Skip to content

Commit 86ae2f0

Browse files
committed
Fix CI image builds and harden scanner findings
1 parent cfe409e commit 86ae2f0

11 files changed

Lines changed: 291 additions & 148 deletions

File tree

docs/test-counts.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"generated": "2026-04-28",
33
"go": {
44
"airlock": 11,
5-
"registry": 21,
5+
"registry": 22,
66
"tool-firewall": 15,
77
"gpu-integrity-watch": 62,
88
"mcp-firewall": 71,
@@ -11,7 +11,7 @@
1111
"integrity-monitor": 50,
1212
"incident-recorder": 97
1313
},
14-
"go_total": 427,
15-
"python_total": 1117,
16-
"grand_total": 1544
14+
"go_total": 428,
15+
"python_total": 1119,
16+
"grand_total": 1547
1717
}

files/scripts/build-services.sh

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,15 @@ for scanner in ${SCANNERS}; do
341341
echo " Installing: ${scanner}"
342342
scanner_venv="${SCANNER_ROOT}/${scanner}"
343343
scanner_package="$(scanner_package_spec "${scanner}")"
344-
if python3 -m venv "${scanner_venv}" && \
344+
scanner_python="${SCANNER_PYTHON:-python3}"
345+
if [ "${scanner}" = "modelscan" ]; then
346+
# Upstream modelscan 0.8.x currently declares Python <3.13. Keep it
347+
# isolated on Fedora's still-supported Python 3.12 until the audited
348+
# fork is intentionally integrated.
349+
scanner_python="${MODELSCAN_PYTHON:-python3.12}"
350+
fi
351+
if command -v "${scanner_python}" >/dev/null 2>&1 && \
352+
"${scanner_python}" -m venv "${scanner_venv}" && \
345353
"${scanner_venv}/bin/python" -m pip install --no-cache-dir --upgrade \
346354
pip==26.0.1 setuptools==82.0.1 wheel==0.46.2 && \
347355
"${scanner_venv}/bin/python" -m pip install --no-cache-dir "${scanner_package}" && \

recipes/recipe.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ modules:
1818
- cosign
1919
- jq
2020
- python3
21+
- python3.12 # modelscan 0.8.x declares Python <3.13
2122
- python3-pip
2223
- python3-pyyaml
2324
- python3-flask

services/diffusion-worker/Containerfile.sandbox

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
ARG COMPUTE=cpu
22
ARG TORCH_CUDA_VERSION=2.6.0+cu124
33
ARG TORCH_ROCM_VERSION=2.5.1+rocm6.1
4-
ARG TORCH_CPU_VERSION=2.6.0+cpu
4+
ARG TORCH_CPU_VERSION=2.11.0+cpu
55
ARG TORCHVISION_CUDA_VERSION=0.21.0+cu124
66
ARG TORCHVISION_ROCM_VERSION=0.20.1+rocm6.1
7-
ARG TORCHVISION_CPU_VERSION=0.21.0+cpu
8-
ARG IPEX_CPU_VERSION=2.6.0
7+
ARG TORCHVISION_CPU_VERSION=0.26.0+cpu
8+
ARG IPEX_CPU_VERSION=2.11.0
99

1010
FROM cgr.dev/chainguard/python:latest-dev@sha256:2c0fbbac86b72ebb4bfee15b64d8cd5fd6b49dfe7bb279b5c9f193198a84c1c9 AS build
1111

services/diffusion-worker/app.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -392,9 +392,9 @@ def generate_image():
392392
},
393393
})
394394

395-
except Exception as e:
395+
except Exception:
396396
log.exception("image generation failed")
397-
return jsonify({"error": str(e)}), 500
397+
return jsonify({"error": "image generation failed"}), 500
398398

399399

400400
# --- Video Generation ---
@@ -523,9 +523,9 @@ def generate_video():
523523
},
524524
})
525525

526-
except Exception as e:
526+
except Exception:
527527
log.exception("video generation failed")
528-
return jsonify({"error": str(e)}), 500
528+
return jsonify({"error": "video generation failed"}), 500
529529

530530

531531
# --- Image-to-Image ---
@@ -613,9 +613,9 @@ def generate_img2img():
613613
"elapsed_seconds": elapsed,
614614
})
615615

616-
except Exception as e:
616+
except Exception:
617617
log.exception("img2img generation failed")
618-
return jsonify({"error": str(e)}), 500
618+
return jsonify({"error": "img2img generation failed"}), 500
619619

620620

621621
# --- Unload / Memory Management ---

services/quarantine/quarantine/pipeline.py

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,20 @@ def _http_urlopen(target, timeout: int = 30):
4949
raise URLError(f"unsupported URL scheme: {scheme or 'none'}")
5050
return urlopen(target, timeout=timeout) # nosec B310
5151

52+
53+
def _source_registry_host(source_url: str) -> str:
54+
"""Extract a registry host from a URL or image reference."""
55+
raw = str(source_url or "").strip()
56+
if not raw:
57+
return ""
58+
parsed = urlparse(raw if "://" in raw else f"//{raw}")
59+
return (parsed.hostname or "").lower().rstrip(".")
60+
61+
62+
def _supports_cosign_provenance(source_url: str) -> bool:
63+
host = _source_registry_host(source_url)
64+
return host in {"ghcr.io", "docker.io"} or host.endswith(".docker.io")
65+
5266
MODELS_LOCK_PATH = Path(
5367
os.getenv("MODELS_LOCK_PATH", "/etc/secure-ai/policy/models.lock.yaml")
5468
)
@@ -533,7 +547,7 @@ def check_provenance(artifact_path: Path, source_url: str) -> dict:
533547
except (FileNotFoundError, subprocess.TimeoutExpired):
534548
has_cosign = False
535549

536-
if has_cosign and ("ghcr.io" in source_url or "docker.io" in source_url):
550+
if has_cosign and _supports_cosign_provenance(source_url):
537551
try:
538552
result = subprocess.run(
539553
["cosign", "verify", "--key", "/etc/secure-ai/keys/cosign.pub", source_url],

0 commit comments

Comments
 (0)