From f5aca0af9ebbd8c022b2db9b500ff700943fda8e Mon Sep 17 00:00:00 2001 From: Steve Beattie Date: Wed, 28 Oct 2026 20:26:12 -0700 Subject: [PATCH] ci: allow apt HTTPS SRV lookups and sigstore TUF in harden-runner Follow-up to #2715. The HTTPS apt fallbacks now work, but before connecting to them apt's https method does an SRV lookup for _https._tcp., which harden-runner drops and reports as an anomalous call. The jobs still pass (apt falls back to A records), but the StepSecurity Harden-Runner summary check stays red on every PR where the Azure mirror flakes. Allow the SRV names for both fallback hosts in test-packages and build-packages, matching the existing _https._tcp.esm/motd.ubuntu.com entries. Also allow tuf-repo-cdn.sigstore.dev:443 in wolfi-presubmit's build-packages. wolfi-dev/os 208e4a2c1f (2026-10-24) added upstream-tests/go-test to gitsign.yaml, so the gitsign leg now runs gitsign's Go test suite, which fetches the sigstore TUF trust root. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/melange-test-pipelines.yaml | 2 ++ .github/workflows/wolfi-presubmit.yaml | 3 +++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/melange-test-pipelines.yaml b/.github/workflows/melange-test-pipelines.yaml index 89607a368..ea08cbdd9 100644 --- a/.github/workflows/melange-test-pipelines.yaml +++ b/.github/workflows/melange-test-pipelines.yaml @@ -151,10 +151,12 @@ jobs: *.githubapp.com:443 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 _http._tcp.azure.archive.ubuntu.com:443 + _https._tcp.archive.ubuntu.com:443 _https._tcp.dl.google.com:443 _https._tcp.esm.ubuntu.com:443 _https._tcp.motd.ubuntu.com:443 _https._tcp.packages.microsoft.com:443 + _https._tcp.security.ubuntu.com:443 api.github.com:443 apk.cgr.dev:443 archive.ubuntu.com:443 diff --git a/.github/workflows/wolfi-presubmit.yaml b/.github/workflows/wolfi-presubmit.yaml index 0496fcb12..a5683488c 100644 --- a/.github/workflows/wolfi-presubmit.yaml +++ b/.github/workflows/wolfi-presubmit.yaml @@ -105,10 +105,12 @@ jobs: *.githubapp.com:443 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 _http._tcp.azure.archive.ubuntu.com:443 + _https._tcp.archive.ubuntu.com:443 _https._tcp.dl.google.com:443 _https._tcp.esm.ubuntu.com:443 _https._tcp.motd.ubuntu.com:443 _https._tcp.packages.microsoft.com:443 + _https._tcp.security.ubuntu.com:443 api.github.com:443 api.ipify.org:443 apk.cgr.dev:443 @@ -160,6 +162,7 @@ jobs: time3.google.com:443 time4.google.com:123 time4.google.com:443 + tuf-repo-cdn.sigstore.dev:443 www.oberhumer.com:443 www.sudo.ws:443 yarnpkg.com:443