Publish curated ITWorx_MCP_Hub source from b5607d7532f496660c4a3cbe8db3bc3414a7b36b

tests/test_compose.py

@@ -128,6 +128,12 @@ class ComposeContractTests(unittest.TestCase):
                 encoding="utf-8"
             )
         )
+        security_publication = json.loads(
+            (ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text(encoding="utf-8")
+        )
+        self.assertEqual(security_publication["schema"], "itworx.security-base-preparation/v1")
+        self.assertFalse(security_publication["candidateEmitted"])
+        self.assertEqual(security_publication["reportCount"], 5)
         for name in ("postgres", "redis"):
             with self.subTest(service=name):
                 image_evidence = evidence["images"][name]
@@ -135,18 +141,22 @@ class ComposeContractTests(unittest.TestCase):
                 candidate_proof = publication_proof["candidates"][name]
                 self.assert_database_candidate_pin(
                     name,
-                    self.document["services"][name]["image"],
-                    image_evidence,
-                    publication,
-                    candidate_proof,
-                )
-                self.assert_database_candidate_pin(
-                    name,
-                    integration["services"][name]["image"],
+                    image_ref,
                     image_evidence,
                     publication,
                     candidate_proof,
                 )
+                if name == "postgres":
+                    prepared = next(
+                        row
+                        for row in security_publication["preparedImages"]
+                        if row["service"] == name
+                    )
+                    self.assertEqual(prepared["parentRef"], image_ref)
+                    self.assertTrue(prepared["runtimeVerified"])
+                    self.assertTrue(prepared["vulnerabilityAndSecretVerified"])
+                    self.assertRegex(prepared["imageId"], r"^sha256:[0-9a-f]{64}$")
+                    image_ref = prepared["imageRef"]
                 self.assertEqual(image_ref, self.document["services"][name]["image"])
                 self.assertEqual(image_ref, integration["services"][name]["image"])
 

tests/test_release_images_workflow.py

@@ -60,12 +60,10 @@ def test_release_credentials_only_reach_the_bounded_producer() -> None:
     command = steps[1]["run"]
     assert "set -euo pipefail" in command
     assert "set -x" not in command and "docker login" not in command
-    assert (
-        "python3 scripts/build_mcp_hub_release_images.py --prepare-security-bases "
-        '--revision "$GITHUB_SHA"' in command
-    )
+    assert 'python3 scripts/build_mcp_hub_release_images.py --revision "$GITHUB_SHA"' in command
+    assert "--prepare-security-bases" not in command
     assert '--run-id "$GITHUB_RUN_ID"' in command
-    assert '--output "${RUNNER_TEMP}/hub-release-security-bases-${GITHUB_SHA}"' in command
+    assert '--output "${RUNNER_TEMP}/hub-release-candidate-${GITHUB_SHA}"' in command
 
 
 def test_release_artifact_is_pinned_uncompressed_and_cannot_overwrite() -> None:
@@ -73,8 +71,8 @@ def test_release_artifact_is_pinned_uncompressed_and_cannot_overwrite() -> None:
     assert upload["uses"] == UPLOAD
     assert "if" not in upload
     assert upload["with"] == {
-        "name": "hub-release-security-bases-${{ github.sha }}",
-        "path": "${{ runner.temp }}/hub-release-security-bases-${{ github.sha }}/*",
+        "name": "hub-release-candidate-${{ github.sha }}",
+        "path": "${{ runner.temp }}/hub-release-candidate-${{ github.sha }}/*",
         "if-no-files-found": "error",
         "retention-days": 90,
         "compression-level": 0,

tests/test_security_base_preparation.py

@@ -136,7 +136,7 @@ def test_only_verified_scanned_images_publish_and_no_candidate_is_emitted(
             built[reference] = config
 
     def inspect(reference: str, *args: object, **kwargs: object) -> dict:
-        if reference in {value[0] for value in producer.EXTERNAL_IMAGES.values()}:
+        if reference in set(preparation.PARENT_IMAGES.values()):
             return copy.deepcopy(parent)
         result = copy.deepcopy(built[reference.split("@", 1)[0]])
         if "@" in reference and failure == "pull":

tests/test_security_base_publication_pins.py

@@ -0,0 +1,60 @@
+import hashlib
+import json
+import subprocess
+from pathlib import Path
+
+import yaml
+
+from scripts import build_mcp_hub_release_images as producer
+from scripts import prepare_release_security_bases as preparation
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_preparation_recipe_parents_do_not_follow_the_new_production_pins() -> None:
+    receipt = json.loads((ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text())
+    for row in receipt["preparedImages"]:
+        parent = preparation.PARENT_IMAGES[row["service"]]
+        assert parent == row["parentRef"]
+        assert parent != producer.EXTERNAL_IMAGES[row["service"]][0]
+        recipe = (
+            ROOT / "infrastructure/images/security-bases" / row["service"] / "Dockerfile"
+        ).read_text()
+        assert f"\nFROM {parent}\n" in "\n" + recipe
+
+
+def test_phase_b_pins_are_the_exact_runtime_verified_publication() -> None:
+    receipt = json.loads((ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text())
+    assert receipt["schema"] == "itworx.security-base-preparation/v1"
+    assert receipt["revision"] == "3237e4d8aec312d63d13b4e80664422a7520b5f9"
+    assert receipt["runId"] == 23280 and receipt["runAttempt"] == 1
+    assert receipt["candidateEmitted"] is False and receipt["reportCount"] == 5
+    services = yaml.safe_load((ROOT / "infrastructure/compose/docker-compose.yml").read_text())[
+        "services"
+    ]
+    rows = receipt["preparedImages"]
+    assert {row["service"] for row in rows} == {"postgres", "ingestion-clamd"}
+    for row in rows:
+        assert row["runtimeVerified"] is True and row["vulnerabilityAndSecretVerified"] is True
+        assert producer.EXTERNAL_IMAGES[row["service"]] == (row["imageRef"], row["archiveRef"])
+        assert services[row["service"]]["image"] == row["imageRef"]
+        assert row["archiveRef"] == row["imageRef"].split("@", 1)[0]
+        assert row["archiveRef"] not in {"postgres:18.6", "clamav/clamav:1.4.6"}
+        for path, identities in row["sourceInputs"].items():
+            assert path in {
+                "infrastructure/images/security-bases/postgres/Dockerfile",
+                "evidence/WP-400/database-image-candidate-20261003/recipes/postgres/verify-gosu-metadata.sh",
+                "infrastructure/images/security-bases/ingestion-clamd/Dockerfile",
+                "infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh",
+            }
+            # The recipes remain byte-identical; HEAD also works in depth-one native checkouts.
+            blob = subprocess.check_output(["git", "show", "HEAD:" + path], cwd=ROOT)  # noqa: S603,S607 - fixed reviewed recipe blob paths
+            assert hashlib.sha256(blob).hexdigest() == identities["sourceSha256"]
+            assert (
+                hashlib.sha256(blob.replace(b"\r\n", b"\n")).hexdigest()
+                == identities["materializedSha256"]
+            )
+    integration = yaml.safe_load(
+        (ROOT / "infrastructure/compose/docker-compose.wp050-integration.yml").read_text()
+    )
+    assert integration["services"]["postgres"]["image"] == producer.EXTERNAL_IMAGES["postgres"][0]