mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
Josh Creek
25 lines
1.1 KiB
Markdown
25 lines
1.1 KiB
Markdown
# Multiplayer artifact supply chain
|
|
|
|
Container references in the repository are immutable `@sha256:` digests. The
|
|
base manifests may contain a zero digest only as a deployment template; a
|
|
release overlay must replace it with a registry-resolved digest and run the
|
|
checker with `--require-concrete`.
|
|
|
|
The release pipeline must, for every image and exported server artifact:
|
|
|
|
1. generate and retain an SBOM tied to the exact digest;
|
|
2. scan OS and application dependencies and fail on a critical or disallowed
|
|
vulnerability;
|
|
3. sign the image and provenance with the offline release authority, and
|
|
verify both at cluster admission; and
|
|
4. publish the digest, SBOM, scan result, signature and provenance as one
|
|
immutable release record.
|
|
|
|
Critical vulnerability fixes are triaged immediately and a patched release is
|
|
cut within 24 hours of confirmation. A release with an unaccepted critical
|
|
finding or unverifiable signature is not eligible for admission.
|
|
|
|
`python3 scripts/verify_supply_chain.py` is the dependency-free repository
|
|
guard. Registry signing/scanning and admission require the release environment
|
|
and are intentionally not simulated by this local check.
|