Security reference's Supply chain section says images are published from the docs repository and recommends sha-<short> tags the Docker page does not describe

Filing gate ① (a public page asserts something this site's own pages contradict). Class a; reach: /docs/reference/security. Source: the dev report on #340 (PR #355, out_of_scope_findings). Filed by the repo:docs.objectos.ai seat (objectstack-ai/objectstack#9831), session_01QsR2jTaZ2GeyfjANMwstiw. Dedupe: open issues here searched for "supply chain", "pre-built images", "provenance", "sha- tag": none.

What is wrong

content/docs/reference/security.mdx § Supply chain (on 1282903, lines 307-313):

"Pre-built images published from github.com/objectstack-ai/objectos with reproducible build provenance." This repository (now docs.objectos.ai) publishes no image. deploy/index.mdx and deploy/docker.mdx:12-13 give the Community image as ghcr.io/objectstack-ai/objectstack, and the Enterprise image is the licensed one. PR docs: the Chinese terms page says ObjectOS Community is open source; links follow the repository rename #355 only renames the link, so after it lands the bullet points at the docs repository and is just as wrong.
"Use SHA-pinned image tags (sha-<short>) in production". deploy/docker.mdx § Pin the image says the Community image's tags mirror the CLI version (X.Y.Z, with latest, X.Y and X rolling), and that only the exact tag is immutable. It names no sha- tag.
"reproducible build provenance" names no source. Whether the objectstack image workflow attests provenance (for example SLSA / attest-build-provenance) has to be read from objectstack-ai/objectstack's release workflow, not assumed.

Done looks like

The Supply chain bullets say where each image comes from (Community: ghcr.io/objectstack-ai/objectstack, built from objectstack-ai/objectstack; Enterprise: as deploy/index.mdx states it, and any Enterprise detail beyond that goes to the cloud lane). The pinning advice matches deploy/docker.mdx (exact X.Y.Z tag, or digest pinning if the workflow supports it). The provenance claim is either backed by a citation to the publishing workflow or removed. English only. If a claim is removed or reversed, the locale siblings are deleted in the same PR (AGENTS.md rule 3).

维护者速读

安全参考页的「供应链」一节有两处错：说镜像由本文档仓库发布（实际 Community 镜像是 ghcr.io/objectstack-ai/objectstack），还建议用 sha-<short> 标签（Docker 页只描述 X.Y.Z 版本标签）。「可复现构建溯源」也没有出处。本卡把这一节改成与部署页一致，并核实溯源说法。

Claim: PM loop round 3 · 2026-10-27T22:51Z
Session: session_01QsR2jTaZ2GeyfjANMwstiw (seat thread; the dev is card thread session_01QsR2jSu4EKmL1qLQgAxPaS, identity by branch)
Account: zhuangjianguo
Branch: claude/project-thread-m58nze (platform-assigned; a card thread can push only this branch)
Worktree: the card thread's own docs.objectos.ai checkout
Domain: domain:docs (single-lane repository)
Seat: repo:docs.objectos.ai#1
File surface: content/docs/reference/security.mdx (English), and deletion of its security.<locale>.mdx siblings only if a claim is removed or reversed (AGENTS.md rule 3) — stop on breach; explain in the report
Container & model: S, mode:thread, model: default tier (TIER_DEFAULT — sister repository, hand-derived: no packages/spec, no protocol-semantic surface), effort: project default
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — documentation wording, filed by this seat
Thread-read: none
Premise: confirmed on 1282903 — the Supply chain bullets at security.mdx:307-313 are as the card quotes. Image publishing, tags and provenance are read from objectstack's own workflows and cited by file:line. Enterprise facts are limited to what deploy/index.mdx states; anything beyond that goes to the cloud lane.
Tier: none.
Serial constraints cleared: PR #355 (#340, Tier H, waiting on a governed approval) changes the same bullet's link. This card branches from main as it stands, and whichever PR lands second merges main. #347 (translation pass) may write security.zh-Hans.mdx. If this card deletes siblings, the pass's later PR re-derives them from the corrected English.

os-dev-report

{
  "issue": 356,
  "status": "done",
  "branch": "claude/project-thread-m58nze",
  "pr": "https://github.com/objectstack-ai/docs.objectos.ai/pull/358",
  "session": "session_01QsR2jSu4EKmL1qLQgAxPaS",
  "premise_still_valid": true,
  "summary": "security.mdx Supply chain now names the Community image ghcr.io/objectstack-ai/objectstack, built and published from objectstack-ai/objectstack on every ObjectStack release with tags mirroring the CLI version; adds an Enterprise bullet limited to deploy/index.mdx wording plus a link to deploy/docker#verify-the-image-before-production; removes the unsourced reproducible-build-provenance claim (docker-publish.yml configures no attestation); pinning advice matches deploy pages (exact X.Y.Z on Community, release-notes digest on Enterprise). The hardening checklist item 'pinned to sha-SHORT or semver tag' (same file, same defect) is fixed the same way. Two commits, head a94c0c6, English only; no locale siblings exist, so rule 3 deletes nothing.",
  "tests": "Content-only diff, no test files. Browser: next start of the built site, Chromium desktop 1440x900 and phone 390x844: the four Supply chain links are https://github.com/objectstack-ai/objectstack, /docs/deploy#the-two-images, /docs/deploy/docker#verify-the-image-before-production, /docs/deploy/docker#pin-the-image, each target anchor present (count 1). Screenshots /mnt/project-files/docs-356/desktop-security-supply-chain.png, mobile-security-supply-chain.png, desktop-security-hardening-checklist.png.",
  "gates": "local at a94c0c6, exit captured before any pipe: pnpm install --frozen-lockfile 0; gen-zh-hant --check 0; check-doc-samples 0; turbo type-check 0; turbo build --force 0 (NEXT_PRIVATE_STANDALONE=true, 53 s under the verify lock, VERDICT command-exit 0); check-locale-surface 0; check-positioning 0; check-search-locales 0; check-translations 0; check-translation-ownership --files 0 (1 file, 0 translation artifacts); turbo test 0; smoke-docs.mjs --base http://localhost:3356 0 (4 pages rendered, negative control red, search in 8 locales). The first locale-surface/positioning/search-locales run exited 1 only because no build existed yet; re-run after build, 0. PR CI at report time: Ownership & freshness success, Node floor success, build in_progress. actionlint NOT MEASURED (no workflow change).",
  "dogfood_battery": "n/a — sister repository, no ! in the title, Clause-② no",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (run 40598912163, PR #358, 5859/5859 bytes read back identical, assignee zhuangjianguo); this os-dev-report comment via post-stamped.mjs. git push of claude/project-thread-m58nze is not a REST write.",
  "open_questions": [
    {
      "question": "Should the site make any provenance claim about the Community image? Measured: the ghcr latest index (sha256:3d14ddf5...) carries an unsigned in-toto SLSA v1 provenance attestation per platform, which docker/build-push-action adds by default; docker-publish.yml declares no provenance/sbom input, no attest step and no id-token permission, and the GitHub attestations API answers 404 for the image digests.",
      "options": [
        "A: keep the page silent on Community provenance (this PR)",
        "B: an objectstack card makes docker-publish.yml declare provenance (and optionally sbom and actions/attest-build-provenance with id-token: write); the docs then cite it"
      ],
      "recommendation": "A now; B only if maintainers want the claim, because an undeclared default can change without notice and docs must cite a file:line."
    },
    {
      "question": "Enterprise image signing/SBOM/provenance is stated on deploy/docker.mdx:301-315, not on deploy/index.mdx. This PR only links it. Does the cloud lane want to confirm those claims?",
      "options": [
        "A: leave as is, carrier: cloud",
        "B: no action"
      ],
      "recommendation": "A, carrier: cloud — confirming needs the private repo."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: public page /docs/deploy/docker § Pin the image says 'Only the exact tag is immutable' (docker.mdx:19-20), and /docs/deploy says an exact version cannot be re-pointed (index.mdx:38); objectstack docker-publish.yml:12-14 has a workflow_dispatch that rebuilds an already-published version (e.g. for base-image CVE patches) and pushes the same X.Y.Z tag (:150-164), and :39-40 records two dispatch runs, so the exact tag can move and only a digest is immutable · evidence: objectstack aa00362f .github/workflows/docker-publish.yml:12-14,39-40,150-164 · dedupe words: immutable tag, exact tag, digest pin, rebuild, workflow_dispatch",
    "class: none (observation) · content/docs/editions/license.mdx:142 links github.com/objectstack-ai/objectos/blob/main/TRADEMARK.md (old repository name) · carrier: #340 / PR #355 (repo-rename link pass) · noted, not filed"
  ]
}

Generated by Claude Code

Landing · 2026-10-27T23:16Z · session_01QsR2jTaZ2GeyfjANMwstiw · seat repo:docs.objectos.ai#1

Reading	Value
PR #358	MERGED through the merge queue as `8d02849`: squash, under the maintainer's standing go-ahead, on head `a94c0c6`, the ACCEPTed head of seat record 6455736630
`main` CI run 40600319872 on `8d02849`	`build` success · `Deploy docs / Publish the tested Worker` success, with "Assert a new version is serving" success · `Deploy docs / Smoke-check the live site` success · rollback and failure-card jobs skipped

State change: this card closed itself through Fixes #356, and pm:dispatched comes off here. #359 (tag immutability, from this card's dev report) starts from 8d02849. PR #355 merges main to drop its now-obsolete link change in this section.

Navigation Menu

Repository navigation

Security reference's Supply chain section says images are published from the docs repository and recommends `sha-<short>` tags the Docker page does not describe #356

What is wrong

Done looks like

维护者速读

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Security reference's Supply chain section says images are published from the docs repository and recommends sha-<short> tags the Docker page does not describe #356

Description

What is wrong

Done looks like

维护者速读

Activity

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Security reference's Supply chain section says images are published from the docs repository and recommends `sha-<short>` tags the Docker page does not describe #356