[rmcdaniel]

Part of #295 (CVE-2026-109518: APT follows a redirect on retry, then installs a swapped package as root).

ci.yml (contracts) and sonar.yml (analysis) run shivammathur/setup-php on ubuntu-latest. setup-php can call apt-get itself: its package-repair, extension and packaged-PHP paths do. Hosted runner images aren't pinned, so the runner's apt version can't be checked ahead of time.

Change

• Both jobs write Acquire::Retries "0"; to /etc/apt/apt.conf.d/99-no-retries before setup-php. Same pattern as cli#121 and waterline#300. The step sits after bootstrap-patched-pip and before setup-php, so the Composer-trust order is unchanged.
• Needs Security's exact-source review: scripts/protected_policy_context.py gets a new REVIEWED_APT_NO_RETRIES_SOURCE_CI_SUCCESSORS entry. It holds the new exact SHA-256 of each workflow: ci.yml 760de748…31719fc, sonar.yml f7fad836…55038ed9c749fdfcd86e1312bfca3cced. Both workflows are reviewed complex workflows, so any byte change needs a registered identity. The earlier identities stay registered.
• New tests/test_apt_no_retries.py, collected by tests.test_ci_trust, so neither workflow's unittest module list changes. It fails if any job reaches shivammathur/setup-php or a networked APT step before that line. It also has a control for a late or missing line.

Unchanged:

• qualify-linux-php-initial.yml and qualify-linux-php-ubuntu24.yml use the local bound setup-php-linux. Its derived runtime removes or refuses setup-php's APT paths (scripts/php_linux_recipe.py GUARDS, php_linux_bootstrap.installer_source).
• qualification/vendor/setup-php-f3e473d/*.sh are reference bytes that are compared, never executed.

Local results

• The workflow's unittest list: 815 tests. The only failure is test_pip_cert_alone_is_additive_but_exported_file_and_empty_directory_refuse, which fails the same way on unmodified main here.
• check_public_boundary.py passes.
• qualification_policy.py validate --target github-control-plane passes.

🤖 Generated with Claude Code

[rmcdaniel]

Depends on #374. Validate native policy subject fails here as expected: it checks this PR's ci.yml/sonar.yml bytes against main's protected_policy_context.py registry, which doesn't have them yet. #374 registers exactly these bytes (760de748…, f7fad836…) and nothing else. After #374 merges, rebase this PR so the registry hunk drops out, then re-run the check.

[rmcdaniel]

Security PASS at 617778f, conditional on the branch update after #374. Each workflow gains one step, echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries, right before the pinned setup-php, and nothing else changes. tests/test_apt_no_retries.py guards it. The bytes equal the hashes registered in #374, which accounts for the expected 'Validate native policy subject' failure until #374 merges. After the update, the diff should contain only the two workflows and the tests. If anything else changes, send it back to me.

[rmcdaniel]

Security: confirmed at db27d1c. Its parents are 617778f and main 114ad7d (the #374 merge), and nothing changed relative to 617778f. The PR's diff against main is only ci.yml, sonar.yml and the two test files. The workflow bytes (760de748… / f7fad836…) equal the hashes #374 registered. My PASS holds at this head, conditional on green CI.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud