From b80148f30a98ff3e02f317a60ace51d8caf318d6 Mon Sep 17 00:00:00 2001 From: egibs <20933572+egibs@users.noreply.github.com> Date: Mon, 27 Jul 2026 01:34:27 +0000 Subject: [PATCH] chore(oscap): re-pin CA bundle hash and fixture base-image digests Atomically updates the CA bundle SHA in the OSCAP datastream, the digest-pinned FROM lines in tests/e2e/fixtures/*/Dockerfile, and the pinned wolfi-base digest in the offline harness test (TestParseWolfiBaseRef) so the three values can never drift out of sync (which would flake the CertificateAudit E2E assertions or break the offline unit tests). Image: cgr.dev/chainguard/wolfi-base:latest Digest: sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e CA SHA: 61efbd6d3f829f71039c57b29dd37d15ac7f33c4ece861aaef8c7d7a519cd1d9 Signed-off-by: github-actions[bot] --- tests/e2e/fixtures/baseline-clean/Dockerfile | 2 +- tests/e2e/fixtures/cabundle-tampered/Dockerfile | 2 +- tests/e2e/fixtures/non-https-repo/Dockerfile | 2 +- tests/e2e/fixtures/remote-access-violation/Dockerfile | 2 +- tests/e2e/fixtures/shadow-active-password/Dockerfile | 2 +- tests/oscap-offline/internal/scan/fixtures_test.go | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/e2e/fixtures/baseline-clean/Dockerfile b/tests/e2e/fixtures/baseline-clean/Dockerfile index 7f14ac5..7873e53 100644 --- a/tests/e2e/fixtures/baseline-clean/Dockerfile +++ b/tests/e2e/fixtures/baseline-clean/Dockerfile @@ -12,7 +12,7 @@ # - CertificateAudit: /etc/ssl/certs/ca-certificates.crt matches the pinned SHA-256 # # Expected result: a clean scan with no failures attributable to these rules. -FROM cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795 +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e # Suppress OrbStack's automatic root-CA injection so the baked CA bundle in # the image is identical to the upstream wolfi-base bundle. Without this, the diff --git a/tests/e2e/fixtures/cabundle-tampered/Dockerfile b/tests/e2e/fixtures/cabundle-tampered/Dockerfile index 794a766..4d5bf03 100644 --- a/tests/e2e/fixtures/cabundle-tampered/Dockerfile +++ b/tests/e2e/fixtures/cabundle-tampered/Dockerfile @@ -6,7 +6,7 @@ # Appends a bogus trust anchor to /etc/ssl/certs/ca-certificates.crt so # the SHA-256 of the baked bundle diverges from the pinned value the # CertificateAudit OVAL check expects. The rule must FAIL. -FROM cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795 +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e LABEL dev.orbstack.add-ca-certificates=false diff --git a/tests/e2e/fixtures/non-https-repo/Dockerfile b/tests/e2e/fixtures/non-https-repo/Dockerfile index d5de89f..c32d561 100644 --- a/tests/e2e/fixtures/non-https-repo/Dockerfile +++ b/tests/e2e/fixtures/non-https-repo/Dockerfile @@ -6,7 +6,7 @@ # Injects a non-https repository URL into /etc/apk/repositories so the # textfilecontent54 pattern ^(?!\s*#)(?!.*https://).+$ must match at # least one line and the rule must FAIL. -FROM cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795 +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e LABEL dev.orbstack.add-ca-certificates=false diff --git a/tests/e2e/fixtures/remote-access-violation/Dockerfile b/tests/e2e/fixtures/remote-access-violation/Dockerfile index cef922a..2fa4c13 100644 --- a/tests/e2e/fixtures/remote-access-violation/Dockerfile +++ b/tests/e2e/fixtures/remote-access-violation/Dockerfile @@ -7,7 +7,7 @@ # RemoteAccessServices OVAL check must detect the package record under # /usr/lib/apk/db/installed and every RemoteAccessServices-backed rule # must FAIL. -FROM cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795 +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e LABEL dev.orbstack.add-ca-certificates=false diff --git a/tests/e2e/fixtures/shadow-active-password/Dockerfile b/tests/e2e/fixtures/shadow-active-password/Dockerfile index 0ba409e..5453e23 100644 --- a/tests/e2e/fixtures/shadow-active-password/Dockerfile +++ b/tests/e2e/fixtures/shadow-active-password/Dockerfile @@ -9,7 +9,7 @@ # "$"-prefixed hashes and would have let this slip through; the corrected # ^[^:]+:(?![!*])[^:\n]*: pattern matches any unlocked field, so the # UserPasswordConfigured rule must FAIL. -FROM cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795 +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e LABEL dev.orbstack.add-ca-certificates=false diff --git a/tests/oscap-offline/internal/scan/fixtures_test.go b/tests/oscap-offline/internal/scan/fixtures_test.go index 2512407..d3f8fba 100644 --- a/tests/oscap-offline/internal/scan/fixtures_test.go +++ b/tests/oscap-offline/internal/scan/fixtures_test.go @@ -624,7 +624,7 @@ func TestSCERulesExcludedFromMatrix(t *testing.T) { func TestParseWolfiBaseRef(t *testing.T) { t.Parallel() - const pinned = wolfiBaseRepo + ":latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795" + const pinned = wolfiBaseRepo + ":latest@sha256:003627df3c1e1bba0c4116afcddb314aca9594ee2328c7e876a8081a6c988b2e" realDockerfile, err := os.ReadFile(filepath.Clean(filepath.Join("..", "..", "..", "e2e", "fixtures", "baseline-clean", "Dockerfile"))) if err != nil {