Use digest-pinned BCI Nano for the static CLI - #164
Merged
Merged
Conversation
ai-collaboration-app
Bot
changed the title
ai-collaboration-app
Bot
changed the title
LouisLotter
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switch the static SUSE Observability CLI from BCI Micro to digest-pinned BCI Nano 15.7. Nano supplies CA certificates and tzdata 2026c, including the Vancouver UTC-07 correction required by DLA-4569-1. The final diff against main is one
FROMline; application code, Go/linter versions and existing CI/release configuration are unchanged.AMD64 and ARM64 validation at signed
d15b40d4passed 35 timezone/JSON assertions and TLS positive/negative controls per architecture. Both scanners found seven OS packages; vulnerability and separate secret scans were clean. AMD64 evidence · ARM64 evidence.These results apply to unchanged application/dependency inputs, static release build settings and the identical Nano digest/Dockerfile. Only validation files were removed; commit/build metadata changes, so prior binary hashes identify the tested candidate, not a rebuilt final head. Signed evidence branch preserves every test source, previous signed candidate and the prior PR narrative.
Final signed head:
28f541deb8dcc646b84dabae449d064169fe0f5b. Ordinary CI 35339703524 passed tests, lint, license and GoReleaser checks; publication skipped. The same independent reviewer accepted this final one-line head with no required corrections (review); ready for human review. Tracks https://github.com/StackVista/cve-reporter/issues/65. No merge/release/deployment; published delivery evidence remains outstanding.