Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
312 commits
Select commit Hold shift + click to select a range
562da2b
Update buildscript.sh
0mniteck Mar 21, 2026
8ef6d96
Update buildscript.sh
0mniteck Mar 21, 2026
c647443
Update buildscript.sh
0mniteck Mar 21, 2026
656a68a
Update buildscript.sh
0mniteck Mar 21, 2026
4c3009b
Update buildscript.sh
0mniteck Mar 21, 2026
c19d2da
Update buildscript.sh
0mniteck Mar 21, 2026
ee7047f
Update buildscript.sh
0mniteck Mar 21, 2026
686e513
Update buildscript.sh
0mniteck Mar 21, 2026
c0b5606
Update buildscript.sh
0mniteck Mar 22, 2026
85264a1
Update buildscript.sh
0mniteck Mar 22, 2026
88c5f1f
Update buildscript.sh
0mniteck Mar 22, 2026
723319c
Update buildscript.sh
0mniteck Mar 22, 2026
942b106
Update buildscript.sh
0mniteck Mar 22, 2026
3564f27
Update buildscript.sh
0mniteck Mar 22, 2026
0f03263
Update buildscript.sh
0mniteck Mar 22, 2026
4c13c36
Update Dockerfile
0mniteck Mar 25, 2026
4a04755
Update Dockerfile
0mniteck Mar 25, 2026
4e5a118
Update Dockerfile
0mniteck Mar 25, 2026
922c4d6
Update .pinned_ver
0mniteck Mar 25, 2026
7ac536b
Update signal-buildscript.sh
0mniteck Mar 25, 2026
c236d49
Create 0mniteck.rego
0mniteck Mar 25, 2026
ccb03d5
Update 0mniteck.rego
0mniteck Mar 25, 2026
b4abee6
Update 0mniteck.rego
0mniteck Mar 25, 2026
6885d94
Update modules
0mniteck Mar 25, 2026
5bc7a0e
Update modules
0mniteck Mar 25, 2026
aac96fa
Update modules
0mniteck Mar 25, 2026
0888463
Update buildscript.sh
0mniteck Mar 25, 2026
60e1b94
Update buildscript.sh
0mniteck Mar 25, 2026
18865a7
Update 0mniteck.rego
0mniteck Mar 25, 2026
eee7a5e
Update modules
0mniteck Mar 25, 2026
9e54088
Update .pinned_ver
0mniteck Mar 25, 2026
ae4eff7
Update modules
0mniteck Mar 25, 2026
6e850c2
Update 0mniteck.rego
0mniteck Mar 25, 2026
b668078
Update 0mniteck.rego
0mniteck Mar 25, 2026
553c85f
Update 0mniteck.rego
0mniteck Mar 25, 2026
71360c7
Update docker buildx command for logging and policy
0mniteck Mar 25, 2026
b3d8630
Update 0mniteck.rego
0mniteck Mar 25, 2026
da18519
Update Dockerfile
0mniteck Mar 25, 2026
d39b1ba
Update allowed Docker Hub images and add comments
0mniteck Mar 25, 2026
46f3434
Update modules
0mniteck Mar 25, 2026
a6077d5
Update .identity
0mniteck Mar 25, 2026
e7cc92b
Refactor usage and error handling in buildscript.sh
0mniteck Mar 26, 2026
2421a42
Fix variable naming and update error handling
0mniteck Mar 26, 2026
02f25b1
Fix export statement formatting in buildscript.sh
0mniteck Mar 26, 2026
2b6da06
Update modules
0mniteck Mar 26, 2026
c15fa3f
Fix environment variable export syntax in buildscript
0mniteck Mar 26, 2026
e5d74fe
Update commit hash in .pinned_ver file
0mniteck Mar 26, 2026
f77d24e
Set default branch to 'main' in git config
0mniteck Mar 26, 2026
28214a7
Update .pinned_ver
0mniteck Mar 26, 2026
8f08808
Update environment variables in Dockerfile
0mniteck Mar 26, 2026
3300df7
Update version to 2.1 and change connectivity check
0mniteck Mar 26, 2026
b71546f
Refactor environment variable export in buildscript.sh
0mniteck Mar 26, 2026
3eaa6a9
Add files via upload
0mniteck Mar 26, 2026
c4b4086
Add Developer Certificate of Origin document
0mniteck Mar 26, 2026
fd6ebb1
Change file reference in Developer Certificate of Origin
0mniteck Mar 26, 2026
24ed02a
Update buildscript.sh to enhance logging and cleanup
0mniteck Mar 26, 2026
f27b662
Refactor RUN command in Dockerfile for visual clarity
0mniteck Mar 26, 2026
efd0f0c
Adjust .gitattributes for file formatting
0mniteck Mar 26, 2026
c113cf7
Update signal-buildscript.sh
0mniteck Mar 27, 2026
235e99a
Fix docker run command for module execution
0mniteck Mar 27, 2026
cef2f92
Update signal-buildscript.sh
0mniteck Mar 27, 2026
cedf5d0
Update commit hash in .pinned_ver file
0mniteck Mar 27, 2026
d2e7eb5
Change COPY to ADD with checksum for buildscript
0mniteck Mar 27, 2026
f66b2b8
Update Dockerfile
0mniteck Mar 27, 2026
86b3971
Enhance rootlesskit with XDG session support
0mniteck Mar 27, 2026
cf7a4f4
Refactor buildscript for improved clarity and functionality
0mniteck Mar 27, 2026
3de7847
Improve test function and logging in buildscript.sh
0mniteck Mar 28, 2026
cb5e770
Update buildscript.sh
0mniteck Mar 28, 2026
6ba587d
Refactor identity script for SKIP_LOGIN test and using new anon key r…
0mniteck Mar 29, 2026
27e0b16
Fix user declaration formatting in .identity
0mniteck Mar 29, 2026
fe85d3d
Added priv mkdir daemon seend
0mniteck Mar 29, 2026
5baaf68
Refactor mount logic and cleanup in buildscript.sh
0mniteck Mar 29, 2026
6cc305a
Refactor buildscript.sh for improved execution
0mniteck Mar 29, 2026
53a883b
Change check_file condition from '1' to 'yes'
0mniteck Mar 29, 2026
5a066f1
Update buildscript.sh to improve command execution
0mniteck Mar 29, 2026
a8dfe02
Revise usage instructions and maintainer info
0mniteck Mar 29, 2026
1a91fcc
Refactor test function and update debug handling
0mniteck Mar 29, 2026
0742dc3
Update pkexec usage and variable assignments in script
0mniteck Mar 29, 2026
a9dd326
Improve variable handling and error management
0mniteck Mar 29, 2026
c6d9791
Refactor test function and update date variable
0mniteck Mar 29, 2026
ce7c0ed
Refactor id assignment in buildscript.sh
0mniteck Mar 29, 2026
10ef0ec
Update debug mode settings in buildscript.sh
0mniteck Mar 29, 2026
683df60
Update package installation in buildscript.sh
0mniteck Mar 29, 2026
5b13bd4
Modify buildscript for Docker installation and config
0mniteck Mar 29, 2026
57ddbe2
Refactor buildscript.sh for improved package management
0mniteck Mar 29, 2026
12cfd8b
Add overlay metacopy options in buildscript
0mniteck Mar 29, 2026
bd76545
Add AllowIsolate and ConditionUser to service config
0mniteck Mar 30, 2026
1565e47
Update docker service configuration in buildscript.sh
0mniteck Mar 30, 2026
aad78ce
Modify modprobe and sysctl commands for quiet output
0mniteck Mar 30, 2026
5fb2d7f
Refactor process management and cleanup logic
0mniteck Mar 30, 2026
fc5d860
Fix condition checks for xs.id in buildscript.sh
0mniteck Mar 30, 2026
6495441
Fix variable assignment and improve directory creation
0mniteck Mar 30, 2026
2a0aedf
Fix lsof command and improve process handling
0mniteck Mar 30, 2026
6f2576f
Enhance usage message and snap debug logging
0mniteck Mar 30, 2026
2b361ae
Add snapd cohort configuration to .pinned_ver
0mniteck Mar 31, 2026
efda2b1
Refine usage documentation and add commit message option
0mniteck Mar 31, 2026
ba360b3
Update cohort declaration in .pinned_ver
0mniteck Mar 31, 2026
5e242ec
Modify .pinned_ver for new cohort information
0mniteck Mar 31, 2026
78e61f0
Refactor Docker installation and snap commands
0mniteck Apr 1, 2026
fbe80bc
Improve Docker installation and removal commands
0mniteck Apr 1, 2026
cf2060f
Fix snap install command for syft and grype
0mniteck Apr 1, 2026
95b85a1
Update commit hash in .pinned_ver file
0mniteck Apr 1, 2026
6a8ad95
Fix snap install command for syft and grype
0mniteck Apr 1, 2026
c72ee60
Update snap install command for syft and grype
0mniteck Apr 1, 2026
bc86802
Split snap installation of syft and grype
0mniteck Apr 1, 2026
51fd2ea
Refactor snap install commands for syft, grype, and docker
0mniteck Apr 2, 2026
7365c54
Refactor snap command handling in buildscript.sh
0mniteck Apr 2, 2026
a6a527a
Fix docker rootless name in buildscript.sh
0mniteck Apr 2, 2026
1694f3f
Update docker snap installation command with version
0mniteck Apr 2, 2026
4f03c72
Fix docker snap installation name in buildscript.sh
0mniteck Apr 2, 2026
fb9d7c5
Update buildscript for docker_rootless support
0mniteck Apr 2, 2026
2d3d909
Update systemd_ctl_common to use rootless Docker
0mniteck Apr 2, 2026
4191622
Fix output redirection for snap info and events
0mniteck Apr 2, 2026
95758f3
Add conditional checks for snap installation commands
0mniteck Apr 2, 2026
e7ffb9c
Fix syntax in for loop in buildscript.sh
0mniteck Apr 2, 2026
874774b
Remove abs-time flag from snap debug timings
0mniteck Apr 2, 2026
e095d8c
Update buildscript.sh
0mniteck Apr 2, 2026
2578b19
Update buildscript.sh
0mniteck Apr 2, 2026
b8606ca
Update buildscript.sh
0mniteck Apr 6, 2026
aa49aa1
Update buildscript.sh
0mniteck Apr 6, 2026
3805dbc
Update buildscript.sh
0mniteck Apr 6, 2026
1998765
Update buildscript.sh
0mniteck Apr 6, 2026
4b26e8d
Update buildscript.sh
0mniteck Apr 6, 2026
7f184cc
Update .pinned_ver
0mniteck Apr 6, 2026
c80b032
Update .identity
0mniteck Apr 6, 2026
9d3284b
Many changes and improvements of the installation steps
0mniteck Apr 6, 2026
4327dce
small fix for json input
0mniteck Apr 6, 2026
cbc0784
Adjusted json input
0mniteck Apr 6, 2026
644b673
Improve debugger
0mniteck Apr 7, 2026
5708c05
Update buildscript.sh
0mniteck Apr 7, 2026
08a308f
Rewrote install to improve formatting. Attempted to fix while loop mi…
0mniteck Apr 7, 2026
8d93427
minor fix add fi to if
0mniteck Apr 7, 2026
1816dfd
Fix command substitution for seend, dir change daemon
0mniteck Apr 7, 2026
c7f60eb
Debugging dockerd service files
0mniteck Apr 7, 2026
64c3bb4
Update buildscript.sh
0mniteck Apr 7, 2026
563f2fb
Update buildscript.sh
0mniteck Apr 7, 2026
dbd7ab1
Many changes
0mniteck Apr 7, 2026
4d69f3b
Minor formatting fixes
0mniteck Apr 7, 2026
a3eb70c
Fix minor formatting issue
0mniteck Apr 7, 2026
bfd9eba
Fix line ending
0mniteck Apr 7, 2026
41657af
Fix missing -p
0mniteck Apr 7, 2026
5214fb3
Fixed unescaped quote
0mniteck Apr 7, 2026
fc15d53
Refactor entire script
0mniteck Apr 7, 2026
88bcebe
Fix typo
0mniteck Apr 7, 2026
33a518e
Update buildscript.sh
0mniteck Apr 7, 2026
5d0208f
Update buildscript.sh
0mniteck Apr 8, 2026
ad4091f
Update buildscript.sh
0mniteck Apr 8, 2026
e35ceea
Update buildscript.sh
0mniteck Apr 8, 2026
f6b5f8b
Update CNAME
0mniteck Apr 8, 2026
ad15476
Fixed formatting
0mniteck Apr 8, 2026
1528bf7
Update buildscript.sh
0mniteck Apr 8, 2026
81cdf0e
Update buildscript.sh
0mniteck Apr 8, 2026
5ca2b64
Update buildscript.sh
0mniteck Apr 9, 2026
15fda13
Update .pinned_ver
0mniteck Apr 11, 2026
e18a8fb
Update buildscript.sh
0mniteck Apr 11, 2026
d640c7f
Update buildscript.sh
0mniteck Apr 11, 2026
50f92a1
Update buildscript.sh
0mniteck Apr 11, 2026
30cccc9
Update buildscript.sh
0mniteck Apr 11, 2026
2347721
Update credential helper version to v0.9.6
0mniteck Apr 21, 2026
c031763
Refactor docker commands and cleanup operations
0mniteck Apr 21, 2026
729260d
Update commit hash in .pinned_ver file
0mniteck Apr 22, 2026
a6b3c22
Handle errors for update-alternatives command
0mniteck Apr 22, 2026
3d42378
Fix apt-get command syntax in buildscript.sh
0mniteck Apr 29, 2026
448af86
Update commit hash and cohort key comments
0mniteck Apr 29, 2026
21d3b51
Update docker snap versions in .pinned_ver
0mniteck Apr 29, 2026
76a5de0
Refactor package installation and update logic
0mniteck Apr 29, 2026
2e2096b
Refactor pushd and popd commands in buildscript.sh
0mniteck Apr 29, 2026
59cb2c8
Remove Docker buildx create command
0mniteck Apr 29, 2026
70b353c
Replace docker buildx command
0mniteck Apr 29, 2026
86fa168
Fix syntax errors in runtime script
0mniteck Apr 29, 2026
6af0637
Refactor buildscript to source runtime and log cgroups
0mniteck Apr 29, 2026
d89a5b8
Modify git fetch command to use variable for shallow
0mniteck Apr 29, 2026
3dc0818
Fix prompt quotes and shallow fetch condition
0mniteck Apr 29, 2026
758bcf0
Add funding configuration file
0mniteck Apr 29, 2026
48d48d6
Rename funding.yml to Funding.yml
0mniteck Apr 29, 2026
6d2ac93
Modify git fetch logic in buildscript.sh
0mniteck Apr 30, 2026
477c319
Enhance user prompt for git fetch depth option
0mniteck Apr 30, 2026
ce8772f
Update cgroup base and user service paths
0mniteck Apr 30, 2026
205b45e
Fix variable substitution and update environment files
0mniteck Apr 30, 2026
6624b26
Fix string escaping in git fetch prompt condition
0mniteck Apr 30, 2026
aac01dc
Fix rootlesskit command arguments in buildscript.sh
0mniteck Apr 30, 2026
418220e
Refactor unmount function and add run_plugins handling
0mniteck Apr 30, 2026
56b9e81
Revise WIP section in README.md
0mniteck Apr 30, 2026
02a4231
Update readme for rootless builds description
0mniteck Apr 30, 2026
ad4960f
Update README with new tasks and formatting changes
0mniteck Apr 30, 2026
b755738
Modify base image builds to include attestation
0mniteck Apr 30, 2026
dab7f27
Refactor buildscript.sh for improved readability
0mniteck Apr 30, 2026
440b6e2
Fix mkdir and clean_most commands in buildscript.sh
0mniteck Apr 30, 2026
51cb3ed
Improve error handling for snap ack command
0mniteck Apr 30, 2026
b99f214
Update SSH config handling and git fetch prompt
0mniteck Apr 30, 2026
59ec863
Refactor debugger info saving process in buildscript
0mniteck Apr 30, 2026
19d8995
Fix formatting issues in buildscript.sh
0mniteck Apr 30, 2026
35e71b3
Fix formatting in README for pubkey pinning item
0mniteck Apr 30, 2026
c905448
Fix SSH_CONF variable assignment in buildscript.sh
0mniteck Apr 30, 2026
9bb89e2
Refactor buildscript.sh for directory creation and cleanup
0mniteck Apr 30, 2026
6a18e33
Refactor directory setup and rootless environment script
0mniteck Apr 30, 2026
3bb8143
Use '-f' flag for file operations in buildscript.sh
0mniteck Apr 30, 2026
f554a62
Refactor docker plugin paths and update configurations
0mniteck Apr 30, 2026
6b3f94a
Fix rootlesskit command options in buildscript.sh
0mniteck Apr 30, 2026
cec98e5
Fix syntax and formatting issues in buildscript.sh
0mniteck Apr 30, 2026
a845845
Fix command execution in buildscript.sh
0mniteck Apr 30, 2026
aeb45fe
Refactor service slice configuration in buildscript.sh
0mniteck Apr 30, 2026
6845490
Add CPU and IO resource limits to systemd service
0mniteck Apr 30, 2026
e36d718
Create rootless_path.sh earlier in buildscript.sh
0mniteck Apr 30, 2026
59b7cd5
Add logging configuration to buildscript.sh
0mniteck Apr 30, 2026
c4c7cce
Update buildscript.sh
0mniteck Apr 30, 2026
e7cddcd
Fix CPUQuota assignment in buildscript.sh
0mniteck Apr 30, 2026
9df3641
Update version to v0.1.2-Alpha in 0mniteck.rego
0mniteck Apr 30, 2026
48faba4
Refactor Docker rootless build script
0mniteck May 1, 2026
48e775f
Refactor buildscript.sh for improved session handling
0mniteck May 1, 2026
8e2a901
Refactor debug handling and service modification
0mniteck May 4, 2026
bf343b9
Add breakpoint before Docker buildx creation
0mniteck May 4, 2026
e4318b4
Update Docker build options in buildscript.sh
0mniteck May 4, 2026
f8b8c5c
Refactor debug and test variable handling
0mniteck May 4, 2026
d293218
Update test usage format in buildscript.sh
0mniteck May 4, 2026
3ba8c06
Fix conditional checks and improve git fetch logic
0mniteck May 4, 2026
9198b40
Refactor test function and cleanup variable assignments
0mniteck May 4, 2026
5169723
Refactor debug and nulled variable handling
0mniteck May 4, 2026
fd8aec2
Refactor test function for clarity and consistency
0mniteck May 4, 2026
be09559
Refactor rootless Docker script for improved logging
0mniteck May 4, 2026
b55bde3
Enhance output formatting and PID management
0mniteck May 4, 2026
0a9df90
Update buildscript.sh for docker buildx options
0mniteck May 4, 2026
629fde4
Fix echo formatting for modified sysusr_service
0mniteck May 4, 2026
adb815a
Fix echo formatting in buildscript.sh
0mniteck May 4, 2026
685f8ed
Create user slice directory in buildscript
0mniteck May 4, 2026
36a852a
Add debug logging for docker service changes
0mniteck May 4, 2026
56e49d2
Update Docker buildx options in buildscript.sh
0mniteck May 4, 2026
20ce04b
Redirect stderr for docker.pid file reads
0mniteck May 4, 2026
14e7ed3
Update cgroup directory creation in buildscript.sh
0mniteck May 4, 2026
9887056
Update usage instructions in buildscript.sh
0mniteck May 4, 2026
eb2af3d
Fix version numbers in buildscript requirements
0mniteck May 4, 2026
9be1195
Use --ff-only for git pull command
0mniteck May 4, 2026
6ab841d
Update cgroup directory creation in buildscript.sh
0mniteck May 4, 2026
eb9e14a
Add init.scope directory creation in buildscript.sh
0mniteck May 4, 2026
9ab6c7b
Add ExecStop command to buildscript.sh
0mniteck May 4, 2026
5358a5e
Fix script to remove docker run pid/sock files
0mniteck May 4, 2026
b14e1e5
Fix escaping in ExecStop command
0mniteck May 4, 2026
a3ca6c3
Improve debug logging and test conditions
0mniteck May 4, 2026
1c0da44
Fix formatting in ExecStop command
0mniteck May 4, 2026
ea73756
Fix escape characters in ExecStop command
0mniteck May 4, 2026
93adfd3
Fix ExecStop command in buildscript.sh
0mniteck May 4, 2026
644df6a
Fix ExecStop command formatting in buildscript.sh
0mniteck May 4, 2026
cb75996
Fix escaping in ExecStop command
0mniteck May 4, 2026
a868348
Change ExecStop command to use 'true' instead of printf
0mniteck May 4, 2026
bfffb4f
Change terminal type and set language variable
0mniteck May 8, 2026
2ed9d4b
Update commit version to v8.9.0
0mniteck May 8, 2026
dcf4354
Update credential helper version to v0.9.7
0mniteck May 8, 2026
eba044d
Update .pinned_ver
0mniteck May 10, 2026
459b63f
Update buildscript.sh
0mniteck May 11, 2026
e70e2f9
Update moby_src SHA256 checksum
0mniteck May 11, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .gitattributes
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
Dockerfile* linguist-language=Dockerfile
*.deb filter=lfs diff=lfs merge=lfs -text
*.json filter=lfs diff=lfs merge=lfs -text
*.log filter=lfs diff=lfs merge=lfs -text
51 changes: 51 additions & 0 deletions .github/Developer Certificate of Origin.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2//EN">
<!-- saved from url=(0033)https://developercertificate.org/ -->
<html><!--
File: Developer Certificate of Origin.md
Editor: None, you wimpy wysiwyg people...this is hand crafted!
What are you doing reading this anyway???
--><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">

<title>Developer Certificate of Origin</title>
</head>
<body>
<pre>Developer Certificate of Origin
Version 1.1

Copyright (C) 2004, 2006 The Linux Foundation and its contributors.

Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.


Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
have the right to submit it under the open source license
indicated in the file; or

(b) The contribution is based upon previous work that, to the best
of my knowledge, is covered under an appropriate open source
license and I have the right under that license to submit that
work with modifications, whether created in whole or in part
by me, under the same open source license (unless I am
permitted to submit under a different license), as indicated
in the file; or

(c) The contribution was provided directly to me by some other
person who certified (a), (b) or (c) and I have not modified
it.

(d) I understand and agree that this project and the contribution
are public and that a record of the contribution (including all
personal information I submit with it, including my sign-off) is
maintained indefinitely and may be redistributed consistent with
this project or the open source license(s) involved.
</pre>




</body></html>
File renamed without changes.
11 changes: 8 additions & 3 deletions .identity
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,19 @@ declare -- NAME=Signal-Desktop
declare -- USERNAME=0mniteck42
declare -- IDENTITY_FILE=.ssh/$MODULE
declare -- PKI_ID_FILE=.ssh/.pki
declare -- PROJECT=Signal-Desktop-Reproducible
declare -- PROJECT=$NAME-Reproducible
declare -- USER='Shant Patrick Tchatalbachian'
declare -- SIGSTORE_USR=tiger-varsity-alto@duck.com
declare -- USER_ID=10482171+0mniteck@users.noreply.github.com
declare -- SIGNING_KEY=42E2DDF1E31B370F8BFFEE03287EE837E6ED2DD3
declare -- CLIENT_ID=Iv23liF4fUl7FZ7MmEay

git config --global user.name "$USER"
git config --global user.email $USER_ID
git config --global user.name 'Shant Patrick Tchatalbachian'
git config --global user.signingkey $SIGNING_KEY
if [[ "$SKIP_LOGIN" == "" ]]; then
git config --global init.defaultBranch main

if [[ "$TESTS" != *SKIP_LOGIN* ]]; then
echo '-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBGUR6+QBCADbwEILdDDXamhAQbL7KlgFzoP3NI8+I2bCHHAUPYbpaCax0plM
Expand Down
38 changes: 24 additions & 14 deletions .pinned_ver
Original file line number Diff line number Diff line change
@@ -1,16 +1,26 @@
declare -- commit=949bdb77ac2f791711ffec2504866b9ee4b24fef
declare -- last_rel_date=02-17-2026
declare -- last_ver_num=7.68
declare -- last_epoch=1756598400
declare -- docker_snap_arm64_ver=3380
declare -- docker_snap_amd64_ver=3377
declare -- source_tag=02-18-2026
declare -- source_img=0mniteck/debian-slim:$source_tag
declare -- source_loc=docker.io/$source_img
declare -- source=$source_img@sha256:13b15f452474e3f662cb3c2c76d2b480f90c2e6318f3905ae9b4711fd6c7b10b
declare -- node_ver=24.13.0
declare -- node_ver=24.14.0
declare -- nvm_ver=0.40.4
declare -- pnpm_ver=10.18.1
declare -- cred_helper_sha=e784c37f55c2f3d143a06916169ce8de879894bae45c4e6313daa72af8c75316685ca5a24cf4b7bdb66633e72fd89f7c8e5b3dae81ca6b62b7adec210711b806
declare -- cred_helper_name=docker-credential-pass-v0.9.5.linux-arm64
declare -- cred_helper="github.com/docker/docker-credential-helpers/releases/download/v0.9.5/$cred_helper_name"
declare -- docker_snap_arm64_ver=3507
declare -- docker_snap_amd64_ver=3505
declare -- commit=abc765a83de4fa4e25e97064d96bd60d7464b1f2 # v8.9.1
declare -- last_ver_num=8.02
declare -- last_epoch=1773619200
declare -- last_rel_date=03-16-2026
declare -- binfmt_repo=docker.io/tonistiigi/binfmt
declare -- binfmt_tag=$binfmt_repo:qemu-v10.2.1-65
declare -- binfmt_arm64=$binfmt_tag@sha256:9fbc2c89ff373eb14bbcb43272738ebc49785661a7badbd3e3b1d391aaa8259d
declare -- binfmt_amd64=$binfmt_tag@sha256:8db0f28060565399642110b798c6c35efcac7c5b3b48c56d36503d3b4d8f93c8
declare -- source_repo=$REPO/debian-slim
declare -- source_tag=$source_repo:02-18-2026
declare -- source=$source_tag@sha256:13b15f452474e3f662cb3c2c76d2b480f90c2e6318f3905ae9b4711fd6c7b10b
declare -- source_loc=docker.io/$source
declare -- cred_helper_ver=v0.9.7
declare -- cred_helper_name=docker-credential-pass-$cred_helper_ver.linux-arm64
declare -- cred_helper="github.com/docker/docker-credential-helpers/releases/download/$cred_helper_ver/$cred_helper_name"
declare -- cred_helper_sha=085cbadca168361455d530b425304475500bc9d1a209390089bd468c2e6f3da07b483f3e3ace5f65729d6b272f6f5ad6815a0f252f72bd81587de112ebab84f9
declare -- moby_repo=docker.io/moby/buildkit
declare -- moby_tag=v0.29.0
declare -- moby_src=sha256:8550ee821375d58adc345db341b1c08df993d8411544b36fd4c6cb2dd2fb12c5
declare -- moby=$moby_repo:$moby_tag@$moby_src
# snap cohorts, 90 day auto-pinning, valid for v29.3.1 (4/29/2026) until (7/29/2026) -- {"cohorts":{"core24":{"cohort-key":"MSBkd1RBaDdNWlowMXp5cmlPWkVycWQxSnluUUxpT0d2TSAxNzc3NDUyMDc5IGIwOGJmZWZmNTM4ZjdmMDU0NWFjZjkxYjI0YjY3OTRiMDllZjgyY2EyNjA1YzdkNzc5NjZjMGM5MzJmOGFlZTY="},"docker":{"cohort-key":"MSBzTENzRkFPOFBLTTVaMGZBS05zelVPWDBZQVNqUWZlWiAxNzc3NDUyMDc5IGRlNDg0NzMyOWRhMTgyNjFmMGI2NDdlODM2MjhmMTVlMjJlMDljODJjZWRjODExYTlmY2ExNDcwYWMxYTcxMzc="},"grype":{"cohort-key":"MSB6RXlLcERiMG5oRUVQajJndjNuNDNjcTRKMlRxbnlRTCAxNzc3NDUyMDc5IGMyOGMwYzRmYjIwMmU3MWI1ZGE5ZmY3ZmFkZDkzMTU3ZmZkMTdjYzc5YTE3OTQ0YWRjNzg3MjAyNTRiYzM3NDI="},"syft":{"cohort-key":"MSBUSUxXMWpoc3VqOTQyUHpwbk1MR2tGUEIzVFQ2YkdsaiAxNzc3NDUyMDc5IGE5YWFmYTBkM2Y3YzQwZTZkZTA5YzdlN2NjMmRmZjY0NzA3ZjllMjRhNThlM2ZlNmJiZTEzZWE5ZjAzZWVmMmQ="}}}
1 change: 1 addition & 0 deletions .pki
Submodule .pki added at ab9682
138 changes: 138 additions & 0 deletions 0mniteck.rego
Original file line number Diff line number Diff line change
@@ -0,0 +1,138 @@
# 0mniteck.rego - v0.1.2-Alpha - Multi-Repo Policy File
# Strict requirement for docker public registries: https, and @digest_tag or --checksum
#
# Demos:
# docker buildx build --policy reset=true,strict=true,filename=$REPO.rego .
# docker buildx build --progress=plain --policy log-level=debug,reset=true,strict=true,filename=$REPO.rego .
# docker buildx policy eval --print --fields image.checksum docker-image://$source_img
# docker buildx policy eval --print $source
# Builtins: print load_json verify_git_signature pin_image
# [input.image.checksum input.image.labels input.image.user input.image.volumes input.image.workingDir \
# input.image.env input.image.hasProvenance input.image.signatures input.image.fullRepo]
#

package docker

default allow := false

allow if input.local

allow if {
input.image.host == "docker.io" # Docker Hub
input.image.checksum == digest
}

allow if {
input.image.host == "dhi.io" # Docker Hardened Images
input.image.hasProvenance # Include attestation check
}

allow if {
input.image.isCanonical # registry.url/org/repo@sha256:digest
}

allow if {
input.http.schema == "https" # Require HTTPS for all downloads
}

decision := {"allow": allow}

#WIP from DEMO

allowed_repos := ["myorg/backend", "myorg/frontend", "myorg/worker"]

allow if {
some repo in allowed_repos
input.image.repo == repo
input.image.hasProvenance
some sig in input.image.signatures
trusted_github_builder(sig, repo)
}

# Helper to validate GitHub Actions build from main branch
trusted_github_builder(sig, repo) if {
sig.signer.certificateIssuer == "CN=sigstore-intermediate,O=sigstore.dev"
sig.signer.issuer == "https://token.actions.githubusercontent.com"
startswith(sig.signer.buildSignerURI, sprintf("https://github.com/myorg/%s/.github/workflows/", [repo]))
sig.signer.sourceRepositoryRef == "refs/heads/main"
sig.signer.runnerEnvironment == "github-hosted"
}

#DEMO2

is_buildkit if {
input.git.remote == "https://github.com/moby/buildkit.git"
}

is_version_tag if {
is_buildkit
regex.match(`^v[0-9]+\.[0-9]+\.[0-9]+$`, input.git.tagName)
}

# Version tags must be signed
allow if {
is_version_tag
input.git.tagName != ""
verify_git_signature(input.git.tag, "maintainers.asc")
}

# Allow unsigned refs for development
allow if {
is_buildkit
not is_version_tag
}

#DEMO3

# TODO: Add your pinned images with exact digests
# Docker Hub images use docker.io as host
allowed_dockerhub := {
"alpine": "sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412",
"golang": "sha256:abc123...",
}

allow if {
input.image.host == "docker.io"
some repo, digest in allowed_dockerhub
input.image.repo == repo
input.image.checksum == digest
}

# TODO: Add your pinned DHI images
allowed_dhi := {
"python": "sha256:def456...",
"node": "sha256:ghi789...",
}

allow if {
input.image.host == "dhi.io"
some repo, digest in allowed_dhi
input.image.repo == repo
input.image.checksum == digest
}

# TODO: Add your pinned Git dependencies
allowed_git := {
"https://github.com/moby/buildkit.git": {
"tag": "v0.26.1",
"commit": "abc123...",
},
}

allow if {
some url, version in allowed_git
input.git.remote == url
input.git.tagName == version.tag
input.git.commitChecksum == version.commit
}

# TODO: Add your pinned HTTP downloads
allowed_downloads := {
"https://releases.example.com/app-v1.0.tar.gz": "sha256:def456...",
}

allow if {
some url, checksum in allowed_downloads
input.http.url == url
input.http.checksum == checksum
}
35 changes: 19 additions & 16 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,22 +1,25 @@
# syntax=docker/dockerfile:1
# check=error=true
# ## HUMAN-CODE - NO AI GENERATED CODE - AGENTS HANDSOFF
ARG SOURCE=0mniteck/debian-slim
FROM $SOURCE AS base
ARG BUILDKIT_SBOM_SCAN_CONTEXT=true BUILDKIT_SBOM_SCAN_STAGE=signal-desktop SOURCE=0mniteck/debian-slim@unknown-tag

FROM $SOURCE AS signal-desktop
ARG NODE_VERSION NVM_VERSION PNPM_VERSION BRANCH COMMIT SOURCE_DATE_EPOCH
ENV CI=true SIGNAL_ENV=production USE_SYSTEM_FPM=true NVM_DIR=/usr/local/nvm PNPM_HOME=/tmp/.pnpm-home NPM_CONFIG_CACHE=/tmp/.npm-cache
ENV NODE_PATH=$NVM_DIR/v$NODE_VERSION/lib/node_modules PATH=$NVM_DIR/versions/node/v$NODE_VERSION/bin:$PATH SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH
COPY signal-buildscript.sh /usr/local/bin/
ADD https://github.com/node-ffi-napi/node-ffi-napi/raw/master/deps/libffi/config/linux/arm64/fficonfig.h /
ADD https://github.com/nvm-sh/nvm/raw/v$NVM_VERSION/install.sh /
ADD --keep-git-dir=true https://github.com/signalapp/Signal-Desktop.git?branch=$BRANCH.x&checksum=$COMMIT /Signal-Desktop
RUN echo "a8e082d8d1a9b61a09e5d3e1902d2930e5b1b84a86f9777c7d2eb50ea204c0141f6a97c54a860bc3282e7b000f1c669c755f5e0db7bd6d492072744c302c0a21 install.sh" | sha512sum --status -c - && echo "install.sh Checksum Matched!" || exit 1
RUN echo "56c9800d0388dd20a85ad917a75a0dc96aa0de95db560e586b540e657a7a10ec8ef9759f1d09d7cb2f0861c9b88650246a9ace97708a20d8757bcd0c559333a7 fficonfig.h" | sha512sum --status -c - && echo "fficonfig.h Checksum Matched!" || exit 1
RUN mkdir -p /Signal-Desktop/artifacts/linux/logs $NVM_DIR && gem install fpm && chmod +x install.sh && ./install.sh && . $NVM_DIR/nvm.sh && nvm install $NODE_VERSION && nvm alias $NODE_VERSION && nvm use $NODE_VERSION
RUN mv fficonfig.h /usr/include/aarch64-linux-gnu/fficonfig.h && git config --global --add safe.directory /project && npm install --location=global pnpm@$PNPM_VERSION
FROM scratch AS builder
COPY --from=base / /
ARG NODE_VERSION SOURCE_DATE_EPOCH
ENV CI=true SIGNAL_ENV=production USE_SYSTEM_FPM=true NVM_DIR=/usr/local/nvm PNPM_HOME=/tmp/.pnpm-home NPM_CONFIG_CACHE=/tmp/.npm-cache
ENV SIGNAL_ENV=production USE_SYSTEM_FPM=true NVM_DIR=/usr/local/nvm PNPM_HOME=/tmp/.pnpm-home NPM_CONFIG_CACHE=/tmp/.npm-cache
ENV NODE_PATH=$NVM_DIR/v$NODE_VERSION/lib/node_modules PATH=$NVM_DIR/versions/node/v$NODE_VERSION/bin:$PATH SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH
ADD --checksum=sha256:c8f7120fba37152b0f62df2445e80c34ef48c7eb0378c5c289928ff1b51c8569 \
signal-buildscript.sh /usr/local/bin/
ADD --checksum=sha256:f78ebf9776234423b69cdef1ab1698ebb2a7666cb0ac0f8c823d7862d1f8f851 \
https://github.com/node-ffi-napi/node-ffi-napi/raw/master/deps/libffi/config/linux/arm64/fficonfig.h /usr/include/aarch64-linux-gnu/
ADD --checksum=sha256:4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f \
https://github.com/nvm-sh/nvm/raw/v$NVM_VERSION/install.sh /
ADD --checksum=$COMMIT --keep-git-dir=true https://github.com/signalapp/Signal-Desktop.git?ref=$COMMIT /Signal-Desktop

RUN mkdir -p /Signal-Desktop/artifacts/linux/logs $NVM_DIR && gem install fpm \
&& chmod +x install.sh && ./install.sh && . $NVM_DIR/nvm.sh && rm -f /install.sh \
&& nvm install $NODE_VERSION && nvm alias $NODE_VERSION && nvm use $NODE_VERSION \
&& git config --global --add safe.directory /project \
&& npm install --location=global pnpm@$PNPM_VERSION

ENTRYPOINT ["signal-buildscript.sh"]
CMD ["no",""]
Loading