R-1303: every pin names its security-notice source (upstream.txt, # upstream: above each FROM); gate upstream + decoys. No runtime change.

2026-10-26 23:23:36 +01:00
parent 37f7e40b18
commit e01eb64b25
6 changed files with 80 additions and 0 deletions
@@ -0,0 +1,7 @@
+# upstream.txt — where each pin in infra.go publishes its security notices (the security watch, felhom.eu R-1303).
+# One line per `*Image` const in infra.go: the const name, then its sources. The grammar lives in ONE place:
+# felhom.eu/scripts/security_watch_inventory.py. A const with no line here refuses the push (gate `upstream`).
+TraefikImage      github:traefik/traefik
+CloudflaredImage  github:cloudflare/cloudflared feed:cloudflare-blog vulnnotes:cloudflared
+FileBrowserImage  github:gtsteffaniak/filebrowser
+SambaImage        self