code-sandboxes 1.9.7__tar.gz → 1.9.9__tar.gz

{code_sandboxes-1.9.7 → code_sandboxes-1.9.9}/CHANGELOG.md

@@ -8,6 +8,32 @@
 
 ## Unreleased
 
+## 1.9.9
+
+- **cosign gets the same registry credential the build pushed with**
+  (`environments.attest`; PLAN_ENV.md D-17, E1-09). cosign has no AWS
+  credential chain of its own for ECR, unlike the boto3 client the scan is
+  read with. Found live on r1, 2026-09-14: `cosign sign` reached the
+  repository anonymously and was refused, plain `401 Unauthorized`, on
+  every real artifact this pipeline ever tried to sign. `Attestor` takes a
+  `registry_auth` — the same `{"DOCKER_CONFIG": <dir>}` shape the resolver
+  and the builder already read off a `BuildCredential` — and sets it on
+  cosign's own subprocess, added to this process's own environment rather
+  than replacing it.
+
+## 1.9.8
+
+- **Every page of a scan's findings is read before deciding**
+  (`environments.attest`; PLAN_ENV.md E1-08, D-11). `describe_image_scan_
+  findings` paginates, and the attestor called it exactly once. Found live
+  on r1, 2026-09-14: the first real image with more findings than one page
+  had 1,547 enhanced findings, 31 of them critical, and the single-page read
+  saw a small enough slice that the decision passed — an image with real,
+  unreviewed critical vulnerabilities would have been signed and started. A
+  hard cap of 50 pages keeps a pathological registry from paginating
+  forever; hitting it logs that more findings went unread rather than
+  pretending the scan was complete.
+
 ## 1.9.7
 
 - **cosign signs again under `--use-signing-config=false`** (`environments

{code_sandboxes-1.9.7 → code_sandboxes-1.9.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.7
+Version: 1.9.9
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.7 → code_sandboxes-1.9.9}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.7"
+__version__ = "1.9.9"

{code_sandboxes-1.9.7 → code_sandboxes-1.9.9}/code_sandboxes/environments/attest.py

@@ -150,6 +150,15 @@ class Attestor:
     policy
         What the findings have to say. The owner's default unless an
         organization tightened it (E3-06).
+    registry_auth
+        What cosign reads the repository with, to sign it (D-17): the same
+        `{"DOCKER_CONFIG": <dir>}` shape the resolver and the builder already
+        take off a `BuildCredential`, the one attribute name every caller
+        reads regardless of what kind of credential it holds. cosign has no
+        AWS credential chain of its own for ECR, unlike the boto3 client the
+        scan is read with — found live, 2026-09-14: with none, `cosign sign`
+        reached the registry anonymously and was refused, `401 Unauthorized`,
+        on every real artifact this pipeline ever tried to sign.
     """
 
     def __init__(
@@ -166,6 +175,7 @@ class Attestor:
         scan_timeout_seconds: float = DEFAULT_SCAN_TIMEOUT_SECONDS,
         scan_interval_seconds: float = DEFAULT_SCAN_INTERVAL_SECONDS,
         log: Callable[[str], None] | None = None,
+        registry_auth: Mapping[str, str] | None = None,
     ) -> None:
         self._ecr = ecr
         self._cosign = (shutil.which("cosign") or "") if cosign is None else cosign
@@ -178,6 +188,7 @@ class Attestor:
         self._timeout = scan_timeout_seconds
         self._interval = scan_interval_seconds
         self._log = log or (lambda _line: None)
+        self._registry_auth = dict(registry_auth or {})
 
     # -- the scan -------------------------------------------------------------
 
@@ -289,32 +300,70 @@ class Attestor:
             detail={"repository": repository, "digest": digest},
         )
 
+    #: A hard cap on pages read, so a registry that never stops paginating
+    #: cannot wedge a build forever — this many pages is already far past any
+    #: real image's own finding count (E1-08, found live 2026-09-14: see
+    #: `_describe`'s own docstring for why a page limit is not optional).
+    _MAX_FINDING_PAGES = 50
+
     def _describe(self, *, repository: str, digest: str) -> tuple[str, dict[str, Any]]:
-        """One `DescribeImageScanFindings`, as a status and what it answered."""
-        try:
-            answer = self._client().describe_image_scan_findings(
-                repositoryName=repository, imageId={"imageDigest": digest}
-            )
-        except Exception as error:
-            if _is_in_progress(error):
-                return "IN_PROGRESS", {}
-            if _is_missing(error):
+        """Every `DescribeImageScanFindings` page, as one status and one answer.
+
+        ECR paginates enhanced findings — `nextToken`, not a field this call
+        can ask to skip — and a single unpaginated call answers only its first
+        page. Found live, 2026-09-14: the first real artifact this pipeline
+        scanned had 1,547 enhanced findings across many pages and 31 of them
+        critical, and a single-page read passed a decision that should have
+        blocked, because none of those 31 were in the one page it happened to
+        see. Every page is read and merged before `decide` ever runs.
+        """
+        pages = 0
+        status = ""
+        enhanced: list[Any] = []
+        basic: list[Any] = []
+        completed_at: Any = None
+        token: str | None = None
+        while True:
+            try:
+                kwargs: dict[str, Any] = {
+                    "repositoryName": repository,
+                    "imageId": {"imageDigest": digest},
+                }
+                if token:
+                    kwargs["nextToken"] = token
+                answer = self._client().describe_image_scan_findings(**kwargs)
+            except Exception as error:
+                if _is_in_progress(error):
+                    return "IN_PROGRESS", {}
+                if _is_missing(error):
+                    raise EnvironmentsError(
+                        PROVIDER_ERROR,
+                        f"The registry has no scan for {digest}: {error}",
+                        detail={"repository": repository, "digest": digest},
+                    ) from error
                 raise EnvironmentsError(
                     PROVIDER_ERROR,
-                    f"The registry has no scan for {digest}: {error}",
+                    f"The scan of {digest} could not be read: {error}",
                     detail={"repository": repository, "digest": digest},
                 ) from error
-            raise EnvironmentsError(
-                PROVIDER_ERROR,
-                f"The scan of {digest} could not be read: {error}",
-                detail={"repository": repository, "digest": digest},
-            ) from error
-        status = str(((answer.get("imageScanStatus") or {}).get("status")) or "")
-        findings = answer.get("imageScanFindings") or {}
+            status = str(((answer.get("imageScanStatus") or {}).get("status")) or "")
+            findings = answer.get("imageScanFindings") or {}
+            enhanced.extend(findings.get("enhancedFindings") or [])
+            basic.extend(findings.get("findings") or [])
+            completed_at = findings.get("imageScanCompletedAt") or completed_at
+            pages += 1
+            token = answer.get("nextToken")
+            if not token or pages >= self._MAX_FINDING_PAGES:
+                if token:
+                    self._log(
+                        f"Stopped reading {digest}'s scan after {pages} pages, "
+                        "with more findings still unread"
+                    )
+                break
         return status, {
-            "findings": findings,
-            "completed_at": findings.get("imageScanCompletedAt"),
-            "scanner": "ECR enhanced" if findings.get("enhancedFindings") else "ECR basic",
+            "findings": {"enhancedFindings": enhanced, "findings": basic},
+            "completed_at": completed_at,
+            "scanner": "ECR enhanced" if enhanced else "ECR basic",
         }
 
     @staticmethod
@@ -421,9 +470,19 @@ class Attestor:
         return bool(answer.get("imageDetails"))
 
     def _invoke(self, command: Sequence[str]) -> subprocess.CompletedProcess[str]:
+        # `registry_auth` — same shape as the resolver's own — puts cosign's
+        # `DOCKER_CONFIG` beside the rest of this process's environment,
+        # never replacing it: `--key` alone still needs AWS's own chain to
+        # reach the KMS key, which this does not touch.
+        env = {**os.environ, **self._registry_auth} if self._registry_auth else None
         try:
             finished = self._run(
-                list(command), capture_output=True, text=True, check=False, timeout=self._timeout
+                list(command),
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=self._timeout,
+                env=env,
             )
         except subprocess.TimeoutExpired as expired:
             raise EnvironmentsError(
@@ -514,6 +573,7 @@ def attest_artifact(
         key=str(getattr(credential, "signing_key", "") or ""),
         policy=policy,
         log=log,
+        registry_auth=getattr(credential, "registry_auth", None),
     )
     return use.attest(
         registry=registry,

{code_sandboxes-1.9.7 → code_sandboxes-1.9.9}/tests/test_environment_attest.py

@@ -90,9 +90,14 @@ class FakeEcr:
         enhanced_findings=True,
         signed: set[str] | None = None,
         manifest: dict | None = None,
+        pages: list[list[dict]] | None = None,
     ) -> None:
         self.statuses = list(statuses)
         self.findings = list(findings)
+        #: Each entry is one `describe_image_scan_findings` page's own
+        #: findings, read in order and merged by `_describe` — overrides
+        #: `findings` when given, to test reading more than one page.
+        self.pages = pages
         self.enhanced_findings = enhanced_findings
         self.signed = set(signed or set())
         self.manifest = manifest
@@ -115,7 +120,7 @@ class FakeEcr:
             ]
         }
 
-    def describe_image_scan_findings(self, repositoryName, imageId):  # noqa: N803 - boto3's spelling
+    def describe_image_scan_findings(self, repositoryName, imageId, nextToken=None):  # noqa: N803 - boto3's spelling
         self.asked += 1
         self.scanned.append(imageId["imageDigest"])
         status = self.statuses[min(self.asked, len(self.statuses)) - 1]
@@ -132,6 +137,18 @@ class FakeEcr:
             error.response = {"Error": {"Code": "ImageNotFoundException"}}
             raise error
         key = "enhancedFindings" if self.enhanced_findings else "findings"
+        if self.pages is not None:
+            index = int(nextToken or "0")
+            answer = {
+                "imageScanStatus": {"status": status},
+                "imageScanFindings": {
+                    key: list(self.pages[index]),
+                    "imageScanCompletedAt": "2026-09-12T09:00:00Z",
+                },
+            }
+            if index + 1 < len(self.pages):
+                answer["nextToken"] = str(index + 1)
+            return answer
         return {
             "imageScanStatus": {"status": status},
             "imageScanFindings": {
@@ -151,14 +168,16 @@ class FakeEcr:
 
 
 class Cosign:
-    """A cosign whose argv is read, and which can refuse."""
+    """A cosign whose argv and env are read, and which can refuse."""
 
     def __init__(self, returncode: int = 0) -> None:
         self.returncode = returncode
         self.argv: list[str] = []
+        self.env: dict[str, str] | None = None
 
-    def __call__(self, argv, **_kwargs) -> subprocess.CompletedProcess[str]:
+    def __call__(self, argv, *, env=None, **_kwargs) -> subprocess.CompletedProcess[str]:
         self.argv = list(argv)
+        self.env = env
         return subprocess.CompletedProcess(self.argv, self.returncode, "", "Pushing signature\n")
 
 
@@ -327,6 +346,31 @@ class TestTheScan:
         assert raised.value.code.code == "DL_ENV_PROVIDER_ERROR"
         assert raised.value.detail["digest"] == DIGEST
 
+    def test_every_page_of_findings_is_read_before_deciding(self) -> None:
+        """Found live, 2026-09-14: a single unpaginated call answered only its
+        first page, and a real image with 1,547 findings across many pages
+        passed a decision that should have blocked — none of its 31 critical
+        findings were on the one page a single call happened to see. Every
+        page is now read and merged before `decide` runs."""
+        page_1 = [enhanced("CVE-2026-1111", "LOW")]
+        page_2 = [enhanced("CVE-2026-1234", "CRITICAL", fixed="2.9.15")]
+        page_3 = [enhanced("CVE-2026-2222", "MEDIUM")]
+        ecr = FakeEcr(pages=[page_1, page_2, page_3])
+        decision = an_attestor(ecr=ecr).scan(repository=REPOSITORY, digest=DIGEST)
+        assert decision.decision == "blocked"
+        assert [finding.id for finding in decision.blocking] == ["CVE-2026-1234"]
+        assert decision.body()["counts"] == {"LOW": 1, "CRITICAL": 1, "MEDIUM": 1}
+        assert ecr.asked == 3
+
+    def test_reading_pages_stops_at_the_cap_rather_than_paginating_forever(self) -> None:
+        pages = [
+            [enhanced(f"CVE-2026-{n:04d}", "LOW")] for n in range(Attestor._MAX_FINDING_PAGES + 5)
+        ]
+        ecr = FakeEcr(pages=pages)
+        decision = an_attestor(ecr=ecr).scan(repository=REPOSITORY, digest=DIGEST)
+        assert decision.decision == "pass"
+        assert ecr.asked == Attestor._MAX_FINDING_PAGES
+
     IMAGE = "sha256:" + "bb" * 32
     ATTESTATION = "sha256:" + "cc" * 32
 
@@ -429,6 +473,35 @@ class TestTheSignature:
         assert reference == f"{REGISTRY}/{REPOSITORY}:{signature_tag(DIGEST)}"
         assert signed_now is True
 
+    def test_no_registry_auth_leaves_cosigns_own_environment_untouched(self) -> None:
+        """The common case — nothing to add — inherits this process's own
+        environment rather than replacing it with an empty one."""
+        cosign = Cosign()
+        an_attestor(run=cosign).sign(registry=REGISTRY, repository=REPOSITORY, digest=DIGEST)
+        assert cosign.env is None
+
+    def test_registry_auth_reaches_cosign_as_docker_config(self) -> None:
+        """cosign has no AWS credential chain of its own for ECR, unlike the
+        boto3 client the scan is read with: found live, 2026-09-14, `cosign
+        sign` reached the registry anonymously and was refused with a plain
+        `401 Unauthorized` on every real artifact this pipeline tried to
+        sign. The same `{"DOCKER_CONFIG": <dir>}` the resolver and the
+        builder already take off a `BuildCredential` fixes it here too."""
+        docker_config = "/tmp/dl-docker-abc"  # noqa: S108 - a build's own dir, never touched by this test
+        cosign = Cosign()
+        an_attestor(run=cosign, registry_auth={"DOCKER_CONFIG": docker_config}).sign(
+            registry=REGISTRY, repository=REPOSITORY, digest=DIGEST
+        )
+        assert cosign.env is not None
+        assert cosign.env["DOCKER_CONFIG"] == docker_config
+        # Added to this process's own environment, not instead of it — cosign
+        # still needs AWS's own chain to reach the KMS key with `--key`.
+        import os
+
+        for name in ("PATH", "HOME"):
+            if name in os.environ:
+                assert cosign.env[name] == os.environ[name]
+
     def test_a_replay_finds_the_signature_instead_of_pushing_a_second(self) -> None:
         """Immutable tags would refuse the second, and two signatures are two words."""
         ecr = FakeEcr(signed={signature_tag(DIGEST)})