Add APK security reports

2026-08-24 10:09:00 +02:00
parent 479886d37d
commit 8d98ccf093
6 changed files with 255 additions and 0 deletions
@@ -0,0 +1,44 @@
+# Project Review and Development Roadmap
+
+## Current State
+
+This repository packages four upstream services for Alpine 3.24, with source
+builds, binary repackages, OpenRC integration, Docker-based local builds, and
+CI publication to the Gitea Alpine registry. Package selection avoids rebuilding
+unchanged versions already present in the registry.
+
+The main release risks are missing retained build artifacts, permissive duplicate
+publish handling, rolling toolchain inputs, and limited end-to-end service
+validation. Documentation and test defaults must remain synchronized with each
+`APKBUILD` version.
+
+## Prioritized Goals
+
+1. **Reproducible, auditable releases.** Split build and publish work so publish
+   consumes a retained APK artifact plus a checksum manifest; verify registry
+   contents after upload and reject mismatched duplicate versions.
+2. **Build security visibility.** Generate an installed-rootfs CycloneDX SBOM
+   and advisory Trivy report for every package and architecture selected by CI.
+   Retain reports as Gitea workflow artifacts.
+3. **Service-level confidence.** Add bounded readiness checks for Gitea,
+   LavinMQ, and GreptimeDB; retain SeaweedFS role startup coverage.
+4. **Automation correctness.** Add fixture-based tests for package selection,
+   APKINDEX parsing, metadata/version drift, and registry error paths.
+5. **Developer feedback and cost.** Record build durations/cache outcomes,
+   keep package-scoped validation, and add a scheduled update-report workflow.
+
+## Security Reports
+
+`mise run apk:security-report` scans the installed root filesystem for each
+selected local package. It writes advisory reports under:
+
+```text
+packages/security-reports/<package>/<architecture>/
+├── trivy.json
+├── sbom.cdx.json
+└── summary.md
+```
+
+The scan includes the package, its selected subpackages, and resolved runtime
+dependencies from the signed local repository. Findings do not block a build yet; report generation,
+package installation, and report validation do.