From 8621982a37a1fc74e9cc073212fe446e2153ab8b Mon Sep 17 00:00:00 2001 From: RSI smoke Date: Thu, 22 Oct 2026 16:09:00 -0600 Subject: [PATCH 1/2] Patch Hono and publish verified runtime images after CI --- .github/workflows/container.yml | 44 +++++++++++++++++++++++++++++++++ docker/Dockerfile | 1 + package-lock.json | 12 ++++----- 3 files changed, 51 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/container.yml diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml new file mode 100644 index 0000000..a121e67 --- /dev/null +++ b/.github/workflows/container.yml @@ -0,0 +1,44 @@ +name: Publish verified container +on: + workflow_run: + workflows: [ci] + branches: [master] + types: [completed] +permissions: + contents: read + packages: write +concurrency: + group: headlesscode-container + cancel-in-progress: false +jobs: + publish: + if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'master' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.workflow_run.head_sha }} + - name: Require tested current master + env: + SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} + run: | + git fetch origin master + test "$(git rev-parse HEAD)" = "$SOURCE_SHA" + test "$(git rev-parse origin/master)" = "$SOURCE_SHA" + - name: Build and verify the runtime image + env: + SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} + run: | + image="ghcr.io/capsize-games/headlesscode:sha-$SOURCE_SHA" + docker build --pull -f docker/Dockerfile --label "org.opencontainers.image.revision=$SOURCE_SHA" --label "org.opencontainers.image.source=https://github.com/Capsize-Games/headlesscode" -t "$image" . + test "$(docker run --rm --entrypoint node "$image" --version)" = v22.23.4 + docker run --rm --entrypoint headlesscode "$image" --version + docker run --rm --entrypoint node "$image" -e 'const fs=require("fs"),c=require("crypto");const p=fs.readFileSync("/etc/ssl/certs/ca-certificates.crt","utf8");for(const s of p.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g)||[]){const x=new c.X509Certificate(s);if(/CN=(emSign ECC Root CA - G3|AAA Certificate Services)(\n|$)/.test(x.subject))throw Error("Revoked CA root retained");}' + - name: Publish the tested image + env: + SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} + GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GHCR_USER: ${{ github.actor }} + run: | + printf '%s' "$GHCR_TOKEN" | docker login ghcr.io --username "$GHCR_USER" --password-stdin + docker push "ghcr.io/capsize-games/headlesscode:sha-$SOURCE_SHA" diff --git a/docker/Dockerfile b/docker/Dockerfile index ffdae59..f79c931 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -46,6 +46,7 @@ FROM node:22.23.4-bookworm-slim # recent release so detail queries (issue/pr view) keep working. RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates curl git \ + && apt-get upgrade -y ca-certificates \ && curl -fsSL https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_linux_amd64.tar.gz -o /tmp/gh.tar.gz \ && tar -xzf /tmp/gh.tar.gz -C /tmp \ && install -m 0755 /tmp/gh_2.98.0_linux_amd64/bin/gh /usr/local/bin/gh \ diff --git a/package-lock.json b/package-lock.json index 43df958..a1480fd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2060,9 +2060,9 @@ } }, "node_modules/hono": { - "version": "4.13.10", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.10.tgz", - "integrity": "sha512-dQuLsa5oO+47QVMVMaaD9cIv8ctmVtK1iRvwWngkfloFJMeFeuoUFDswIqZGxmGX3hrRzREgEArjkK9OgsQEhA==", + "version": "4.13.13", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz", + "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==", "license": "MIT", "engines": { "node": ">=16.9.0" @@ -2118,9 +2118,9 @@ "license": "ISC" }, "node_modules/ip-address": { - "version": "10.7.2", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz", - "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==", + "version": "10.7.4", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz", + "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==", "license": "MIT", "engines": { "node": ">= 12" From ef4c2a2120adc6f0794310a100c72ef7964a8b20 Mon Sep 17 00:00:00 2001 From: RSI smoke Date: Thu, 22 Oct 2026 16:16:26 -0600 Subject: [PATCH 2/2] Keep distrusted roots disabled in bookworm runtime stores --- docker/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docker/Dockerfile b/docker/Dockerfile index f79c931..ae6167d 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -47,6 +47,8 @@ FROM node:22.23.4-bookworm-slim RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates curl git \ && apt-get upgrade -y ca-certificates \ + && sed -i '/^mozilla\/emSign_ECC_Root_CA_-_G3.crt$/s/^/!/; /^mozilla\/Comodo_AAA_Services_root.crt$/s/^/!/' /etc/ca-certificates.conf \ + && update-ca-certificates --fresh \ && curl -fsSL https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_linux_amd64.tar.gz -o /tmp/gh.tar.gz \ && tar -xzf /tmp/gh.tar.gz -C /tmp \ && install -m 0755 /tmp/gh_2.98.0_linux_amd64/bin/gh /usr/local/bin/gh \