code-sandboxes 1.9.6__tar.gz → 1.9.8__tar.gz

{code_sandboxes-1.9.6 → code_sandboxes-1.9.8}/CHANGELOG.md

@@ -8,6 +8,30 @@
 
 ## Unreleased
 
+## 1.9.8
+
+- **Every page of a scan's findings is read before deciding**
+  (`environments.attest`; PLAN_ENV.md E1-08, D-11). `describe_image_scan_
+  findings` paginates, and the attestor called it exactly once. Found live
+  on r1, 2026-09-14: the first real image with more findings than one page
+  had 1,547 enhanced findings, 31 of them critical, and the single-page read
+  saw a small enough slice that the decision passed — an image with real,
+  unreviewed critical vulnerabilities would have been signed and started. A
+  hard cap of 50 pages keeps a pathological registry from paginating
+  forever; hitting it logs that more findings went unread rather than
+  pretending the scan was complete.
+
+## 1.9.7
+
+- **cosign signs again under `--use-signing-config=false`** (`environments
+  .attest`; PLAN_ENV.md E1-09). cosign 3.1.3 defaults `--use-signing-config`
+  to `true`: a TUF-provided signing config now names the service URLs,
+  including a transparency log, and `--tlog-upload=false` alone no longer
+  overrides that — cosign refused the combination outright (found live on
+  r1, 2026-09-14, the first real signature this pipeline ever attempted).
+  Turning the signing config off restores the plain, flag-driven behavior
+  `--tlog-upload=false` already asks for.
+
 ## 1.9.6
 
 - **`datalayer/python-cpu`'s `2026.09` channel points at the patched base**

{code_sandboxes-1.9.6 → code_sandboxes-1.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.6
+Version: 1.9.8
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.6 → code_sandboxes-1.9.8}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.6"
+__version__ = "1.9.8"

{code_sandboxes-1.9.6 → code_sandboxes-1.9.8}/code_sandboxes/environments/attest.py

@@ -289,32 +289,70 @@ class Attestor:
             detail={"repository": repository, "digest": digest},
         )
 
+    #: A hard cap on pages read, so a registry that never stops paginating
+    #: cannot wedge a build forever — this many pages is already far past any
+    #: real image's own finding count (E1-08, found live 2026-09-14: see
+    #: `_describe`'s own docstring for why a page limit is not optional).
+    _MAX_FINDING_PAGES = 50
+
     def _describe(self, *, repository: str, digest: str) -> tuple[str, dict[str, Any]]:
-        """One `DescribeImageScanFindings`, as a status and what it answered."""
-        try:
-            answer = self._client().describe_image_scan_findings(
-                repositoryName=repository, imageId={"imageDigest": digest}
-            )
-        except Exception as error:
-            if _is_in_progress(error):
-                return "IN_PROGRESS", {}
-            if _is_missing(error):
+        """Every `DescribeImageScanFindings` page, as one status and one answer.
+
+        ECR paginates enhanced findings — `nextToken`, not a field this call
+        can ask to skip — and a single unpaginated call answers only its first
+        page. Found live, 2026-09-14: the first real artifact this pipeline
+        scanned had 1,547 enhanced findings across many pages and 31 of them
+        critical, and a single-page read passed a decision that should have
+        blocked, because none of those 31 were in the one page it happened to
+        see. Every page is read and merged before `decide` ever runs.
+        """
+        pages = 0
+        status = ""
+        enhanced: list[Any] = []
+        basic: list[Any] = []
+        completed_at: Any = None
+        token: str | None = None
+        while True:
+            try:
+                kwargs: dict[str, Any] = {
+                    "repositoryName": repository,
+                    "imageId": {"imageDigest": digest},
+                }
+                if token:
+                    kwargs["nextToken"] = token
+                answer = self._client().describe_image_scan_findings(**kwargs)
+            except Exception as error:
+                if _is_in_progress(error):
+                    return "IN_PROGRESS", {}
+                if _is_missing(error):
+                    raise EnvironmentsError(
+                        PROVIDER_ERROR,
+                        f"The registry has no scan for {digest}: {error}",
+                        detail={"repository": repository, "digest": digest},
+                    ) from error
                 raise EnvironmentsError(
                     PROVIDER_ERROR,
-                    f"The registry has no scan for {digest}: {error}",
+                    f"The scan of {digest} could not be read: {error}",
                     detail={"repository": repository, "digest": digest},
                 ) from error
-            raise EnvironmentsError(
-                PROVIDER_ERROR,
-                f"The scan of {digest} could not be read: {error}",
-                detail={"repository": repository, "digest": digest},
-            ) from error
-        status = str(((answer.get("imageScanStatus") or {}).get("status")) or "")
-        findings = answer.get("imageScanFindings") or {}
+            status = str(((answer.get("imageScanStatus") or {}).get("status")) or "")
+            findings = answer.get("imageScanFindings") or {}
+            enhanced.extend(findings.get("enhancedFindings") or [])
+            basic.extend(findings.get("findings") or [])
+            completed_at = findings.get("imageScanCompletedAt") or completed_at
+            pages += 1
+            token = answer.get("nextToken")
+            if not token or pages >= self._MAX_FINDING_PAGES:
+                if token:
+                    self._log(
+                        f"Stopped reading {digest}'s scan after {pages} pages, "
+                        "with more findings still unread"
+                    )
+                break
         return status, {
-            "findings": findings,
-            "completed_at": findings.get("imageScanCompletedAt"),
-            "scanner": "ECR enhanced" if findings.get("enhancedFindings") else "ECR basic",
+            "findings": {"enhancedFindings": enhanced, "findings": basic},
+            "completed_at": completed_at,
+            "scanner": "ECR enhanced" if enhanced else "ECR basic",
         }
 
     @staticmethod
@@ -380,6 +418,17 @@ class Attestor:
             # even answer. The matching verify-side omission is fixed in
             # `datalayer_operator.services.environment_signatures`.
             "--tlog-upload=false",
+            # cosign 3.1.3 defaults `--use-signing-config` to `true`: a
+            # TUF-provided signing config now names the service URLs,
+            # including a transparency log, and `--tlog-upload=false` alone
+            # no longer overrides that — cosign refuses the combination
+            # outright, "not supported with --signing-config or
+            # --use-signing-config" (found live, 2026-09-14, the first real
+            # sign this worker's own pinned cosign ever ran). Turning the
+            # signing config off restores the plain, flag-driven behavior
+            # `--tlog-upload=false` already asks for, and needs no network
+            # call of its own to fetch one.
+            "--use-signing-config=false",
             "--key",
             self._key,
             reference,

{code_sandboxes-1.9.6 → code_sandboxes-1.9.8}/tests/test_environment_attest.py

@@ -90,9 +90,14 @@ class FakeEcr:
         enhanced_findings=True,
         signed: set[str] | None = None,
         manifest: dict | None = None,
+        pages: list[list[dict]] | None = None,
     ) -> None:
         self.statuses = list(statuses)
         self.findings = list(findings)
+        #: Each entry is one `describe_image_scan_findings` page's own
+        #: findings, read in order and merged by `_describe` — overrides
+        #: `findings` when given, to test reading more than one page.
+        self.pages = pages
         self.enhanced_findings = enhanced_findings
         self.signed = set(signed or set())
         self.manifest = manifest
@@ -115,7 +120,7 @@ class FakeEcr:
             ]
         }
 
-    def describe_image_scan_findings(self, repositoryName, imageId):  # noqa: N803 - boto3's spelling
+    def describe_image_scan_findings(self, repositoryName, imageId, nextToken=None):  # noqa: N803 - boto3's spelling
         self.asked += 1
         self.scanned.append(imageId["imageDigest"])
         status = self.statuses[min(self.asked, len(self.statuses)) - 1]
@@ -132,6 +137,18 @@ class FakeEcr:
             error.response = {"Error": {"Code": "ImageNotFoundException"}}
             raise error
         key = "enhancedFindings" if self.enhanced_findings else "findings"
+        if self.pages is not None:
+            index = int(nextToken or "0")
+            answer = {
+                "imageScanStatus": {"status": status},
+                "imageScanFindings": {
+                    key: list(self.pages[index]),
+                    "imageScanCompletedAt": "2026-09-12T09:00:00Z",
+                },
+            }
+            if index + 1 < len(self.pages):
+                answer["nextToken"] = str(index + 1)
+            return answer
         return {
             "imageScanStatus": {"status": status},
             "imageScanFindings": {
@@ -327,6 +344,31 @@ class TestTheScan:
         assert raised.value.code.code == "DL_ENV_PROVIDER_ERROR"
         assert raised.value.detail["digest"] == DIGEST
 
+    def test_every_page_of_findings_is_read_before_deciding(self) -> None:
+        """Found live, 2026-09-14: a single unpaginated call answered only its
+        first page, and a real image with 1,547 findings across many pages
+        passed a decision that should have blocked — none of its 31 critical
+        findings were on the one page a single call happened to see. Every
+        page is now read and merged before `decide` runs."""
+        page_1 = [enhanced("CVE-2026-1111", "LOW")]
+        page_2 = [enhanced("CVE-2026-1234", "CRITICAL", fixed="2.9.15")]
+        page_3 = [enhanced("CVE-2026-2222", "MEDIUM")]
+        ecr = FakeEcr(pages=[page_1, page_2, page_3])
+        decision = an_attestor(ecr=ecr).scan(repository=REPOSITORY, digest=DIGEST)
+        assert decision.decision == "blocked"
+        assert [finding.id for finding in decision.blocking] == ["CVE-2026-1234"]
+        assert decision.body()["counts"] == {"LOW": 1, "CRITICAL": 1, "MEDIUM": 1}
+        assert ecr.asked == 3
+
+    def test_reading_pages_stops_at_the_cap_rather_than_paginating_forever(self) -> None:
+        pages = [
+            [enhanced(f"CVE-2026-{n:04d}", "LOW")] for n in range(Attestor._MAX_FINDING_PAGES + 5)
+        ]
+        ecr = FakeEcr(pages=pages)
+        decision = an_attestor(ecr=ecr).scan(repository=REPOSITORY, digest=DIGEST)
+        assert decision.decision == "pass"
+        assert ecr.asked == Attestor._MAX_FINDING_PAGES
+
     IMAGE = "sha256:" + "bb" * 32
     ATTESTATION = "sha256:" + "cc" * 32
 
@@ -418,6 +460,10 @@ class TestTheSignature:
             # default and prompts for consent to publish an immutable
             # record — the wrong default for a private environment.
             "--tlog-upload=false",
+            # cosign 3.1.3 defaults to a TUF-provided signing config that
+            # `--tlog-upload=false` alone can no longer override (found live
+            # 2026-09-14): turned off so the plain flag is honored again.
+            "--use-signing-config=false",
             "--key",
             KEY,
             f"{REGISTRY}/{REPOSITORY}@{DIGEST}",