[rmcdaniel]

Verify production image inputs and effective trust

Refs #271 and durable-workflow/.github#237. This changes the root application image. Its final cb3b9c30 source is incorporated in combined PR #270, which will deliver both production and development fixes. Keep this draft unmerged; close it as delivered after the combined source qualifies and merges.

• Pin the PHP 8.4.27, Composer 2.10.3 and Node 22.23.4 multi-platform inputs by reviewed digest. Preserve application dependency locks and package versions.
• Check actual PHP/Composer versions, configured CA files and directories, parsed certificate subjects and enabled TLS before apt and Composer requests. Repeat after OS and browser installation.
• Check Node's actual default CA store with tls.getCACertificates('default') before npm, after copying the runtime into the final image, and after browser installation. This includes configured extra/system roots, rather than inspecting only the bundled snapshot. TLS verification must remain enabled.
• Use the fixed Node runtime for ordinary source tests. Extend the existing Compose smoke to independent native amd64/arm64 runners, cold input builds, copied-runtime verification, browser startup and the existing embedded workflow scenarios. No registry publication is added.

Focused results: all three new immutable-input/order controls fail on the unchanged Dockerfile; the final correction passes three tests / 22 assertions. On the exact pinned Node input, all five process controls pass, including blocked extra/default roots, an empty default store and disabled verification. The real default store has 116 roots / zero blocked subjects. The public PEM fixture is synthetic; no private key is committed. The locked frontend installs all 87 packages and builds successfully with lifecycle scripts disabled.

Component source 45f108c17c1b429bd4fd55417d8c1fe59328ed37, whole tree 8c642ee06d4acc92f6ac2bb099a6e6549b0e5d9a, has cold image run 39829977835 passing both native amd64 and arm64 jobs, including copied-runtime trust, browser startup, embedded workflows and teardown. Each job verifies the built platform and exact checkout revision label. The amd64 image is sha256:f603d2107f39d49f7dd9f2be225dc8d1f786cda7e003aece23d87ce4686c16b0, labelled with synthetic checkout 2cbda352ec4a457670c1bfb0920e8d1e3f37a345. Final cb3b9c30 restores the existing required status name as the aggregate over both architectures. Combined #270 must qualify its own complete tree.

The initial candidate's Sonar failure remains recorded. The final source fixes npm lifecycle-script execution, generic exception handling and Docker ordering findings. The three readable-tag-plus-digest findings are accepted individually because the reviewed digests make these inputs immutable; no quality profile or threshold changed. Its Sonar passes with zero OPEN/CONFIRMED findings. Cancellation requests for optional unchanged SDK scenarios were not treated as proof of completed cancellation. The required source and image jobs were preserved; current combined results are recorded on #270.

Draft, delivered through #270 after its independent qualification. The cross-repository CI trust rollout remains open.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
3 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The complete source is delivered through merged #270 at 910f928 / whole tree ddbea538b1faf41a5c091641b8de71fcfe118357. Its exact bd5a08b candidate passes all 28 checks, including native amd64/arm64 root-image/browser/workflow qualification and all SDK originals. This supersedes the separate merge of this draft; closing it as delivered through #270. Publication and installed acceptance remain open on #271 and shared #237, with main image run 39848751833 still pending. Earlier failed observations remain failed on their original sources.