From 52b870824f7beae00e827e695c81dd13b7e8e36e Mon Sep 17 00:00:00 2001 From: ogt Date: Tue, 14 Jul 2026 16:54:28 +0800 Subject: [PATCH] fix(security): verify internal runtime mirror digests --- scripts/security/runtime_image_mirror_controller.py | 8 +++++++- .../tests/test_runtime_image_mirror_controller.py | 13 +++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/scripts/security/runtime_image_mirror_controller.py b/scripts/security/runtime_image_mirror_controller.py index 2864d00b6..7565356cd 100644 --- a/scripts/security/runtime_image_mirror_controller.py +++ b/scripts/security/runtime_image_mirror_controller.py @@ -299,7 +299,13 @@ def _target_digest_ref(image: ImagePolicy) -> str: def _target_digest_present(image: ImagePolicy) -> bool: try: completed = subprocess.run( - ["docker", "manifest", "inspect", _target_digest_ref(image)], + [ + "docker", + "manifest", + "inspect", + "--insecure", + _target_digest_ref(image), + ], check=False, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, diff --git a/scripts/security/tests/test_runtime_image_mirror_controller.py b/scripts/security/tests/test_runtime_image_mirror_controller.py index 9faa3dab4..e3a715c14 100644 --- a/scripts/security/tests/test_runtime_image_mirror_controller.py +++ b/scripts/security/tests/test_runtime_image_mirror_controller.py @@ -8,6 +8,7 @@ import tempfile import unittest from io import BytesIO from pathlib import Path +from unittest.mock import patch ROOT = Path(__file__).resolve().parents[3] @@ -102,6 +103,18 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase): ) ) + def test_target_digest_verifier_uses_internal_registry_transport(self) -> None: + image = controller.load_policy(POLICY_PATH).images[0] + with patch.object(controller.subprocess, "run") as run: + run.return_value.returncode = 0 + + self.assertTrue(controller._target_digest_present(image)) + + command = run.call_args.args[0] + self.assertEqual(command[:3], ["docker", "manifest", "inspect"]) + self.assertIn("--insecure", command) + self.assertEqual(command[-1], controller._target_digest_ref(image)) + def test_source_manifests_match_internal_policy(self) -> None: policy = controller.load_policy(POLICY_PATH) by_asset = {image.asset_id: image for image in policy.images}