Merge branch 'main' into refactor/unify-topo-sort

Author: mchmarny

.github/workflows/rekor-monitor.yaml

@@ -12,17 +12,39 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Transparency-log monitoring for AICR's release supply chain.
+# Transparency-log monitoring for AICR's release supply chain, on Rekor v2.
 #
-# Hourly, this calls the upstream sigstore/rekor-monitor reusable workflow to:
-#   - Consistency: verify the public-good Rekor log stays append-only between
-#     runs (checkpoint persisted as the `checkpoint` artifact).
-#   - Identity: scan entries added since the last run for AICR's release signing
-#     identity. An entry under that identity that a release did not produce
-#     signals OIDC/key compromise.
+# Hourly, this calls the upstream sigstore/rekor-monitor reusable workflow to do
+# both checks in a single job (see internal/cmd MonitorLoop upstream):
+#   - Consistency: prove the Rekor v2 log stays append-only between runs (Merkle
+#     consistency from the last checkpoint to the current tree head). O(log n),
+#     always finishes in seconds. Checkpoint persisted as the `checkpoint`
+#     artifact.
+#   - Identity: scan entries added since the last checkpoint for AICR's release
+#     signing identity. An entry under that identity that a release did not
+#     produce signals OIDC/key compromise.
 # On any failure (consistency break or matched identity), it files an issue
 # (`file_issue: true`).
 #
+# Why v2 (NVIDIA/aicr#1623). Identity monitoring is a linear scan of every entry
+# added since the last checkpoint (Rekor's index cannot be queried by
+# certificate SAN, and our keyless release identity has no email or fixed key).
+# On the Rekor **v1** firehose that scan runs ~50x slower than the log grows, so
+# it can never keep up in a bounded CI job: the earlier v1 config timed out
+# every run and never completed a single scan. Rekor **v2** is tile-based: bulk
+# 256-entry reads make a single-worker scan outpace the log, so identity
+# monitoring becomes one cheap job. This rides on release signing having moved to
+# v2 in NVIDIA/aicr#1650 (only entries actually in v2 can be watched there).
+#
+# Selecting v2. The monitor picks its Rekor API version by matching its `url`
+# against the services in the TUF-distributed Sigstore SigningConfig; a match on
+# a v2 service switches it to v2. The resolve-v2-shard job computes that URL at
+# run time from the same signing config release signing uses (via `aicr trust
+# update --emit-signing-config`), so we never hardcode a shard and yearly shard
+# rotation (log2025-1 -> log2026-1 -> ...) needs no change here. Once v2 is
+# selected the *full* shard set is auto-discovered from the SigningConfig and
+# refreshed each run.
+#
 # The monitored identity is AICR's release signer (see .goreleaser.yaml and
 # .github/workflows/on-tag.yaml): the GitHub Actions OIDC SAN for on-tag.yaml,
 # issued by token.actions.githubusercontent.com.
@@ -52,8 +74,38 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # Resolve the current Rekor v2 shard from the Sigstore signing config, so the
+  # monitor always selects v2 against a live shard without a hardcoded URL. We
+  # read the same TUF-distributed signing config that release signing resolves
+  # (`aicr trust update --emit-signing-config`, see pkg/trust), so the monitor
+  # provably watches where releases actually write, and yearly shard rotation
+  # (log2025-1 -> log2026-1 -> ...) needs no change here.
+  resolve-v2-shard:
+    name: Resolve current Rekor v2 shard
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # checkout to build the aicr CLI
+    outputs:
+      url: ${{ steps.resolve.outputs.url }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
+        with:
+          go-version-file: go.mod
+      - id: resolve
+        name: Resolve v2 shard URL from the signing config
+        run: |
+          set -euo pipefail
+          go run ./cmd/aicr trust update --emit-signing-config signing-config.json
+          # Newest currently-listed v2 shard (majorApiVersion 2). Any live v2
+          # shard selects v2; the monitor then discovers the full set from TUF.
+          url="$(jq -er '[.rekorTlogUrls[] | select(.majorApiVersion == 2)] | sort_by(.validFor.start) | last | .url' signing-config.json)"
+          echo "Resolved Rekor v2 shard: $url"
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+
   monitor:
-    name: AICR release identity + log consistency
+    name: AICR release identity + log consistency (Rekor v2)
+    needs: resolve-v2-shard
     permissions:
       contents: read  # checkout performed by the reusable workflow
       issues: write   # file an issue on monitoring failure
@@ -64,6 +116,10 @@ jobs:
       # Must exceed the hourly cron so the consistency checkpoint never expires
       # between runs; wide enough to survive a brief scheduling pause.
       artifact_retention_days: 30
+      # Rekor v2 shard resolved at run time from the signing config (see the
+      # resolve-v2-shard job). Selecting a v2 service switches the monitor to v2;
+      # it then auto-discovers the full shard set from TUF.
+      url: ${{ needs.resolve-v2-shard.outputs.url }}
       config: |
         monitoredValues:
           certIdentities:

.github/workflows/renovate.yaml

@@ -105,7 +105,7 @@ jobs:
       # Keep this digest in lockstep with RENOVATE_VALIDATOR_IMAGE in
       # the Makefile.
       - name: Run Renovate
-        uses: renovatebot/github-action@b50d2ba2bd928235abdcc14d06dfafc217f1c565  # v46.1.18
+        uses: renovatebot/github-action@22e0a16091fc706b04affe6ae53d5e3358ac4023  # v46.1.19
         with:
           renovate-version: '43@sha256:00185c0d63462acec8331cc9a94dcd74a763f2765fca0edcc3ff568af1dc8104'
         env:

.openvex.json

@@ -3,8 +3,8 @@
   "@id": "https://github.com/NVIDIA/aicr/.openvex.json",
   "author": "NVIDIA AICR maintainers",
   "role": "document creator",
-  "timestamp": "2026-07-09T00:00:00Z",
-  "version": 6,
+  "timestamp": "2026-07-13T00:00:00Z",
+  "version": 7,
   "tooling": "manual; aiperf-bench statements verified against aiperf v0.7.0 source; aicr statement reachability verified by source inspection (CGO-free ko build, no libssl linkage); aicr-gate statements suppress CVEs in the embedded upstream kyverno/chainsaw binary (affected packages identified via vuln.go.dev), justified by chainsaw's ephemeral cluster-internal readiness-gate usage",
   "statements": [
     {
@@ -306,6 +306,29 @@
       "justification": "vulnerable_code_not_in_execute_path",
       "impact_statement": "The attack requires parsing a crafted (attacker-controlled) XML document through xml.parsers.expat or xml.etree.ElementTree to trigger hash flooding. AICR invokes aiperf-bench exclusively as `aiperf profile <text-LLM> --url <endpoint>` (validators/performance/inference_perf_constraint.go). That subcommand communicates with the inference endpoint via JSON over HTTP only; all data transport uses aiohttp + orjson/msgspec. aiperf v0.7.0's declared dependencies contain no XML parsing libraries \u2014 the runtime stack (aiohttp, msgspec, orjson, numpy, transformers, uvicorn, fastapi) is entirely JSON/binary-based. While xml.parsers.expat is present in the Python 3.13 stdlib image, no attacker-controlled XML document can enter the aiperf profile execution path, making the hash-flooding trigger unreachable."
     },
+    {
+      "vulnerability": {
+        "name": "CVE-2026-15308",
+        "description": "cpython CPU-exhaustion DoS in html.parser.HTMLParser incremental feed() via repeated unterminated markup declarations (PSF-2026-33, CWE-407, High CVSS 7.5/8.7). Fix merged to the cpython 3.13 branch on 2026-07-04 (PR #153040) but as of 2026-07-13 no released CPython contains it — v3.13.14 (2026-06-10), v3.14.6, and v3.15.0b3 all predate the fix, so no base-image bump can remediate yet."
+      },
+      "products": [
+        {
+          "@id": "pkg:oci/aicr-aiperf-bench",
+          "identifiers": {
+            "purl": "pkg:oci/aicr-aiperf-bench"
+          }
+        },
+        {
+          "@id": "pkg:oci/aiperf-bench",
+          "identifiers": {
+            "purl": "pkg:oci/aiperf-bench"
+          }
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "The trigger requires incrementally feeding attacker-controlled HTML containing repeated unterminated markup declarations into html.parser.HTMLParser.feed(). aiperf v0.7.0 source contains zero references to html.parser, HTMLParser, or any html stdlib import (verified with `grep -rn -E 'html\\.parser|HTMLParser|^(import|from) html'` against the PyPI sdist — no hits). AICR invokes aiperf-bench exclusively as `aiperf profile <text-LLM> --url <endpoint>` (validators/performance/inference_perf_constraint.go); the workload exchanges only JSON over HTTP via aiohttp + msgspec/orjson and never parses HTML documents from the inference endpoint or any other source. No attacker-controlled markup can reach the vulnerable parser, so the quadratic-complexity code path is unreachable."
+    },
     {
       "vulnerability": {
         "name": "CVE-2026-45447",

.settings.yaml

@@ -64,7 +64,7 @@ testing_tools:
   # renovate: datasource=github-releases depName=tilt-dev/tilt depType=testing_tools
   tilt: '0.37.5'
   # renovate: datasource=github-releases depName=helm/helm depType=testing_tools
-  helm: 'v4.2.2'
+  helm: 'v4.2.3'
   # renovate: datasource=github-releases depName=databus23/helm-diff depType=testing_tools
   helm_diff: 'v3.15.10'
   # renovate: datasource=github-releases depName=helmfile/helmfile depType=testing_tools
@@ -91,14 +91,14 @@ testing_tools:
   yq: 'v4.53.3'
   # AWS CLI used by the KMS e2e to provision keys against the MiniStack emulator.
   # renovate: datasource=pypi depName=awscli depType=testing_tools
-  awscli: '1.45.41'
+  awscli: '1.45.45'
   # MiniStack: MIT-licensed, token-free AWS emulator (https://ministack.org) used
   # by the KMS e2e in place of LocalStack, whose latest/stable images now refuse
   # to boot without a paid license token. Pinned (never :latest) for reproducibility.
   # Run with USE_SSL=1: sigstore's awskms signer hardcodes https://, so the e2e
   # serves TLS with a mkcert cert (see mkcert below).
   # renovate: datasource=docker depName=ministackorg/ministack depType=testing_tools
-  ministack_image: 'ministackorg/ministack:1.3.72'
+  ministack_image: 'ministackorg/ministack:1.4.1'
   # mkcert issues a trusted localhost cert for MiniStack's TLS and installs its CA
   # into the system trust store, so the Go AWS SDK accepts the awskms:// endpoint.
   # renovate: datasource=github-releases depName=FiloSottile/mkcert depType=testing_tools
@@ -127,7 +127,7 @@ testing_tools:
   # kustomize-controller and helm-controller are the only controllers the
   # bundle consumes (OCIRepository -> Kustomization -> HelmRelease).
   # renovate: datasource=github-releases depName=fluxcd/flux2 depType=testing_tools
-  flux_version: 'v2.9.0'
+  flux_version: 'v2.9.1'
   # In-cluster Git server for the KWOK flux-git deployer lane (issue #963).
   # Rootless variant so the admin-user bootstrap can `kubectl exec gitea
   # admin user create` directly without su gymnastics.
@@ -136,7 +136,7 @@ testing_tools:
   # renovate: datasource=github-releases depName=hauler-dev/hauler depType=testing_tools
   hauler: 'v2.0.1'
   # renovate: datasource=github-releases depName=zarf-dev/zarf depType=testing_tools
-  zarf: 'v0.80.0'
+  zarf: 'v0.81.0'
 # Quality Thresholds
 quality:
   coverage_threshold: '75'

docs/contributor/maintaining.md

@@ -53,17 +53,71 @@ failure during the first 60s after tag publish. Re-run the workflow.
 
 The `Rekor Monitor` workflow (`.github/workflows/rekor-monitor.yaml`) runs
 hourly and calls the upstream `sigstore/rekor-monitor` reusable workflow. It
-watches the public-good Rekor transparency log for two things: that the log
-stays append-only (consistency), and that no entry appears under AICR's release
-signing identity that a release did not produce (identity). On either failure it
-opens an issue.
+watches the **Rekor v2** transparency log (where AICR release signing writes
+since [#1650](https://github.com/NVIDIA/aicr/issues/1650)) for two things, both
+in one job: that the log stays append-only (consistency), and that no entry
+appears under AICR's release signing identity that a release did not produce
+(identity). On either failure it opens an issue.
 
 This protects the trust root every AICR consumer depends on: the release
 binaries, the signed recipe catalog, and the container images all chain to that
 one identity. When the workflow files an issue, follow the triage steps in the
 workflow file's header comment; an unrecognized identity hit should be treated
 as potential OIDC/key compromise.
 
+### Why v2, and why identity monitoring is feasible now
+
+Identity monitoring is a linear scan of every entry added to the log since the
+last checkpoint, because Rekor's index cannot be queried by certificate SAN and
+AICR's keyless release identity has no email or fixed public key to search on.
+On the Rekor **v1** firehose that scan runs roughly 50x slower than the log
+grows, so it can never keep up inside a bounded CI job: the earlier v1
+identity config timed out on every run and never completed a single scan
+([#1623](https://github.com/NVIDIA/aicr/issues/1623)). Rekor **v2** is
+tile-based: bulk 256-entry reads let a single worker outpace the log, so the
+identity scan is a cheap job that always finishes. This is why the whole design
+is a single unbounded scan again rather than sharded paging.
+
+### Shard selection (automatic, no manual re-tune)
+
+The monitor selects Rekor v2 by pointing its `url` at a v2 shard listed in the
+Sigstore `SigningConfig`; a match on a v2 service switches it to v2, after which
+it auto-discovers the **full** shard set from TUF and refreshes it every run.
+
+The shard URL is **not hardcoded**. The `resolve-v2-shard` job computes it at run
+time from the same TUF-distributed signing config that release signing resolves,
+then feeds it to the monitor:
+
+```bash
+# Same command the resolve-v2-shard job runs (works from a fresh checkout).
+go run ./cmd/aicr trust update --emit-signing-config signing-config.json
+jq -er '[.rekorTlogUrls[] | select(.majorApiVersion == 2)] | sort_by(.validFor.start) | last | .url' signing-config.json
+```
+
+Because it reads the signing config directly, the monitor provably watches where
+releases actually write, and yearly shard rotation (`log2025-1` -> `log2026-1`
+-> ...) needs no change to this workflow. If the resolve job ever fails (for
+example the TUF CDN is unreachable), the monitor job is skipped for that run and
+retries on the next hourly tick.
+
+### First run after switching from v1: reset the checkpoint
+
+The `checkpoint` artifact persists a **v1** checkpoint from the prior config; a
+v2 run cannot parse it and will fail. After merging a change that moves this
+workflow to v2, delete the stale artifact once so the first v2 run establishes a
+fresh v2 baseline (it saves the current v2 tree head and scans forward from
+there):
+
+```bash
+gh api "repos/NVIDIA/aicr/actions/artifacts?name=checkpoint" \
+  --jq '.artifacts[].id' \
+  | xargs -I{} gh api -X DELETE "repos/NVIDIA/aicr/actions/artifacts/{}"
+```
+
+The first v2 run then watches forward from the current head; historical entries
+predating the baseline are covered by release-time verification (the `aicr
+verify` path), not by this monitor.
+
 ## Reviewing Recipe Contributions
 
 A recipe PR touches `recipes/overlays/`, `recipes/mixins/`,

go.mod

@@ -35,7 +35,7 @@ require (
 	k8s.io/apimachinery v0.36.2
 	k8s.io/client-go v0.36.2
 	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
-	oras.land/oras-go/v2 v2.6.1
+	oras.land/oras-go/v2 v2.6.2
 	sigs.k8s.io/controller-runtime v0.24.1
 	sigs.k8s.io/kustomize/api v0.21.1
 	sigs.k8s.io/kustomize/kyaml v0.21.1

go.sum

@@ -603,8 +603,8 @@ k8s.io/streaming v0.36.2 h1:NSKthPPg9UFSKsRauVJUVGH2Dvn8fhKmY4qrMkw/p98=
 k8s.io/streaming v0.36.2/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
-oras.land/oras-go/v2 v2.6.1 h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs=
-oras.land/oras-go/v2 v2.6.1/go.mod h1:dhtFrFOuZuDtAVeZ9FUnaa5zfzplG3ZnFX9/uH1J/Yk=
+oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
+oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
 sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
 sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=

vendor/modules.txt

@@ -1694,7 +1694,7 @@ k8s.io/utils/internal/third_party/forked/golang/net
 k8s.io/utils/net
 k8s.io/utils/ptr
 k8s.io/utils/trace
-# oras.land/oras-go/v2 v2.6.1
+# oras.land/oras-go/v2 v2.6.2
 ## explicit; go 1.25.0
 oras.land/oras-go/v2
 oras.land/oras-go/v2/content

vendor/oras.land/oras-go/v2/content/file/utils.go

@@ -175,6 +175,15 @@ func extractTarDirectory(dirPath, dirName string, r io.Reader, buf []byte, prese
 		}
 		filePath := filepath.Join(dirPath, filePathRel)
 
+		// resolveRelToBase only performs lexical and per-component Lstat checks,
+		// which a chain of previously-extracted symlinks can bypass. Re-verify
+		// containment with symlinks fully resolved before mutating the
+		// filesystem, matching the check on the pushFile path.
+		// (GHSA-m37j-52j7-pjw7)
+		if err := checkSymlinkEscape(dirPath, filePath); err != nil {
+			return err
+		}
+
 		// Create content
 		switch header.Typeflag {
 		case tar.TypeReg:
@@ -188,6 +197,11 @@ func extractTarDirectory(dirPath, dirName string, r io.Reader, buf []byte, prese
 			// This is a known limitation and will not be addressed.
 			var target string
 			if target, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {
+				if !filepath.IsAbs(target) {
+					// link(2) resolves relative paths against the process CWD, not
+					// the link file's directory. Resolve explicitly to prevent escape.
+					target = filepath.Join(filepath.Dir(filePath), target)
+				}
 				err = os.Link(target, filePath)
 			}
 		case tar.TypeSymlink:
@@ -276,6 +290,16 @@ func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) {
 
 // writeFile writes content to the file specified by the `path` parameter.
 func writeFile(path string, r io.Reader, perm os.FileMode, buf []byte) (err error) {
+	// os.OpenFile follows a terminal symlink, so a regular-file entry whose
+	// path was already created as a symlink by an earlier archive entry would
+	// be written through that link, landing outside the extraction root
+	// (GHSA-m37j-52j7-pjw7). Remove any such symlink first so the content is
+	// written to a regular file at path itself.
+	if fi, err := os.Lstat(path); err == nil && fi.Mode()&os.ModeSymlink != 0 {
+		if err := os.Remove(path); err != nil {
+			return err
+		}
+	}
 	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
 	if err != nil {
 		return err