wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

perf(cd): skip redundant mirror and bootstrap work

Browse Source
This commit is contained in:
Your Name
2026-07-18 19:34:31 +08:00
parent e7e3bcf8a5
commit 5c43b3da2e
5 changed files with 269 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
scripts/security/runtime_image_mirror_controller.py
View File

@@ -19,9 +19,9 @@ from typing import Any, Sequence
SCHEMA_VERSION = "awoooi_runtime_image_mirror_policy_v1"
RECEIPT_SCHEMA_VERSION = "awoooi_runtime_image_mirror_receipt_v1"
RECEIPT_SCHEMA_VERSION = "awoooi_runtime_image_mirror_receipt_v2"
STAGING_SCHEMA_VERSION = "awoooi_runtime_image_mirror_staging_policy_v1"
STAGING_RECEIPT_SCHEMA_VERSION = "awoooi_runtime_image_mirror_staging_receipt_v1"
STAGING_RECEIPT_SCHEMA_VERSION = "awoooi_runtime_image_mirror_staging_receipt_v2"
ALLOWED_KINDS = {"deployment", "daemonset", "statefulset"}
ALLOWED_CONTAINER_KINDS = {"container", "init_container"}
DIGEST_PATTERN = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -665,16 +665,25 @@ def mirror_images(
known_hosts: Path,
apply: bool,
) -> dict[str, Any]:
cache = RuntimeCache(policy, ssh_key, known_hosts)
cache: RuntimeCache | None = None
image_receipts: list[dict[str, Any]] = []
missing_count = 0
for image in policy.images:
source_ref = cache.verify_source(image)
source_fingerprint = "sha256:" + hashlib.sha256(source_ref.encode()).hexdigest()
target_present = _target_digest_present(image)
source_fingerprint = None
source_cache_verified = False
source_cache_verification_skipped_reason = "target_digest_already_verified"
execution = "already_present"
if not target_present:
missing_count += 1
if cache is None:
cache = RuntimeCache(policy, ssh_key, known_hosts)
source_ref = cache.verify_source(image)
source_fingerprint = (
"sha256:" + hashlib.sha256(source_ref.encode()).hexdigest()
)
source_cache_verified = True
source_cache_verification_skipped_reason = None
execution = "check_only_missing"
if apply:
source_preexisting = _local_image_present(source_ref)
@@ -727,7 +736,10 @@ def mirror_images(
"platform_digest": image.platform_digest,
"target_registry_digest": image.target_registry_digest,
"target_digest_ref": _target_digest_ref(image),
"source_cache_verified": True,
"source_cache_verified": source_cache_verified,
"source_cache_verification_skipped_reason": (
source_cache_verification_skipped_reason
),
"target_digest_verified": target_present,
"execution": execution,
}
@@ -743,6 +755,7 @@ def mirror_images(
"mode": "apply" if apply else "check",
"external_pull_allowed": False,
"source_cache_only": True,
"source_cache_accessed": cache is not None,
"candidate_count": len(image_receipts),
"missing_before_count": missing_count,
"verified_count": sum(
@@ -766,20 +779,30 @@ def stage_images(
known_hosts: Path,
apply: bool,
) -> dict[str, Any]:
cache = RuntimeCache(policy, ssh_key, known_hosts)
cache: RuntimeCache | None = None
image_receipts: list[dict[str, Any]] = []
missing_count = 0
for image in policy.images:
source_ref = cache.verify_source(image)
source_fingerprint = "sha256:" + hashlib.sha256(source_ref.encode()).hexdigest()
source_config_digest = cache.source_config_digest(image.platform_digest)
if source_config_digest != image.source_config_digest:
raise ControllerError("runtime_cache_config_digest_mismatch")
descriptor = _registry_descriptor(image.push_ref)
source_fingerprint = None
source_cache_verified = False
source_cache_verification_skipped_reason = (
"internal_registry_provenance_already_verified"
)
execution = "already_present"
if descriptor is None:
missing_count += 1
if cache is None:
cache = RuntimeCache(policy, ssh_key, known_hosts)
source_ref = cache.verify_source(image)
source_fingerprint = (
"sha256:" + hashlib.sha256(source_ref.encode()).hexdigest()
)
source_config_digest = cache.source_config_digest(image.platform_digest)
if source_config_digest != image.source_config_digest:
raise ControllerError("runtime_cache_config_digest_mismatch")
source_cache_verified = True
source_cache_verification_skipped_reason = None
execution = "check_only_missing"
if apply:
source_preexisting = _local_image_present(source_ref)
@@ -836,7 +859,10 @@ def stage_images(
raise ControllerError("internal_registry_descriptor_missing")
execution = "staged_from_runtime_cache"
if descriptor is not None and descriptor.config_digest != source_config_digest:
if (
descriptor is not None
and descriptor.config_digest != image.source_config_digest
):
raise ControllerError("internal_registry_provenance_mismatch")
target_digest_ref = None
runtime_ref = None
@@ -858,13 +884,16 @@ def stage_images(
"source_ref_fingerprint": source_fingerprint,
"source_index_digest": image.source_index_digest,
"platform_digest": image.platform_digest,
"source_config_digest": source_config_digest,
"source_config_digest": image.source_config_digest,
"target_registry_digest": (
descriptor.digest if descriptor is not None else None
),
"target_digest_ref": target_digest_ref,
"runtime_ref": runtime_ref,
"source_cache_verified": True,
"source_cache_verified": source_cache_verified,
"source_cache_verification_skipped_reason": (
source_cache_verification_skipped_reason
),
"target_digest_verified": target_verified,
"provenance_config_digest_match": descriptor is not None,
"execution": execution,
@@ -889,6 +918,7 @@ def stage_images(
"risk_level": policy.risk_level,
"external_pull_allowed": False,
"source_cache_only": True,
"source_cache_accessed": cache is not None,
"candidate_count": len(image_receipts),
"missing_before_count": missing_count,
"verified_count": sum(