Forward-merge release/26.08 into main - #905
Merged
Merged
Conversation
Feedback from James is that the purpose of this PR was not clear, and that the summary was pretty heavy on jargon. The jargon did not phase me, presumably because I've been swimming in this stuff for longer/deeper. The purpose of this PR is to surface image contents in better ways. As part of our release process, the images that this repo produces get scanned with various tools to find CVEs and malware. These tools are prone to misidentifying some components, and that has been especially true for conda packages historically. We have frequently needed to override the detected package lists/SBOM via JIRA tickets with our security tools team. Part of filing those tickets is providing them with the actual contents of the images, which we often have to discover by looking into build logs. That's where this PR comes in. Instead of looking at build logs, we should export our known environment information to a more readily usable location. In theory, this could replace the scans, but I think it's better to keep doing the scans and use our manifests as validation/correction where necessary. That keeps us in line with how security tools team manages other projects. **Posted by Codex (GPT-5.6) on behalf of Michael Sarahan. Treat this description as LLM-generated.** ## Summary Add a signed, OCI-referrer RAPIDS image provenance manifest for published `base` and `notebooks` image digests. - Export exact `conda-meta` package facts through minimal BuildKit targets rather than downloading image layers. - Attach a platform-specific manifest to every pushed architecture image, then attach a multiarch index manifest that links those platform records. - Record the image digest, platform, source SHA, workflow URL, build arguments, and conda package name/version/build/channel/source URL. - Keylessly sign each attached OCI artifact with GitHub Actions OIDC and Cosign. - Keep pURLs explicitly unmapped until a verified upstream mapping is available; this intentionally does not invent `pkg:conda/...` identifiers. ## Relationship to #805 #805 is complementary. It generates and embeds a CycloneDX SBOM in the final image. This change makes digest-bound build facts discoverable as registry metadata and supplies the platform-to-multiarch relationship needed by scan triage without pulling image layers. If #805 lands, the preferred follow-up is to add its SBOM digest/reference to this manifest rather than maintain a separate provenance model. Its Dockerfile stage renaming will require a small conflict resolution in this branch's `provenance-base` and `provenance-notebooks` export targets.
This reverts commit f33fc76. This broke and should not have been merged into the release branch. Revert and re-do on main. See #901 and #902 for more info. Authors: - Mike Sarahan (https://github.com/msarahan) Approvers: - James Lamb (https://github.com/jameslamb) URL: #903
Contributor
Author
|
SUCCESS - forward-merge complete. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-merge triggered by push to release/26.08 that creates a PR to keep main up-to-date. If this PR is unable to be immediately merged due to conflicts, it will remain open for the team to manually merge. See forward-merger docs for more info.