[stevebeattie]

Summary

Follow-up to #2715. Since it merged, the apt jobs pass, but the StepSecurity Harden-Runner summary check is still red on most PRs because of two kinds of blocked DNS lookup.

1. apt SRV lookups for the HTTPS fallback mirrors

#2715 allowed archive.ubuntu.com:443 and security.ubuntu.com:443, the HTTPS fallbacks in the runner image's /etc/apt/apt-mirrors.txt. The fallback works: on #2715's own CI, the Azure mirror failed mid-install and apt downloaded qemu-system-x86 from https://archive.ubuntu.com instead (job log).

Before connecting, apt's https method looks up an SRV record for _https._tcp.<host>. harden-runner drops that lookup and flags it. apt carries on with a normal DNS lookup, so nothing fails, but the alert appears whenever the Azure mirror flakes: on #2715, #2716, #2718, #2719 and #2722. The original failing trace on #2714 shows the same dropped lookup for _https._tcp.security.ubuntu.com.

This adds both SRV names, matching the existing _https._tcp.esm.ubuntu.com and _https._tcp.motd.ubuntu.com entries.

2. tuf-repo-cdn.sigstore.dev in wolfi-presubmit

wolfi-dev/os@208e4a2c1f (2026-10-24, "ci: run upstream go tests for 9 packages") added upstream-tests/go-test to gitsign.yaml. The Build packages (qemu, gitsign) leg of wolfi-presubmit builds wolfi-dev/os at HEAD, so it now runs gitsign's own Go test suite, and that suite fetches the sigstore TUF trust root. The timing matches: runs before 10-24 (#2718, #2719) don't show this lookup, and runs after it do (#2662, #2716, #2722, #2723). The tests currently pass with it blocked.

Approved endpoints

Endpoint	Jobs	Rationale
_https._tcp.archive.ubuntu.com:443	test-packages, build-packages	SRV lookup apt does before using the archive.ubuntu.com HTTPS fallback
_https._tcp.security.ubuntu.com:443	test-packages, build-packages	SRV lookup apt does before using the security.ubuntu.com HTTPS fallback
tuf-repo-cdn.sigstore.dev:443	build-packages (wolfi-presubmit)	sigstore TUF trust root, fetched by gitsign's upstream Go test suite

Normalization notes

Entries are inserted in the existing alphabetical order. No existing entries were changed or removed.

Links

• Harden-Runner alerts: ci: allow HTTPS Ubuntu archive fallbacks in harden-runner #2715, feat: add opt-in structured execution reports for build and test pipelines #2716, perf(git-checkout): read verify_worktree's hashes in step with the index #2718, feat(build): add --strict-sources-from-cache for git-checkout #2719, build(deps): bump the gomod group across 1 directory with 4 updates #2722 (_https._tcp.archive.ubuntu.com); refactor(license): use the shared chainguard.dev/license module #2662, feat: add opt-in structured execution reports for build and test pipelines #2716, build(deps): bump the gomod group across 1 directory with 4 updates #2722, build(deps): bump the actions group across 1 directory with 3 updates #2723 (tuf-repo-cdn.sigstore.dev)
• gitsign build with the upstream tests: https://github.com/chainguard-dev/melange/actions/runs/40664789348/job/122737170847
• Original apt failure trace: https://github.com/chainguard-dev/melange/actions/runs/39851311724

🤖 Generated with Claude Code

[stevebeattie]

Force pushed to correct the gitsign signature.