all holds that loop, tested. - verify-base takes refs besides Dockerfiles: base-python builds FROM ${BASE_OS}, which its nightly sets, and copies CPython from Docker's python:3.12-slim, which is not signed with netOrk's key.	2026-10-22 17:51:05 +02:00
Christian Manivong	9232b54c6d	feat: the verdict on a rebuild as an action too ... base-os's nightly asks netOrk's matcher whether a rebuild improves on the pin (image_tools/verify.py). As an action, a workflow needs nothing of this repository but the pinned commit: no install, no checkout. A verdict that could not be reached fails the step, as it does in base-os since the two nights with an empty NETORK_LICENSE_KEY.	2026-10-22 16:23:51 +02:00
Christian Manivong	d139d66c3d	feat: judge, sign and verify netOrk's images in one place (NetOrk/netork#1390) ... The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived in NetOrk/base-os, the head of the chain. Every link below it -- base-python, engine, ui, satellite, the service images -- needs the same, so the tools move here, and every image repository pins them by commit. - image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The image's own repository holds its cis.toml and packages.allow; both default to the working directory. - bin/sign.sh signs whatever platforms a reference holds: base-os's index of amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest (image_tools/platforms.py). - bin/verify-base.sh checks every FROM image of a Dockerfile against cosign.pub before a build; one without a digest is refused (image_tools/dockerfile.py). - bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners, checked against the release checksums. - actions/verify-base, judge, sign wrap them for the workflows. - cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret, the key rotated on 2026-10-22.	2026-10-22 16:23:00 +02:00