From 38a35fece29b1c006a1e3013849e6892381bd6b3 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 21:16:31 +0000 Subject: [PATCH 1/5] Start squad record for issue 377 --- specs/issue-377/log.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 specs/issue-377/log.md diff --git a/specs/issue-377/log.md b/specs/issue-377/log.md new file mode 100644 index 00000000..b21b936b --- /dev/null +++ b/specs/issue-377/log.md @@ -0,0 +1,8 @@ +# Log: issue #377 + +One line per pipeline step: date and time of day (UTC), step, member, result. Lead decisions and escalations +are quoted in full. + +| Date | Step | Member | Result | +| ---- | ---- | ------ | ------ | +| 2026-10-29 21:16 | 1 Intake | Orchestrator | Issue #377 read; no labels, no feature wording: bug: no feature label (documentation procedure; Lead picks tier) | From b5f5644ab3cda2708db7f42c5e46865835ea88ed Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 21:21:34 +0000 Subject: [PATCH 2/5] Document the Trivy update procedure --- docs/CONTRIBUTING.md | 30 ++++++++++++++++++++++++++++++ specs/issue-377/log.md | 2 ++ 2 files changed, 32 insertions(+) diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index d88d7209..663b25c0 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -148,6 +148,36 @@ issue of its milestone has been closed, not earlier and not later. The current r maintainer assigns a later one. - A tag is pushed only with explicit approval (see above); the milestone, not the merge of a pull request, makes a release due. + +### Updating the bundled Trivy + +Dependabot does not cover Docker images, so the Trivy CLI the image bundles (the `TRIVY_IMAGE` build argument in +`src/DockerUpdateGuard/Dockerfile`, pinned by digest) is updated by hand. Decision records +[0015](decisions/0015-the-trivy-scan-target-follows-an-end-of-options-marker.md) and +[0016](decisions/0016-the-bundled-trivy-skips-its-update-check-and-telemetry.md) rest on measurements of the bundled +version, so every new version is measured again before it is bundled, and the results go into the pull request: + +1. Take the digest of the new version's multi-arch image index (`docker buildx imagetools inspect + aquasec/trivy:`, line `Digest:`) and check that `docker pull aquasec/trivy@` succeeds. +2. Extract `/usr/local/bin/trivy` from that image (`docker create`, `docker cp`) and check that `trivy --version` + names the new version and that `file` reports the binary as statically linked, since the runtime image is + Alpine-based. +3. With `TRIVY_SERVER` pointing at an unreachable server (for example `http://127.0.0.1:9`), re-run the cases of + #367 with the provider's argument list ([Vulnerabilities](areas/vulnerabilities.md#trivy)): without `--`, the + target `--config=x.y/z:latest` is read as an option; after `--`, the targets `--config=…`, `--input=…` and `-a/b` + are taken as image names, the run exits non-zero and opens no file they name (for example checked with + `strace -f -e trace=open,openat`); `-- library/alpine:3.20` takes the normal scan path and fails on the + unreachable server, which shows that `TRIVY_SERVER` is read. +4. Run one scan with `TRIVY_SKIP_VERSION_CHECK=true` and `TRIVY_DISABLE_TELEMETRY=true` and a control run without + them, watching the process's DNS lookups and connections: the first reaches no destination other than those + [Hosting](areas/hosting.md#container-image) lists, and never `check.trivy.dev`; the control run shows the request + to `check.trivy.dev`, so the observation is known to see it. +5. Change together: the `TRIVY_IMAGE` default and the version in its comment in the Dockerfile, the + `aquasec/trivy:` image of both Trivy servers in `docs/docker-compose.trivy.yml` and + `docs/docker-compose.full.yml` (client and server stay on one version), and the bundled version named in + [Hosting](areas/hosting.md#container-image) and in records 0005, 0015 and 0016: in place while a record is + unreleased, through a new record that amends it once it is released ([Decision records](decisions/README.md)). + A version named as the one a past measurement was made with (v0.58.1) stays. diff --git a/specs/issue-377/log.md b/specs/issue-377/log.md index b21b936b..484ea405 100644 --- a/specs/issue-377/log.md +++ b/specs/issue-377/log.md @@ -6,3 +6,5 @@ are quoted in full. | Date | Step | Member | Result | | ---- | ---- | ------ | ------ | | 2026-10-29 21:16 | 1 Intake | Orchestrator | Issue #377 read; no labels, no feature wording: bug: no feature label (documentation procedure; Lead picks tier) | +| 2026-10-29 21:21 | 2 Plan | squad-lead | Tier docs: checklist added to docs/CONTRIBUTING.md (releases block) instead of an area document, since process is not an area (areas README); AC1-AC4 (opus/medium · 76,455 tokens · 16 tool uses · 159 s) | +| 2026-10-29 21:21 | 2 Plan | Orchestrator | Applied the Lead's edit; scope-check --tier docs PASS; challenge skipped: tier docs | From 5aed63192dc513464ab16e98d503db74e218d244 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 21:21:42 +0000 Subject: [PATCH 3/5] Log code check --- specs/issue-377/log.md | 1 + 1 file changed, 1 insertion(+) diff --git a/specs/issue-377/log.md b/specs/issue-377/log.md index 484ea405..5a4850f1 100644 --- a/specs/issue-377/log.md +++ b/specs/issue-377/log.md @@ -8,3 +8,4 @@ are quoted in full. | 2026-10-29 21:16 | 1 Intake | Orchestrator | Issue #377 read; no labels, no feature wording: bug: no feature label (documentation procedure; Lead picks tier) | | 2026-10-29 21:21 | 2 Plan | squad-lead | Tier docs: checklist added to docs/CONTRIBUTING.md (releases block) instead of an area document, since process is not an area (areas README); AC1-AC4 (opus/medium · 76,455 tokens · 16 tool uses · 159 s) | | 2026-10-29 21:21 | 2 Plan | Orchestrator | Applied the Lead's edit; scope-check --tier docs PASS; challenge skipped: tier docs | +| 2026-10-29 21:21 | 7 Code check | Orchestrator | Format check: 0 of 393 files need formatting; scope-check --tier docs PASS; no code, so build/test gates not applicable | From bf8cab7a64592b895d73e3a77c1880ca24180a92 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 21:23:15 +0000 Subject: [PATCH 4/5] Word the Dependabot remark precisely --- docs/CONTRIBUTING.md | 2 +- specs/issue-377/log.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index 663b25c0..40abed99 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -151,7 +151,7 @@ issue of its milestone has been closed, not earlier and not later. The current r ### Updating the bundled Trivy -Dependabot does not cover Docker images, so the Trivy CLI the image bundles (the `TRIVY_IMAGE` build argument in +Dependabot is not configured for Docker images in this repository, so the Trivy CLI the image bundles (the `TRIVY_IMAGE` build argument in `src/DockerUpdateGuard/Dockerfile`, pinned by digest) is updated by hand. Decision records [0015](decisions/0015-the-trivy-scan-target-follows-an-end-of-options-marker.md) and [0016](decisions/0016-the-bundled-trivy-skips-its-update-check-and-telemetry.md) rest on measurements of the bundled diff --git a/specs/issue-377/log.md b/specs/issue-377/log.md index 5a4850f1..7d6fc8ed 100644 --- a/specs/issue-377/log.md +++ b/specs/issue-377/log.md @@ -9,3 +9,4 @@ are quoted in full. | 2026-10-29 21:21 | 2 Plan | squad-lead | Tier docs: checklist added to docs/CONTRIBUTING.md (releases block) instead of an area document, since process is not an area (areas README); AC1-AC4 (opus/medium · 76,455 tokens · 16 tool uses · 159 s) | | 2026-10-29 21:21 | 2 Plan | Orchestrator | Applied the Lead's edit; scope-check --tier docs PASS; challenge skipped: tier docs | | 2026-10-29 21:21 | 7 Code check | Orchestrator | Format check: 0 of 393 files need formatting; scope-check --tier docs PASS; no code, so build/test gates not applicable | +| 2026-10-29 21:23 | 8 Review | squad-reviewer | Round 1: APPROVE, no blocking findings; 1 non-blocking (Dependabot wording) applied verbatim (opus/medium · usage pending) | From e8e5a92f803b808cc67f3581d950e2c802415974 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 21:23:37 +0000 Subject: [PATCH 5/5] Remove squad working record --- specs/issue-377/log.md | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 specs/issue-377/log.md diff --git a/specs/issue-377/log.md b/specs/issue-377/log.md deleted file mode 100644 index 7d6fc8ed..00000000 --- a/specs/issue-377/log.md +++ /dev/null @@ -1,12 +0,0 @@ -# Log: issue #377 - -One line per pipeline step: date and time of day (UTC), step, member, result. Lead decisions and escalations -are quoted in full. - -| Date | Step | Member | Result | -| ---- | ---- | ------ | ------ | -| 2026-10-29 21:16 | 1 Intake | Orchestrator | Issue #377 read; no labels, no feature wording: bug: no feature label (documentation procedure; Lead picks tier) | -| 2026-10-29 21:21 | 2 Plan | squad-lead | Tier docs: checklist added to docs/CONTRIBUTING.md (releases block) instead of an area document, since process is not an area (areas README); AC1-AC4 (opus/medium · 76,455 tokens · 16 tool uses · 159 s) | -| 2026-10-29 21:21 | 2 Plan | Orchestrator | Applied the Lead's edit; scope-check --tier docs PASS; challenge skipped: tier docs | -| 2026-10-29 21:21 | 7 Code check | Orchestrator | Format check: 0 of 393 files need formatting; scope-check --tier docs PASS; no code, so build/test gates not applicable | -| 2026-10-29 21:23 | 8 Review | squad-reviewer | Round 1: APPROVE, no blocking findings; 1 non-blocking (Dependabot wording) applied verbatim (opus/medium · usage pending) |