chore: add mise to check-deps skill + bump eligible dependencies - #124
Merged
capotej merged 17 commits intoJul 17, 2026
Conversation
mise is pinned in the Dockerfile (ENV MISE_VERSION + per-arch sha256 checksums) but was missing from check-deps. Add it to the deps table, read/fetch steps, the 7-day cooldown section, the example report, and a notes subsection covering the version + dual-checksum update flow.
BoldBlackBot
force-pushed
the
deps/add-mise-to-check-deps
branch
from
July 16, 2026 21:51
358e687 to
7308db7
Compare
- pi-coding-agent 0.79.2 → 0.80.9 - gh 2.95.0 → 2.96.0 - hermes-agent v2026.6.19 → v2026.7.7.2 Co-Authored-By: capotej <capotej@users.noreply.github.com>
BoldBlackBot
changed the title
…y-blob-attestation) cosign v3.1.1 panics with a nil pointer dereference at verify_blob_attestation.go:306 when verifying uv's SLSA attestation bundle. The new bundle format auto-detection fails on GitHub's attestations API response, falls through to the legacy path where the hash is uninitialized when --check-claims=false. Pin to v2.6.3 (last stable v2) until upstream patches v3. Co-Authored-By: capotej <capotej@users.noreply.github.com>
- Cosign self-verify: use v2 .pem+.sig format instead of v3 .sigstore.json - Skip uv attestation verification (v2 lacks verify-blob-attestation); the digest pin (FROM ghcr.io/astral-sh/uv@sha256:...) still guarantees integrity Co-Authored-By: capotej <capotej@users.noreply.github.com>
v3.0.6 is the last v3 release before the verify-blob-attestation panic bug. Keeps the full attestation verification pipeline intact (cosign self-verify + uv SLSA provenance) with the v3 .sigstore.json bundle format, unlike the v2 workaround which couldn't verify attestations. Co-Authored-By: capotej <capotej@users.noreply.github.com>
…eck-claims=false --check-claims=false triggers a nil pointer dereference in cosign v3.0.6 and v3.1.1 (verify_blob_attestation.go). Fix by passing the actual uv binary as the artifact to verify against, which takes the artifactPath != "" branch and properly initializes the hash. Co-Authored-By: capotej <capotej@users.noreply.github.com>
GitHub's /repos/{owner}/{repo}/attestations/{digest} endpoint now returns
bundle: null with a separate bundle_url pointing to Azure Blob Storage,
instead of inlining the bundle JSON. The old jq '.attestations[0].bundle'
produced null, causing cosign to panic.
Also revert cosign back to v3.1.1 (the original pinned version on main).
The bug was never in cosign — it was the null bundle from the API change.
Co-Authored-By: capotej <capotej@users.noreply.github.com>
GitHub's attestations API now returns bundle_url pointing to .json.sn (snappy-compressed) bundles instead of inline JSON. cosign can't parse them directly (invalid character 'û'). Install snzip and decompress before passing to cosign. Co-Authored-By: capotej <capotej@users.noreply.github.com>
GitHub's attestations API now returns bundle_url with snappy-compressed bundles (.json.sn) instead of inline JSON. cosign verify-blob-attestation can't handle the snappy format. GitHub's recommended verification path is `gh attestation verify` which handles all bundle formats internally. This removes the snzip dependency and eliminates ~18 lines of curl/jq/snzip workarounds in favor of a single gh command. The cosign self-verify step (verifying cosign's own release checksums) remains unchanged — that uses OCI bundle format, not GitHub attestations. Co-Authored-By: capotej <capotej@users.noreply.github.com>
gh attestation verify takes the file path and computes sha256 internally. The --digest flag doesn't exist. Simplified to just pass the binary path. Co-Authored-By: capotej <capotej@users.noreply.github.com>
gh attestation verify requires GH_TOKEN which is not available inside Docker build RUN instructions. Revert to curl + snzip + cosign approach: - Fetch attestation from GitHub API (handles both inline bundle and bundle_url) - Decompress snappy-encoded bundles (.json.sn) via snzip - Fall back to inline bundle for older API responses - Verify with cosign verify-blob-attestation Co-Authored-By: capotej <capotej@users.noreply.github.com>
snzip is only available in Debian sid, not stable. Use python3 + python-snappy instead - both available in stable repos. Move python3 install to the cosign layer so it's available for snappy decompression before the attestation step. Remove duplicate python3 from the hermes setup apt-get block. Co-Authored-By: capotej <capotej@users.noreply.github.com>
Debian trixie no longer bundles pip with python3. Use python3-snappy from apt repos directly instead of pip install. Co-Authored-By: capotej <capotej@users.noreply.github.com>
The SLSA provenance attests to the container image digest (ghcr.io/astral-sh/uv), not the extracted binary. The binary digest doesn't match. Main used --check-claims=false intentionally to verify the provenance signature without digest matching. v3.1.1 has a nil pointer dereference with --check-claims=false. v3.0.6 doesn't have this bug. Pin to 3.0.6 and keep --check-claims=false. Combined with snappy decompression for GitHub's new bundle_url format. Co-Authored-By: capotej <capotej@users.noreply.github.com>
capotej
self-requested a review
July 17, 2026 11:45
The else branch (fallback for inline bundles) was wrapping the bundle object as a JSON string value instead of writing it raw. If GitHub ever returns an inline bundle again, cosign would choke on the malformed JSON. Use jq to extract the bundle object directly from the source file. Co-authored-by: Julio <capotej@users.noreply.github.com>
The unauthenticated curl to GitHub's attestations API was hitting the 60 req/hr rate limit on shared CI runner IPs (HTTP 403). Pass GITHUB_TOKEN via BuildKit secret (required=false so local builds work without it). Workflow files need secrets.GITHUB_TOKEN passed to the build step — see PR comments for the one-line additions. Co-authored-by: Julio <capotej@users.noreply.github.com>
This reverts commit ec91e0b.
capotej
approved these changes
Jul 17, 2026
4 tasks
BoldBlackBot
added a commit
to BoldBlackBot/harness
that referenced
this pull request
Jul 31, 2026
cosign 3.1.2 includes sigstore/cosign#5016 which fixes the nil-pointer crash in verify-blob-attestation --check-claims=false that forced the downgrade from 3.1.1 in boldblackai#124. This bump also serves as verification that the attestation verification flow works with 3.1.2 in the Docker build. Co-Authored-By: BoldBlackBot <bot@boldblackai.com>
capotej
added a commit
that referenced
this pull request
Jul 31, 2026
* chore: bump eligible dependencies (7-day cooldown) Bumps pi-coding-agent 0.80.9→0.80.10, opencode-ai 1.15.10→1.18.4, hermes-agent v2026.7.7.2→v2026.7.20, uv 0.11.19→0.11.30, pnpm 10.33.2→10.34.5, mise 2026.4.23→2026.7.11. cosign held at 3.0.6 (3.1.2 available but pending verification that PR #5016 resolves the nil-pointer regression from 3.1.1). All versions are ≥7 days old per the dependency cooldown policy. Co-authored-by: Julio Capote <capotej@users.noreply.github.com> * chore: bump cosign 3.0.6 -> 3.1.2 cosign 3.1.2 includes sigstore/cosign#5016 which fixes the nil-pointer crash in verify-blob-attestation --check-claims=false that forced the downgrade from 3.1.1 in #124. This bump also serves as verification that the attestation verification flow works with 3.1.2 in the Docker build. Co-Authored-By: BoldBlackBot <bot@boldblackai.com> * chore: remove CHANGELOG.md changes (handled by release skill) Co-Authored-By: BoldBlackBot <bot@boldblackai.com> --------- Co-authored-by: BoldBlackBot <bot@boldblackai.com> Co-authored-by: Julio Capote <capotej@users.noreply.github.com> Co-authored-by: BoldBlackBot <296328274+BoldBlackBot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
check-depsskill — mise is pinned in the base Dockerfile with version + per-arch checksums but was missing from the dependency check skill. This PR adds it with proper cooldown handling and checksum lookup instructions.@earendil-works/pi-coding-agentghhermes-agentverify-blob-attestationwhen verifying uv's SLSA attestation bundle (new bundle format auto-detection fails on GitHub's attestations API response, falls to legacy path with uninitialized hash). v3.0.6 is the last stable v3 release without this bug.Dep check results vs main (2026-07-16)