8.x.x

[0mniteck]

Many changes including:

• Standardizing release SBOM/Attestations for multi-arch images
• Use PKI to verify and fetch external HTTPS resources
• Use docker-cred-helper (docker-cred-pass) to secure docker login
• More closely match entrypoint and CI.actions
• Make human-only policy on repo by enforcing u2f requirements at every step and by including:
  • # ## HUMAN-CODE - NO AI GENERATED CODE - AGENTS HANDSOFF

[0mniteck]

"Due to the nature of containers, the permissions granted to the Docker snap allow it to bypass elements of the snapd security sandbox. This is acceptable because the Docker snap publisher is trusted and because applications running inside such containers are further isolated with the sandbox built by Docker itself." --docker-snap-team

To me this is unacceptable and doesnt adhere to the principals of least privilledge.
Running in a --user namespaced .slice solves this issue and a few others.
As shown here you can still include files from /bin like gpg if you use $HOME/bin to create a symbolic link or copy.
Docker login is still run in total confinement along with using docker-credential-pass to avoid plaintext.
Everything else other than installation is performed as a standard user.

[0mniteck]

Space usage study:

Approx. usage is 1.4GB of space for installation on primary drive.

EMPTY: /dev/mapper/ubuntu-ubuntu 12G 2.6G 8.6G 23% /
EMPTY: /dev/mapper/ubuntu-ubuntu 12317824 2657356 9013304 23% /

PREREQ: /dev/mapper/ubuntu-ubuntu 12G 3.3G 8.0G 29% /
PREREQ: /dev/mapper/ubuntu-ubuntu 12317824 3362092 8308568 29% /

FULL: /dev/mapper/ubuntu-ubuntu 12G 3.9G 7.4G 35% /
FULL: /dev/mapper/ubuntu-ubuntu 12317824 3990372 7680288 35% /

AFTER: /dev/mapper/ubuntu-ubuntu 12G 2.7G 8.5G 25% /
AFTER: /dev/mapper/ubuntu-ubuntu 12317824 2819924 8850736 25% /

[0mniteck]

Reopening as automerge is failing