Repository navigation
fix: install osv-scanner for air-gap; add feeds update command; drop redundant preflight - #41
Merged
pshickeydev merged 1 commit intoOct 28, 2026
Conversation
…redundant preflight The traust v0.43.0 tag moved osv-scanner to adopter-provided (consumers: [] in external-tools.yaml), so the secure-code-audit toolchain profile no longer installs it. The toolkit-plus-feeds image is itself the adopter: it now installs osv-scanner directly from the GitHub release (pinned to 2.7.0) in the assemble stage. Add `traust-cli feeds update [--max-age 120h] [--timeout 90s]`: refreshes the grype DB (staleness-checked) and OSV offline databases at container start. Fails open on every error path — network failures, tool crashes, and timeouts log a warning and leave the baked databases in place. OSV refresh correctness is mtime-based: pre-existing baked DBs that were not rewritten are reported as unchanged fallbacks, not falsely as refreshed. The entrypoint wrapper calls `traust-cli feeds update` with all output to stderr (preserving command stdout), bounded by `timeout` (default 120s). SKIP_FEED_UPDATE=1 bypasses entirely. Remove ecosystem-cert-preflight-checks from the traust-cli push and pull-request pipelines. The traust-cli image is FROM scratch (a static Go binary with no base OS), which fails the BasedOnUbi, HasNoProhibitedPackages, and HasModifiedFiles preflight checks. The traust-enterprise-contract integration test scenario already handles scratch images and passes. Assisted-by: Claude Opus 4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three fixes for the traust v0.43.0 container build:
Install osv-scanner directly for the air-gapped offline database step.
Since v0.43.0 osv-scanner is adopter-provided (
consumers: []inexternal-tools.yaml), so the toolchain profile no longer installs it.This image is itself the adopter — it now fetches the binary from the
GitHub release (pinned to 2.7.0, matching the
expectedversion inexternal-tools.yaml).traust-cli feeds update— new command that refreshes the grype DB(staleness-checked via
--max-age, default 5 days) and OSV offlinedatabases at container start. Fails open on every error path. OSV refresh
uses mtime comparison to distinguish actually-refreshed DBs from
unchanged baked fallbacks. Context deadline (
--timeout, default 90s)prevents hanging tools from blocking startup. All output goes to stderr.
The entrypoint wrapper calls
traust-cli feeds update >&2 || truebeforeexec traust-cli "$@", bounded bytimeout(default 120s).SKIP_FEED_UPDATE=1bypasses entirely.Remove
ecosystem-cert-preflight-checksfrom thetraust-clipushand pull-request pipelines. The traust-cli image is
FROM scratch(staticGo binary), which fails
BasedOnUbi,HasNoProhibitedPackages, andHasModifiedFiles. Thetraust-enterprise-contractintegration testscenario handles scratch images and already passes.
Tests
10 tests in
internal/feeds/:"refreshed"), actual-refresh (mtime advances → "refreshed"), no-databases,
context-timeout
Verified with real
osv-scanneragainst the baked Go DB from the old image:--download-offline-databasesrefreshes stale files (mtime and content bothchanged).
This PR description is AI-generated (Claude Opus 4).