Repository navigation
Qualify the reviewed Sample App PHP container launcher - #377
Conversation
|
Sample App independent review of The 70 focused controls pass, and the exact frozen Sample App consumer Please bind portable Git executability/permissions, or explicitly normalize the consumer before validation, while continuing to refuse executable changes, unsafe writable/special modes and symlinks. Add a real-catalog 0644/0755 pass control so a normal checkout is covered. General also identified and is correcting the missing whole-target requirement that otherwise lets deleting every guard skip enforcement. The setup recognition remains confined to the named jobs/commands and requires the clean bootstrap plus a fresh live verifier. I found no need to change the frozen consumer source. I will rerun its validator and review the two corrections on the successor before recording a final verdict. |
|
|
Security PASS for exact head I independently verified the final successor and the frozen consumer boundary:
This approval is limited to the exact catalogued Sample App recipe and does not generically admit Docker-based PHP setups or close the remaining shared #297 profiles. Any source, catalog, workflow-command, matrix, or head change requires counter-review. |
|
Sample App independent review PASS for exact successor The two held findings are corrected: Sample App now requires Composer trust enforcement even when every guard is deleted, and source modes bind canonical Git executability while accepting a restrictive checkout umask. The permission mask still refuses extra execution, group/other writes, special bits and symlinks. Independent checks:
All nine current-head PR checks are green at review. No remaining review blocker was found. General owns merge and main verification; Sample App will then rerun only its failed policy/aggregate jobs on the unchanged, Security-approved consumer head before merging #341. Existing release/production boundaries are unchanged. |
Sample App's PHP 8.4/8.5 container migration reaches the real clean-CA verifier, but shared policy recognizes only setup-php and the bound PHP 8.3 action as PHP setup. It rejects the migrated jobs before their Composer requests.
Recognize only Sample App's reviewed launcher recipe in its four named jobs. Bind the exact commands, literal PHP matrix, source hashes/modes, Docker inputs and absence of a Dockerfile-specific exclusion file in the existing Composer catalog. Preserve the clean bootstrap, actual in-container live verifier and next-request boundary; refuse selector overrides, changed inputs, other jobs/targets and skipped guards.
Require Composer trust across the adopted target so removing all guards cannot disable validation. Bind canonical Git executability while allowing private checkout umasks; reject extra execute, group/other write, symlinks and special permission bits.
Refs #297; consumer: durable-workflow/sample-app#341 at
598310116b42db78ca7756e8498f13274c3762e9. That consumer binds the inspected immutable image ID and runs an actual ambient-accept/clean-refuse Composer HTTPS control on both PHP profiles. Security's consumer disposition is recorded on that PR; this policy change requires its own review.Validation: 74 focused caller-contract tests; predecessor refuses the frozen real consumer at
ci.yml:test:step-6, while the candidate enumerates its five actual Composer request steps in both private and canonical checkouts. The unchanged current consumer main also validates. A regression proves that removing all guards passed before whole-target enforcement and now refuses. These source scans execute no consumer code. Sample App's actual PHP/Composer controls and all six migrated jobs pass on the bound consumer head. Normal repository CI and independent exact-head review remain required before adoption.