Security queue pass (#70-#74 on command-center), two commits:
fix(quadlet): drop HostAddr= from prometheus.container - podman 5.7.0 rejects the key and the quadlet generator then aborts the whole user batch, silently orphaning every other unit (live: prometheus ran 16 h as an orphan; deploy died Unit prometheus.service not found). The name resolves natively; the key was never needed.
feat(security): every registry image in every quadlet on all three hosts is now tag@sha256:-pinned (36 units). localhost/* builds exempt. The pihole pin pulls the fixed build (closes the 6.8/6.6.1/6.5 set, #71); copyparty pinned at the build labelled 1.20.26 (closes GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76, #73); valkey is pinned in place - the running 9.1.2 already carries all four HIGH fixes (#72 resolved not-vulnerable); redis pinned, vendor fixes TBD (#74). #70 (Alpine carriers) closes with the pin pass.
Tests
New gate tests/quadlet_image_pins.bats: no unpinned registry image anywhere; no generator-rejected key anywhere (HostAddr/Device/Command).
Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger than before.
## Summary
Security queue pass (#70-#74 on command-center), two commits:
- **fix(quadlet):** drop `HostAddr=` from `prometheus.container` - podman 5.7.0 rejects the key and the quadlet generator then **aborts the whole user batch**, silently orphaning every other unit (live: prometheus ran 16 h as an orphan; deploy died `Unit prometheus.service not found`). The name resolves natively; the key was never needed.
- **feat(security):** every registry image in every quadlet on all three hosts is now `tag@sha256:`-pinned (36 units). `localhost/*` builds exempt. The pihole pin pulls the fixed build (closes the 6.8/6.6.1/6.5 set, #71); copyparty pinned at the build labelled 1.20.26 (closes GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76, #73); valkey is pinned in place - the running 9.1.2 already carries all four HIGH fixes (#72 resolved not-vulnerable); redis pinned, vendor fixes TBD (#74). #70 (Alpine carriers) closes with the pin pass.
## Tests
- New gate `tests/quadlet_image_pins.bats`: no unpinned registry image anywhere; no generator-rejected key anywhere (HostAddr/Device/Command).
- Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require **tag AND digest** - strictly stronger than before.
- [x] touched seams green; full `tests/run.sh` green
- [ ] drains: `deploy.sh dankclaw` + `deploy.sh dankserver` (every container recreates onto its pinned digest)
---
cwd: /home/blank/Projects/serverAppConfig · session: wt-20261020-125416-6d1fc1f
Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags
let a rebuild move under a running service with nobody approving it, and
make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver
and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt
(their build is the pin). The pihole and copyparty pins pull the fixed
builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in
place, vendor fixes TBD.
New gate tests/quadlet_image_pins.bats: no unpinned registry image, no
generator-rejected key anywhere. Three seams that pinned the old exact-tag
law (frankbook readarr, open_webui, seerr) now require tag AND digest -
strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint
flags-only law, pin law.
dank
merged commit 94a9f3aa31 into main2026-10-21 16:32:44 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Security queue pass (#70-#74 on command-center), two commits:
HostAddr=fromprometheus.container- podman 5.7.0 rejects the key and the quadlet generator then aborts the whole user batch, silently orphaning every other unit (live: prometheus ran 16 h as an orphan; deploy diedUnit prometheus.service not found). The name resolves natively; the key was never needed.tag@sha256:-pinned (36 units).localhost/*builds exempt. The pihole pin pulls the fixed build (closes the 6.8/6.6.1/6.5 set, #71); copyparty pinned at the build labelled 1.20.26 (closes GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76, #73); valkey is pinned in place - the running 9.1.2 already carries all four HIGH fixes (#72 resolved not-vulnerable); redis pinned, vendor fixes TBD (#74). #70 (Alpine carriers) closes with the pin pass.Tests
tests/quadlet_image_pins.bats: no unpinned registry image anywhere; no generator-rejected key anywhere (HostAddr/Device/Command).tests/run.shgreendeploy.sh dankclaw+deploy.sh dankserver(every container recreates onto its pinned digest)cwd: /home/blank/Projects/serverAppConfig · session: wt-20261020-125416-6d1fc1f