chore: enable OCI artifact type for attestation manifests by sxd · Pull Request #10601 · cloudnative-pg/cloudnative-pg

sxd · 2026-05-03T15:32:17Z

BuildKit's default image exporter does not set artifactType or the OCI 1.1 Referrers subject backlink on attestation manifests. Setting oci-artifact=true adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API.

oci-mediatypes=true is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index has been application/vnd.oci.image.index.v1+json for a while) but kept for clarity.

GUAC is mentioned in the linked issue, but it has a separate bug with multi-arch images that include attestations and will not pick up the change on its own. This PR makes the manifests Referrers-compliant; GUAC discovery needs a fix upstream.

Refs #10600

github-actions · 2026-05-03T15:32:26Z

❗ By default, the pull request is configured to backport to all release branches.

To stop backporting this pr, remove the label: backport-requested ◀️ or add the label 'do not backport'
To stop backporting this pr to a certain release branch, remove the specific branch label: release-x.y

sxd · 2026-05-03T16:15:32Z

/test feature_type=smoke

github-actions · 2026-05-03T16:15:42Z

@sxd, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/25284255888

Buildkit use by default oci-mediatypes and oci-artifacts sets to false, this disable the OCI compatibility of the images making them not easy to find by tools like GUAC or any other that requires the `artifactType` in the manifest properly propagate with an OCI compatible tag. Closes #10600 Signed-off-by: Jonathan Gonzalez V. <[email protected]>

gbartolini · 2026-05-05T05:11:03Z

Hi @sxd, can you please help me verify the change?

There must be something wrong I am doing, as I verified this both locally and against the image built from this branch on GHCR without success.

Local build, using:

./hack/setup-cluster.sh create load

This pushed the image to localhost:5000/cloudnative-pg-testing:latest-prime. I then inspected it with:

crane manifest localhost:5000/cloudnative-pg-testing:latest-prime | jq .

I also tried with:

docker buildx imagetools inspect localhost:5000/cloudnative-pg-testing:latest-prime --raw | jq .

GHCR image built by this PR (ghcr.io/cloudnative-pg/cloudnative-pg-testing:dev-10600@sha256:10a631571f03005e4231dba033de508d1894e503ce38c3a9988b32493c267be2), using:

crane manifest ghcr.io/cloudnative-pg/cloudnative-pg-testing:dev-10600@sha256:10a631571f03005e4231dba033de508d1894e503ce38c3a9988b32493c267be2 | jq .

In both cases, artifactType is absent from the manifest.

I also checked the current production image:

crane manifest ghcr.io/cloudnative-pg/cloudnative-pg:1.29.0 | jq .

It already uses OCI media types (application/vnd.oci.image.index.v1+json), even though it was built from main, where docker-bake.hcl does not have oci-mediatypes=true. This suggests BuildKit is already defaulting to OCI media types, so the problem described in the PR may not actually exist.

Could you help me understand what oci-artifact=true is supposed to do here, and what specific tool or scenario revealed the issue? I want to make sure I'm not missing something before drawing any conclusions.

sxd · 2026-05-05T09:00:33Z

@gbartolini the documentation is here:

Also in the issue and here I mentioned GUAC as the one that I used to find out https://github.com/guacsec/
You have to look into the layers because the top manifest doesn't mention anything since it's multiarch, so you have too look into these layers:

ghcr.io/cloudnative-pg/cloudnative-pg:1.29.0@sha256:1b0fff73e12b7539bc356b8a6fa525a134b0000e75bdbb3f4bb2e1a329875706
ghcr.io/cloudnative-pg/cloudnative-pg-testing:dev-10600@sha256:f6436386857cf1785538def37e7bfb5b8b4cf9b4a0545c5ef6af3732ca0fd507

Hopefully that helps

Also it's a bit tricky because due to a bug in GUAC it will not even show up after the change because GUAC doesn't support multiarch images with buildkit that include attestation.

gbartolini · 2026-05-05T13:06:37Z

Got it. Found it:

docker buildx imagetools inspect --raw ghcr.io/cloudnative-pg/cloudnative-pg-testing:dev-10600@sha256:277a0a3d3a60f052a361b174a0e84c30b9de0d09e6657cf22d245209b4dc5dd1 | jq .
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "artifactType": "application/vnd.docker.attestation.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.empty.v1+json",
    "digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
    "size": 2,
    "data": "e30="
  },
  "layers": [
    {
      "mediaType": "application/vnd.in-toto+json",
      "digest": "sha256:88086847517d317f761c2ce19a58cfc571a8e25ca8bbbd94edb72e16141b8771",
      "size": 927156,
      "annotations": {
        "in-toto.io/predicate-type": "https://spdx.dev/Document"
      }
    },
    {
      "mediaType": "application/vnd.in-toto+json",
      "digest": "sha256:1be4fc2240c9f2ba7223401ce749ac083950df72a44fc742fa7e244022439f29",
      "size": 37042,
      "annotations": {
        "in-toto.io/predicate-type": "https://slsa.dev/provenance/v1"
      }
    }
  ],
  "subject": {
    "mediaType": "application/vnd.oci.image.manifest.v1+json",
    "digest": "sha256:37751f556f8d7a1ba222fe8f78bcf811a76514ec2ca21ce3ab8b31efe08c41ba",
    "size": 4414
  }
}

BuildKit's default image exporter does not set `artifactType` or the OCI 1.1 Referrers `subject` backlink on attestation manifests. Setting `oci-artifact=true` adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API. `oci-mediatypes=true` is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index has been `application/vnd.oci.image.index.v1+json` for a while) but kept for clarity. GUAC is mentioned in the linked issue, but it has a separate bug with multi-arch images that include attestations and will not pick up the change on its own. This PR makes the manifests Referrers-compliant; GUAC discovery needs a fix upstream. Refs #10600 Signed-off-by: Jonathan Gonzalez V. <[email protected]> (cherry picked from commit 770e95c)

BuildKit's default image exporter does not set `artifactType` or the OCI 1.1 Referrers `subject` backlink on attestation manifests. Setting `oci-artifact=true` on the image exporter adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API. `oci-mediatypes=true` is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index is already `application/vnd.oci.image.index.v1+json`) but kept for clarity. Same fix as cloudnative-pg/cloudnative-pg#10601, mirroring cloudnative-pg/postgres-extensions-containers#198. Closes #123 Signed-off-by: Gabriele Bartolini <[email protected]>

##### [\`v1.29.1\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.1) **Release date:** May 8, 2026 ##### Security and Supply Chain - **`CVE-2026-44477` / `GHSA-423p-g724-fr39`: metrics exporter privilege escalation**: the metrics exporter no longer authenticates as the `postgres` superuser. It now uses a dedicated `cnpg_metrics_exporter` role with `pg_monitor` privileges only, closing a chain that let a low-privilege database user gain PostgreSQL superuser. ([`GHSA-423p-g724-fr39`](GHSA-423p-g724-fr39))  Upgrade impact: custom monitoring queries that read user-owned tables, or use `target_databases: '*'` against databases where `PUBLIC CONNECT` has been revoked, need explicit `GRANT` statements to `cnpg_metrics_exporter`. See ["Custom query privileges and safety"](../monitoring.md#custom-query-privileges-and-safety) and ["Manually creating the metrics exporter role"](../monitoring.md#manually-creating-the-metrics-exporter-role) in the monitoring documentation. For replica clusters, upgrade the source primary cluster before any replica clusters that consume from it. The `cnpg_metrics_exporter` role is created on the source primary and replicates downstream; a replica cluster upgraded first will scrape against a missing role until the source primary upgrades. The manual-recovery section linked above also covers replica clusters. - **Schema-qualified catalog references in default monitoring queries**: hardened the shipped monitoring configuration and documentation samples by qualifying every `pg_catalog` object explicitly. Unqualified references resolve through `search_path`, which a database user can manipulate to shadow built-in objects. ([#10576](cloudnative-pg/cloudnative-pg#10576))  - **Discoverable SBOM and provenance attestations**: SBOM and SLSA provenance attached to operator container images now follow the OCI 1.1 Referrers spec, so standard registry tooling and supply-chain scanners can discover them automatically. ([#10601](cloudnative-pg/cloudnative-pg#10601))  - **CVE remediation in `github.com/jackc/pgx/v5`**: bumped to v5.9.2 to pick up upstream fixes for `CVE-2026-33816` (memory-safety in `pgproto3`) and `GHSA-j88v-2chj-qfwx` (SQL injection via simple-protocol dollar-quoted string handling). ([#10437](cloudnative-pg/cloudnative-pg#10437), [#10499](cloudnative-pg/cloudnative-pg#10499)) - **CVE remediation in the Go runtime**: built with Go 1.26.3 to pick up upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net` (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814, CVE-2026-33811, CVE-2026-39825). ([#10463](cloudnative-pg/cloudnative-pg#10463), [#10647](cloudnative-pg/cloudnative-pg#10647))  - **Build pipeline hardening**: the Go 1.26.3 bump also addresses CVE-2026-42501 (`cmd/go` module-checksum validation), reducing supply-chain exposure during release builds. The affected code paths are not reachable from the running operator. ([#10647](cloudnative-pg/cloudnative-pg#10647))  ##### Changes - Switched TLS peer verification from `VerifyPeerCertificate` to `VerifyConnection`, which runs on every completed handshake (the former is skipped on resumed TLS 1.3 sessions). Session resumption is not enabled in CloudNativePG today, so this has no observable effect, but it future-proofs verification if session caching is introduced later. ([#10478](cloudnative-pg/cloudnative-pg#10478))  ##### Fixes - Fixed a failover window where the former primary kept its primary label. If it returned during failover (for example, after a transient network partition), the `-rw` service kept routing to it, replicas could reconnect, and committed writes were lost to `pg_rewind`. The old primary is now labeled `unhealthy` to isolate it from service traffic during failover. ([#10409](cloudnative-pg/cloudnative-pg#10409))  - Fixed failover not being triggered when the node hosting the primary becomes unreachable. The operator now reads the pod's `Ready` condition (flipped to `False` by the node controller when the kubelet stops reporting) instead of `ContainersReady`, which stays stale as `True` in that scenario. Combined with the spurious-failover guard ([#10445](cloudnative-pg/cloudnative-pg#10445)), failover triggers only when Kubernetes itself marks the pod not Ready. ([#10448](cloudnative-pg/cloudnative-pg#10448))  - Fixed spurious failovers caused by transient failures on the primary's HTTP status endpoint. ([#10445](cloudnative-pg/cloudnative-pg#10445))  - Fixed escaping of backslashes and control characters in PostgreSQL configuration values. Previously, such characters in parameters like `log_line_prefix` could corrupt the configuration file or be silently stripped at runtime. ([#10515](cloudnative-pg/cloudnative-pg#10515))  - Fixed `restore_command` construction to shell-quote each argument. Values such as a `destinationPath` containing whitespace (for example, `s3://my bucket/wal`) were word-split by the POSIX shell and passed to the WAL restore tool as separate arguments. ([#10518](cloudnative-pg/cloudnative-pg#10518))  - Tightened `recoveryTarget` validation in the admission webhook: `targetXID` must now be a non-negative 32-bit integer, and `targetName` must be shorter than 64 bytes and free of ASCII control characters. Malformed values are rejected at admission instead of failing later during PostgreSQL recovery. ([#10565](cloudnative-pg/cloudnative-pg#10565))  - Fixed snapshot restores failing when leftover `pgsql_tmp*` directories were present in the data directory. ([#10447](cloudnative-pg/cloudnative-pg#10447))  - Fixed a deadlock occurring when PVC storage size and resource requests are changed simultaneously. ([#10427](cloudnative-pg/cloudnative-pg#10427))

BuildKit's default image exporter does not set `artifactType` or the OCI 1.1 Referrers `subject` backlink on attestation manifests. Setting `oci-artifact=true` on the image exporter adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API. `oci-mediatypes=true` is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index is already `application/vnd.oci.image.index.v1+json`) but kept for clarity. Same fix as cloudnative-pg/cloudnative-pg#10601, mirroring cloudnative-pg/postgres-extensions-containers#198. Closes #436 Signed-off-by: Gabriele Bartolini <[email protected]>

BuildKit's default image exporter does not set `artifactType` or the OCI 1.1 Referrers `subject` backlink on attestation manifests. Setting `oci-artifact=true` on the image exporter adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API. `oci-mediatypes=true` is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index is already `application/vnd.oci.image.index.v1+json`) but kept for clarity. Same fix as cloudnative-pg/cloudnative-pg#10601, mirroring cloudnative-pg/postgres-extensions-containers#198. Closes #123 Signed-off-by: Gabriele Bartolini <[email protected]>

BuildKit's default image exporter does not set `artifactType` or the OCI 1.1 Referrers `subject` backlink on attestation manifests. Setting `oci-artifact=true` on the image exporter adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API. `oci-mediatypes=true` is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index is already `application/vnd.oci.image.index.v1+json`) but kept for clarity. Same fix as cloudnative-pg/cloudnative-pg#10601, mirroring cloudnative-pg/postgres-containers#436. Closes #198 Signed-off-by: Gabriele Bartolini <[email protected]>

BuildKit's default image exporter does not set `artifactType` or the OCI 1.1 Referrers `subject` backlink on attestation manifests. Setting `oci-artifact=true` on the image exporter adds both, so SBOM and provenance attestations become discoverable through the OCI Referrers API. `oci-mediatypes=true` is redundant (BuildKit already defaults it to true when pushing to a registry, which is why the top-level index is already `application/vnd.oci.image.index.v1+json`) but kept for clarity. Same fix as cloudnative-pg/cloudnative-pg#10601, mirroring cloudnative-pg/postgres-extensions-containers#198. Closes #94 Signed-off-by: Gabriele Bartolini <[email protected]>

sxd requested a review from a team May 3, 2026 15:32

dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label May 3, 2026

cnpg-bot added backport-requested ◀️ This pull request should be backported to all supported releases release-1.25 release-1.28 labels May 3, 2026

dosubot Bot added the chore Intangible work to reduce technical debt label May 3, 2026

cnpg-bot added the ok to merge 👌 This PR can be merged label May 3, 2026

gbartolini force-pushed the dev/10600 branch from e0338a7 to 984f4f2 Compare May 5, 2026 03:41

mnencia changed the title ~~chore: setup OCI types to true in docker-backe.hcl~~ chore: setup OCI types to true in docker-bake.hcl May 5, 2026

gbartolini approved these changes May 5, 2026

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label May 5, 2026

mnencia approved these changes May 5, 2026

View reviewed changes

mnencia changed the title ~~chore: setup OCI types to true in docker-bake.hcl~~ chore: enable OCI artifact type for attestation manifests May 5, 2026

mnencia merged commit 770e95c into main May 5, 2026
46 of 47 checks passed

mnencia deleted the dev/10600 branch May 5, 2026 13:22

sxd mentioned this pull request May 5, 2026

[Bug]: Validate CRD components at API level #10621

Closed

4 tasks done

mnencia mentioned this pull request May 5, 2026

[Bug]: Operator images not using OCI format for attestation #10600

Closed

4 tasks done

Navigation Menu

Repository navigation

chore: enable OCI artifact type for attestation manifests - #10601

chore: enable OCI artifact type for attestation manifests#10601
mnencia merged 1 commit into
mainfrom
dev/10600

sxd commented May 3, 2026 •

edited by mnencia

Loading

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

sxd commented May 3, 2026

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

gbartolini commented May 5, 2026

Uh oh!

sxd commented May 5, 2026

Uh oh!

gbartolini commented May 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

sxd commented May 3, 2026 • edited by mnencia Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

sxd commented May 3, 2026

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

gbartolini commented May 5, 2026

Uh oh!

sxd commented May 5, 2026

Uh oh!

gbartolini commented May 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sxd commented May 3, 2026 •

edited by mnencia

Loading