From c20b794cf96a164383027011fbd1aa40e78eab10 Mon Sep 17 00:00:00 2001 From: joey-huckabee <138994589+joey-huckabee@users.noreply.github.com> Date: Thu, 10 Sep 2026 19:36:50 -0500 Subject: [PATCH] chore: rename ClickHouse UBI project --- .github/ISSUE_TEMPLATE/bug.yml | 2 +- .github/ISSUE_TEMPLATE/config.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/release.yml | 2 +- .gitignore | 2 +- CHANGELOG.md | 3 +++ CLAUDE.md | 4 ++-- Containerfile | 4 ++-- Containerfile.scap | 4 ++-- README.md | 24 ++++++++++++------------ compose.yaml | 2 +- docs/BADGING.md | 2 +- docs/CI.md | 20 ++++++++++---------- docs/OPENSHIFT-TESTING.md | 2 +- docs/OPENSSF_SCORECARD.md | 6 +++--- docs/PODMAN.md | 6 +++--- docs/PRODUCTION.md | 2 +- docs/QUALIFICATION.md | 8 ++++---- docs/ROADMAP.md | 2 +- docs/ROOTLESS.md | 10 +++++----- docs/SCAP.md | 10 +++++----- docs/TLS-REHEARSAL.md | 12 ++++++------ docs/TLS.md | 4 ++-- scripts/scap-scan.sh | 2 +- tests/smoke.sh | 2 +- tests/tls-rehearsal.sh | 2 +- 26 files changed, 73 insertions(+), 70 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index 252ab38..323592f 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -14,7 +14,7 @@ body: attributes: label: Image tag and digest description: Include both when available; do not report only `latest`. - placeholder: ghcr.io/datopsis/clickhouse-server-ubi9:v...@sha256:... + placeholder: ghcr.io/datopsis/clickhouse-ubi:v...@sha256:... validations: required: true - type: input diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index afc010b..225db76 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,7 +1,7 @@ blank_issues_enabled: true contact_links: - name: Report a vulnerability privately - url: https://github.com/datopsis/clickhouse-server-ubi9/security/advisories/new + url: https://github.com/datopsis/clickhouse-ubi/security/advisories/new about: Never disclose a suspected vulnerability in a public issue. - name: ClickHouse upstream support url: https://github.com/ClickHouse/ClickHouse/issues diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a047f7f..1402c5a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -76,8 +76,8 @@ jobs: contents: read security-events: write env: - TEST_IMAGE: ghcr.io/datopsis/clickhouse-server-ubi9:test-${{ matrix.architecture }} - SBOM_FILE: clickhouse-server-ubi9-${{ matrix.architecture }}.spdx.json + TEST_IMAGE: ghcr.io/datopsis/clickhouse-ubi:test-${{ matrix.architecture }} + SBOM_FILE: clickhouse-ubi-${{ matrix.architecture }}.spdx.json GRYPE_SARIF: grype-${{ matrix.architecture }}.sarif GRYPE_ALL: grype-all-${{ matrix.architecture }}.json SCAP_SCANNER_IMAGE: localhost/datopsis-openscap:0.1.82-${{ matrix.architecture }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 00e9e9c..b21da9b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,7 +12,7 @@ concurrency: cancel-in-progress: false env: - IMAGE: ghcr.io/datopsis/clickhouse-server-ubi9 + IMAGE: ghcr.io/datopsis/clickhouse-ubi jobs: release: diff --git a/.gitignore b/.gitignore index 2a3417b..86bc68a 100644 --- a/.gitignore +++ b/.gitignore @@ -6,7 +6,7 @@ .pre-commit-cache/ .smoke-secrets.*/ .tls-rehearsal.*/ -/clickhouse-server-ubi9.spdx.json +/clickhouse-ubi.spdx.json /grype.sarif /grype-all.json /image.intoto.jsonl diff --git a/CHANGELOG.md b/CHANGELOG.md index a4e7bb3..268cd41 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -33,4 +33,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Changed +- Renamed the source repository and planned GHCR image from + `clickhouse-server-ubi`/`clickhouse-server-ubi9` to `clickhouse-ubi`, aligning + the public identity with the `nginx-ubi` and `postgresql-ubi` projects. - The entrypoint now derives primary and additional writable directories from the effective ClickHouse configuration, rejects the misleading `CLICKHOUSE_DATA_DIR` variable, and reports non-root permission failures before server startup. diff --git a/CLAUDE.md b/CLAUDE.md index fe2d57a..c593d21 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -9,8 +9,8 @@ This repository builds a security-oriented ClickHouse Server container on Red Ha Build and test commands are documented in `README.md`. The primary local verification is: ```bash -podman build --format docker --file Containerfile --tag ghcr.io/datopsis/clickhouse-server-ubi9:test . -CONTAINER_RUNTIME=podman IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test bash tests/smoke.sh +podman build --format docker --file Containerfile --tag ghcr.io/datopsis/clickhouse-ubi:test . +CONTAINER_RUNTIME=podman IMAGE=ghcr.io/datopsis/clickhouse-ubi:test bash tests/smoke.sh ``` ## Git conventions diff --git a/Containerfile b/Containerfile index e1837b9..4c0ebf9 100644 --- a/Containerfile +++ b/Containerfile @@ -74,8 +74,8 @@ ARG CLICKHOUSE_VERSION="26.8.2.7" LABEL org.opencontainers.image.title="ClickHouse Server on Red Hat UBI 9" \ org.opencontainers.image.description="A minimal, non-root ClickHouse Server image built on Red Hat UBI 9 Micro" \ - org.opencontainers.image.source="https://github.com/datopsis/clickhouse-server-ubi9" \ - org.opencontainers.image.documentation="https://github.com/datopsis/clickhouse-server-ubi9#readme" \ + org.opencontainers.image.source="https://github.com/datopsis/clickhouse-ubi" \ + org.opencontainers.image.documentation="https://github.com/datopsis/clickhouse-ubi#readme" \ org.opencontainers.image.licenses="Apache-2.0" \ org.opencontainers.image.vendor="Datopsis" \ org.opencontainers.image.version="${CLICKHOUSE_VERSION}" diff --git a/Containerfile.scap b/Containerfile.scap index 7010122..83c9f8c 100644 --- a/Containerfile.scap +++ b/Containerfile.scap @@ -38,8 +38,8 @@ COPY --chmod=0755 scripts/scap-container.sh /usr/local/bin/scap-container COPY --chown=0:0 --chmod=0444 security/scap/datopsis-ubi9-micro-tailoring.xml /opt/scap/datopsis-ubi9-micro-tailoring.xml LABEL org.opencontainers.image.title="Datopsis OpenSCAP offline scanner" \ - org.opencontainers.image.description="Pinned, isolated CI scanner for clickhouse-server-ubi9 exported filesystems" \ - org.opencontainers.image.source="https://github.com/datopsis/clickhouse-server-ubi9" + org.opencontainers.image.description="Pinned, isolated CI scanner for clickhouse-ubi exported filesystems" \ + org.opencontainers.image.source="https://github.com/datopsis/clickhouse-ubi" USER 65534:65534 diff --git a/README.md b/README.md index cd5975e..6581e48 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,10 @@ # ClickHouse Server on Red Hat UBI 9 -[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/datopsis/clickhouse-server-ubi9/badge)](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-server-ubi9) -[![CI](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/ci.yml) -[![CodeQL](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/codeql.yml) -[![Latest release](https://img.shields.io/github/v/release/datopsis/clickhouse-server-ubi9?display_name=tag&sort=semver)](https://github.com/datopsis/clickhouse-server-ubi9/releases) -[![License](https://img.shields.io/github/license/datopsis/clickhouse-server-ubi9)](LICENSE) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/datopsis/clickhouse-ubi/badge)](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-ubi) +[![CI](https://github.com/datopsis/clickhouse-ubi/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-ubi/actions/workflows/ci.yml) +[![CodeQL](https://github.com/datopsis/clickhouse-ubi/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-ubi/actions/workflows/codeql.yml) +[![Latest release](https://img.shields.io/github/v/release/datopsis/clickhouse-ubi?display_name=tag&sort=semver)](https://github.com/datopsis/clickhouse-ubi/releases) +[![License](https://img.shields.io/github/license/datopsis/clickhouse-ubi)](LICENSE) [![Base: Red Hat UBI 9](https://img.shields.io/badge/base-Red%20Hat%20UBI%209-EE0000?logo=redhat&logoColor=white)](https://developers.redhat.com/products/rhel/ubi) [![SBOM: SPDX JSON](https://img.shields.io/badge/SBOM-SPDX%20JSON-2F80ED)](docs/CI.md#artifacts-and-retention) @@ -48,7 +48,7 @@ podman run --detach \ --cap-drop ALL \ --security-opt no-new-privileges \ --volume clickhouse-data:/var/lib/clickhouse \ - ghcr.io/datopsis/clickhouse-server-ubi9: + ghcr.io/datopsis/clickhouse-ubi: ``` Then query it with a ClickHouse client: @@ -104,9 +104,9 @@ Podman is the primary documented local runtime. Podman uses OCI format by defaul ```console podman build --format docker --file Containerfile \ - --tag ghcr.io/datopsis/clickhouse-server-ubi9:test . + --tag ghcr.io/datopsis/clickhouse-ubi:test . CONTAINER_RUNTIME=podman \ - IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test \ + IMAGE=ghcr.io/datopsis/clickhouse-ubi:test \ bash tests/smoke.sh ``` @@ -128,14 +128,14 @@ Verify a release with GitHub as the keyless identity provider: ```console cosign verify \ - --certificate-identity-regexp='https://github.com/datopsis/clickhouse-server-ubi9/.github/workflows/release.yml@refs/tags/.*' \ + --certificate-identity-regexp='https://github.com/datopsis/clickhouse-ubi/.github/workflows/release.yml@refs/tags/.*' \ --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: cosign verify-attestation --type spdxjson \ - --certificate-identity-regexp='https://github.com/datopsis/clickhouse-server-ubi9/.github/workflows/release.yml@refs/tags/.*' \ + --certificate-identity-regexp='https://github.com/datopsis/clickhouse-ubi/.github/workflows/release.yml@refs/tags/.*' \ --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` ## Operational notes diff --git a/compose.yaml b/compose.yaml index 415c228..119018e 100644 --- a/compose.yaml +++ b/compose.yaml @@ -3,7 +3,7 @@ services: build: context: . dockerfile: Containerfile - image: ghcr.io/datopsis/clickhouse-server-ubi9:local + image: ghcr.io/datopsis/clickhouse-ubi:local environment: CLICKHOUSE_PASSWORD: change-me ports: diff --git a/docs/BADGING.md b/docs/BADGING.md index 7a5922d..1382476 100644 --- a/docs/BADGING.md +++ b/docs/BADGING.md @@ -22,7 +22,7 @@ The canonical badge markup lives at the top of `README.md`. When changing it: 1. use HTTPS for both the image and destination; 2. link workflow badges to the workflow page, not to a single run; -3. keep repository coordinates explicit as `datopsis/clickhouse-server-ubi9`; +3. keep repository coordinates explicit as `datopsis/clickhouse-ubi`; 4. URL-encode static badge labels and values; 5. preview links while signed out so badges do not depend on private credentials; and 6. update this inventory in the same pull request. diff --git a/docs/CI.md b/docs/CI.md index bd31b5f..4492633 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -84,7 +84,7 @@ Trivy and Grype deliberately overlap. They use different databases and matching | Artifact | Location | Retention or lifecycle | Purpose | | --- | --- | --- | --- | -| `clickhouse-server-ubi9-.spdx.json` | CI artifact `image-security--` | 14 days | Package inventory for the exact native AMD64 or ARM64 test image. | +| `clickhouse-ubi-.spdx.json` | CI artifact `image-security--` | 14 days | Package inventory for the exact native AMD64 or ARM64 test image. | | `grype-.sarif` | Same architecture-specific CI artifact and GitHub code scanning on non-PR runs | 14 days for the downloadable artifact | Machine-readable findings and architecture-specific review evidence. | | `grype-all-.json` | Architecture-specific CI artifact | 14 days | Complete point-in-time inventory including unfixed Low and Medium matches for human triage. The release workflow separately retains `grype-all.json` for 30 days. | | `scap-results-/` | Architecture-specific CI artifact | 14 days | Tailored ARF/XCCDF/HTML, full JSON rule inventory, exit code, data-stream and tailoring hashes, scanner version, and RPM versions for the exact target/scanner image IDs. | @@ -106,11 +106,11 @@ ARCHITECTURE=amd64 MACHINE=x86_64 test "$(uname -m)" = "${MACHINE}" podman build --format docker --platform "linux/${ARCHITECTURE}" \ - --file Containerfile --tag "clickhouse-server-ubi9:test-${ARCHITECTURE}" . + --file Containerfile --tag "clickhouse-ubi:test-${ARCHITECTURE}" . test "$(podman image inspect --format '{{.Architecture}}' \ - "clickhouse-server-ubi9:test-${ARCHITECTURE}")" = "${ARCHITECTURE}" + "clickhouse-ubi:test-${ARCHITECTURE}")" = "${ARCHITECTURE}" CONTAINER_RUNTIME=podman \ - IMAGE="clickhouse-server-ubi9:test-${ARCHITECTURE}" bash tests/smoke.sh + IMAGE="clickhouse-ubi:test-${ARCHITECTURE}" bash tests/smoke.sh ``` Build and run the isolated tailored SCAP scanner with the Podman procedure in @@ -123,7 +123,7 @@ For the scanner examples below, keep using the architecture-specific image name: ```console ARCHITECTURE=amd64 -IMAGE="clickhouse-server-ubi9:test-${ARCHITECTURE}" +IMAGE="clickhouse-ubi:test-${ARCHITECTURE}" ``` With Trivy, Syft 1.51.1, and Grype 0.118.0 installed from their official release instructions: @@ -131,13 +131,13 @@ With Trivy, Syft 1.51.1, and Grype 0.118.0 installed from their official release ```console trivy config --severity HIGH,CRITICAL --exit-code 1 . trivy image --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1 "${IMAGE}" -syft "${IMAGE}" --output "spdx-json=clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" +syft "${IMAGE}" --output "spdx-json=clickhouse-ubi-${ARCHITECTURE}.spdx.json" python scripts/augment-spdx.py \ - --input "clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" \ - --output "clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" -grype "sbom:clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" \ + --input "clickhouse-ubi-${ARCHITECTURE}.spdx.json" \ + --output "clickhouse-ubi-${ARCHITECTURE}.spdx.json" +grype "sbom:clickhouse-ubi-${ARCHITECTURE}.spdx.json" \ --only-fixed --fail-on high --output table -grype "sbom:clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" \ +grype "sbom:clickhouse-ubi-${ARCHITECTURE}.spdx.json" \ --fail-on critical --output json > "grype-all-${ARCHITECTURE}.json" ``` diff --git a/docs/OPENSHIFT-TESTING.md b/docs/OPENSHIFT-TESTING.md index 3498df0..d1fe12a 100644 --- a/docs/OPENSHIFT-TESTING.md +++ b/docs/OPENSHIFT-TESTING.md @@ -68,7 +68,7 @@ Run the remaining commands in Bash or Git Bash from the repository root: ```console export PROJECT=clickhouse-qualification -export IMAGE_REF='ghcr.io/datopsis/clickhouse-server-ubi9@sha256:<64-hex-digest>' +export IMAGE_REF='ghcr.io/datopsis/clickhouse-ubi@sha256:<64-hex-digest>' export EVIDENCE_DIR="openshift-evidence-$(date -u +%Y%m%dT%H%M%SZ)" export SECRET_DIR="$(mktemp -d)" umask 077 diff --git a/docs/OPENSSF_SCORECARD.md b/docs/OPENSSF_SCORECARD.md index 536b58d..06f0ccb 100644 --- a/docs/OPENSSF_SCORECARD.md +++ b/docs/OPENSSF_SCORECARD.md @@ -17,7 +17,7 @@ The separate `CodeQL` workflow performs genuine static analysis of this reposito ## Where to view current results -The current public score and per-check details are in the [OpenSSF Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-server-ubi9). The [OpenSSF Scorecard workflow history](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/scorecard.yml) shows each run and exposes its downloadable SARIF artifact for five days. Uploaded findings are also available under the repository's **Security > Code scanning** page to users with the required GitHub access. +The current public score and per-check details are in the [OpenSSF Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-ubi). The [OpenSSF Scorecard workflow history](https://github.com/datopsis/clickhouse-ubi/actions/workflows/scorecard.yml) shows each run and exposes its downloadable SARIF artifact for five days. Uploaded findings are also available under the repository's **Security > Code scanning** page to users with the required GitHub access. This file documents the repository's policy, controls, initial baseline, and expected score movement. It is not a copy of the live report; use the viewer or the latest workflow run for current results. @@ -96,12 +96,12 @@ export GITHUB_AUTH_TOKEN="$(gh auth token)" podman run --rm \ --env GITHUB_AUTH_TOKEN \ ghcr.io/ossf/scorecard:v5.5.0@sha256:2ad2ced1cc8d080a589fac211944834c0da3dd82a4d7b0e70a642b6be76987d7 \ - --repo=github.com/datopsis/clickhouse-server-ubi9 \ + --repo=github.com/datopsis/clickhouse-ubi \ --show-details unset GITHUB_AUTH_TOKEN ``` -For machine-readable output, add `--format=json`. The public result is available from the [Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-server-ubi9) after the publishing workflow completes. +For machine-readable output, add `--format=json`. The public result is available from the [Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-ubi) after the publishing workflow completes. ## Review cadence diff --git a/docs/PODMAN.md b/docs/PODMAN.md index 03d7e9e..57cd8f0 100644 --- a/docs/PODMAN.md +++ b/docs/PODMAN.md @@ -19,9 +19,9 @@ Podman's default build format is OCI. Use Docker manifest format for local build ```console podman build --format docker --file Containerfile \ - --tag ghcr.io/datopsis/clickhouse-server-ubi9:test . + --tag ghcr.io/datopsis/clickhouse-ubi:test . CONTAINER_RUNTIME=podman \ - IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test \ + IMAGE=ghcr.io/datopsis/clickhouse-ubi:test \ bash tests/smoke.sh ``` @@ -38,7 +38,7 @@ podman run --detach --name clickhouse \ --read-only --tmpfs /tmp:size=256m,mode=1777 \ --cap-drop ALL --security-opt no-new-privileges \ --volume clickhouse-data:/var/lib/clickhouse \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` For a Linux bind mount, use `podman unshare chown 101:0 ` to express the image identity through the rootless user namespace. Do not assume that container UID `101` must appear as host UID `101`. Podman's `:U` volume option is an alternative, but it recursively changes the host tree and can be slow. Follow [rootless storage and permissions](ROOTLESS.md) for complete named-volume, bind-mount, SELinux, additional-disk, and OpenShift procedures. diff --git a/docs/PRODUCTION.md b/docs/PRODUCTION.md index b59fcb8..1479c5f 100644 --- a/docs/PRODUCTION.md +++ b/docs/PRODUCTION.md @@ -7,7 +7,7 @@ Production readiness is a property of a tested deployment, not an image label. C - Decide whether one node is sufficient. A single node has no database-service high availability; use ClickHouse replication and Keeper only after designing failure domains, quorum, inter-server authentication, and recovery. - Use a ClickHouse LTS line when long maintenance windows matter, and document the supported UBI/ClickHouse combinations and end-of-support date. - Assign owners for the image, database, storage, certificates, backups, vulnerability triage, and incident response. -- Pin `ghcr.io/datopsis/clickhouse-server-ubi9@sha256:`. Verify the release signature, SBOM, and provenance before promotion. Never deploy a failed or unsigned candidate tag. +- Pin `ghcr.io/datopsis/clickhouse-ubi@sha256:`. Verify the release signature, SBOM, and provenance before promotion. Never deploy a failed or unsigned candidate tag. ## 2. Prepare identity and secrets diff --git a/docs/QUALIFICATION.md b/docs/QUALIFICATION.md index 3a93124..d41e5e7 100644 --- a/docs/QUALIFICATION.md +++ b/docs/QUALIFICATION.md @@ -4,15 +4,15 @@ This file records durable links and concise results for first-release gates. Dow ## Native AMD64 and ARM64 CI — 2026-09-07 -- Pull request: [#5](https://github.com/datopsis/clickhouse-server-ubi9/pull/5) +- Pull request: [#5](https://github.com/datopsis/clickhouse-ubi/pull/5) - Head commit: `2e2b07045990c31acbab32c59f53e2979efbedd5` - Pull-request merge commit tested by CI: `523ae3754ef8aa81bd8a3f765ec2591dcb8f2182` -- Workflow: [CI run 34125673268](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268) +- Workflow: [CI run 34125673268](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268) - Aggregate `image` gate: passed after both native jobs completed. | Evidence | AMD64 | ARM64 | | --- | --- | --- | -| Native job | [image (amd64)](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/job/101753657567) | [image (arm64)](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/job/101753657581) | +| Native job | [image (amd64)](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/job/101753657567) | [image (arm64)](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/job/101753657581) | | Runner architecture | `x86_64` | `aarch64` | | Loaded image architecture | `amd64` | `arm64` | | ClickHouse smoke result | 26.8.2.7 passed | 26.8.2.7 passed | @@ -21,7 +21,7 @@ This file records durable links and concise results for first-release gates. Dow | Augmented SPDX/Grype inventory | 37 packages | 37 packages | | Blocking Grype result | Passed; all 24 matches were excluded by the fixed High/Critical gate | Passed; all 24 matches were excluded by the fixed High/Critical gate | | Full Grype inventory | Retained; 24 unfixed matches require release triage | Retained; 24 unfixed matches require release triage | -| Security artifact | [AMD64 artifact 10020245728](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/artifacts/10020245728) | [ARM64 artifact 10020200009](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/artifacts/10020200009) | +| Security artifact | [AMD64 artifact 10020245728](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/artifacts/10020245728) | [ARM64 artifact 10020200009](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/artifacts/10020200009) | This is successful architecture and fixed-vulnerability-gate evidence, not acceptance of the 24 unfixed Grype matches. Those findings remain subject to the documented release triage, ownership, compensating-control, and expiry process. diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 48e7012..7768fb7 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -1,7 +1,7 @@ # First-release roadmap This roadmap is the release gate for the first supported -`clickhouse-server-ubi9` image. Work is organized in small, reviewable packages +`clickhouse-ubi` image. Work is organized in small, reviewable packages whose order follows technical dependencies. Evidence is expected to be regenerated as the candidate changes; preserving an older artifact must never delay a necessary implementation or security change. diff --git a/docs/ROOTLESS.md b/docs/ROOTLESS.md index 3f4a2e8..a3e237e 100644 --- a/docs/ROOTLESS.md +++ b/docs/ROOTLESS.md @@ -31,7 +31,7 @@ podman run --detach --name clickhouse \ --cap-drop ALL --security-opt no-new-privileges \ --volume ./storage.xml:/etc/clickhouse-server/config.d/storage.xml:ro,Z \ --volume ./clickhouse-storage/data:/data/clickhouse:Z \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` This remains runtime-selectable container configuration: no derived image is required. The difference is that the value is expressed in ClickHouse XML rather than an environment variable, preventing the entrypoint and server from using conflicting locations. Deployment automation may render the XML or ConfigMap before creating the container, but the resulting `` and mounted volume must agree. @@ -58,7 +58,7 @@ podman run --detach --name clickhouse \ --read-only --tmpfs /tmp:size=256m,mode=1777 \ --cap-drop ALL --security-opt no-new-privileges \ --volume clickhouse-data:/var/lib/clickhouse \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` The `/tmp` mount is required with a read-only root filesystem. The entrypoint writes its generated users configuration under `/tmp/clickhouse-entrypoint`; ClickHouse table data remains on the persistent configured data path. @@ -76,7 +76,7 @@ podman run --detach --name clickhouse \ --read-only --tmpfs /tmp:size=256m,mode=1777 \ --cap-drop ALL --security-opt no-new-privileges \ --volume ./clickhouse-data:/var/lib/clickhouse:Z \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` The `:Z` option gives a private SELinux label. Coordinate labeling with the host administrator when the same content must be shared; do not disable SELinux to work around a denial. Podman's `:U` option can perform the mapped recursive ownership change automatically, but it modifies the host tree and can delay startup, so this guide uses the explicit `podman unshare` preparation instead. @@ -144,7 +144,7 @@ podman run --detach --name clickhouse \ --volume ./clickhouse-storage/tmp:/data/clickhouse-tmp:Z \ --volume ./clickhouse-storage/user-files:/data/user-files:Z \ --volume ./clickhouse-storage/format-schemas:/data/format-schemas:Z \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` At startup the entrypoint reads the effective `path`, `tmp_path`, `user_files_path`, and `format_schema_path`. Relative auxiliary paths are resolved below the primary data path. The primary `` must be absolute so its persistent-storage boundary is unambiguous. @@ -182,7 +182,7 @@ check the container identity, mount flags, ownership, mode, ACL, SELinux label, ```console podman inspect clickhouse --format '{{.Config.User}} {{json .Mounts}}' podman run --rm --entrypoint id \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: namei -l ./clickhouse-data getfacl ./clickhouse-data ls -ldZ ./clickhouse-data diff --git a/docs/SCAP.md b/docs/SCAP.md index f6d8803..b5401c1 100644 --- a/docs/SCAP.md +++ b/docs/SCAP.md @@ -120,7 +120,7 @@ certification. ## Initial native discovery result -[GitHub Actions run 34151979084](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34151979084) +[GitHub Actions run 34151979084](https://github.com/datopsis/clickhouse-ubi/actions/runs/34151979084) qualified commit `c099690` on both native architectures. The retained AMD64 and ARM64 inventories contained the same 1,540 rule IDs and results: @@ -178,7 +178,7 @@ in-place package-manager rule. ### Initial tailored qualification -[GitHub Actions run 34162299349](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34162299349) +[GitHub Actions run 34162299349](https://github.com/datopsis/clickhouse-ubi/actions/runs/34162299349) evaluated the profile on native AMD64 and ARM64 during pull-request review. Each architecture produced exactly 36 `pass` and 1,504 `notselected` results, OpenSCAP exit code 0, no operational error, and the same complete rule/result @@ -244,11 +244,11 @@ filesystem/chroot capabilities only inside Podman's user namespace; it does not require host root or start the ClickHouse image as root. ```console -git clone https://github.com/datopsis/clickhouse-server-ubi9.git -cd clickhouse-server-ubi9 +git clone https://github.com/datopsis/clickhouse-ubi.git +cd clickhouse-ubi ARCHITECTURE=amd64 # use arm64 on an ARM64 host -IMAGE="localhost/clickhouse-server-ubi9:test-${ARCHITECTURE}" +IMAGE="localhost/clickhouse-ubi:test-${ARCHITECTURE}" SCANNER_IMAGE="localhost/datopsis-openscap:0.1.82-${ARCHITECTURE}" podman build --format docker --platform "linux/${ARCHITECTURE}" \ diff --git a/docs/TLS-REHEARSAL.md b/docs/TLS-REHEARSAL.md index bc453d6..ccab3a6 100644 --- a/docs/TLS-REHEARSAL.md +++ b/docs/TLS-REHEARSAL.md @@ -10,7 +10,7 @@ Never place a private key, CSR containing private material, CA signing key, pass ```console CONTAINER_RUNTIME=podman \ - IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test \ + IMAGE=ghcr.io/datopsis/clickhouse-ubi:test \ bash tests/tls-rehearsal.sh ``` @@ -45,7 +45,7 @@ in the native AMD64 or ARM64 GitHub Actions jobs. Record these values in the release-candidate evidence before creating keys: ```console -IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9@sha256: +IMAGE=ghcr.io/datopsis/clickhouse-ubi@sha256: SERVER_DNS=clickhouse.example.internal HTTPS_PORT=8443 NATIVE_TLS_PORT=9440 @@ -61,11 +61,11 @@ On an approved connected staging host, verify and export the immutable release: podman pull "${IMAGE}" podman image inspect "${IMAGE}" --format '{{.Digest}} {{.Architecture}}' cosign verify \ - --certificate-identity-regexp='https://github.com/datopsis/clickhouse-server-ubi9/.github/workflows/release.yml@refs/tags/.*' \ + --certificate-identity-regexp='https://github.com/datopsis/clickhouse-ubi/.github/workflows/release.yml@refs/tags/.*' \ --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \ "${IMAGE}" podman save --format oci-archive \ - --output clickhouse-server-ubi9.oci "${IMAGE}" + --output clickhouse-ubi.oci "${IMAGE}" ``` Download the release's `image.spdx.json`, `image.sigstore.json`, and `image.intoto.jsonl`. Export only the public CA roots/intermediates authorized inside the disconnected network. Include offline installers or archives for Podman, OpenSSL, `cosign`, ClickHouse clients, and approved scanner databases when those tools are not already managed inside the boundary. @@ -73,7 +73,7 @@ Download the release's `image.spdx.json`, `image.sigstore.json`, and `image.into Create an inventory and hashes: ```console -sha256sum clickhouse-server-ubi9.oci \ +sha256sum clickhouse-ubi.oci \ image.spdx.json image.sigstore.json image.intoto.jsonl \ authorized-ca-bundle.pem > SHA256SUMS sha256sum --check SHA256SUMS @@ -87,7 +87,7 @@ Copy the transfer set to a controlled staging directory, make it read-only after ```console sha256sum --check SHA256SUMS -podman load --input clickhouse-server-ubi9.oci +podman load --input clickhouse-ubi.oci podman image inspect "${IMAGE}" --format '{{.Digest}} {{.Architecture}}' cosign verify --offline \ --bundle image.sigstore.json \ diff --git a/docs/TLS.md b/docs/TLS.md index a8a1107..b8b83fe 100644 --- a/docs/TLS.md +++ b/docs/TLS.md @@ -111,7 +111,7 @@ podman run --detach --name clickhouse \ --volume ./tls.xml:/etc/clickhouse-server/config.d/tls.xml:ro,Z \ --volume ./tls.crt:/etc/clickhouse-server/certs/tls.crt:ro,Z \ --volume ./tls.key:/etc/clickhouse-server/certs/tls.key:ro,Z \ - ghcr.io/datopsis/clickhouse-server-ubi9@sha256: + ghcr.io/datopsis/clickhouse-ubi@sha256: ``` `EXPOSE` is image metadata, not a firewall; publishing `8443` and `9440` works even though the image metadata lists the upstream defaults. The example removes ports `8123` and `9000`. Do not publish those clear-text ports when TLS is mandatory. Port `9009` is inter-server HTTP and must remain private; clustered deployments should separately configure `interserver_https_port` and credentials. @@ -191,7 +191,7 @@ This configures the ClickHouse/Poco TLS client with strict validation. Individua An alternative is a derived image with the private CA added to the RHEL trust store: ```dockerfile -FROM ghcr.io/datopsis/clickhouse-server-ubi9@sha256: +FROM ghcr.io/datopsis/clickhouse-ubi@sha256: USER 0 COPY organization-root-ca.pem /etc/pki/ca-trust/source/anchors/ RUN update-ca-trust diff --git a/scripts/scap-scan.sh b/scripts/scap-scan.sh index 5a1fe06..fc79ab5 100644 --- a/scripts/scap-scan.sh +++ b/scripts/scap-scan.sh @@ -2,7 +2,7 @@ set -Eeuo pipefail runtime="${CONTAINER_RUNTIME:-podman}" -target_image="${IMAGE:-ghcr.io/datopsis/clickhouse-server-ubi9:test}" +target_image="${IMAGE:-ghcr.io/datopsis/clickhouse-ubi:test}" scanner_image="${SCAP_SCANNER_IMAGE:-localhost/datopsis-openscap:0.1.82}" profile="xccdf_org.datopsis_profile_ubi9_micro_container" architecture="${ARCHITECTURE:-$(uname -m)}" diff --git a/tests/smoke.sh b/tests/smoke.sh index ad9b8ce..ef15bfb 100644 --- a/tests/smoke.sh +++ b/tests/smoke.sh @@ -2,7 +2,7 @@ set -Eeuo pipefail runtime="${CONTAINER_RUNTIME:-podman}" -image="${IMAGE:-ghcr.io/datopsis/clickhouse-server-ubi9:test}" +image="${IMAGE:-ghcr.io/datopsis/clickhouse-ubi:test}" repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" run_id="${RANDOM}-$$" prefix="clickhouse-ubi9-smoke-${run_id}" diff --git a/tests/tls-rehearsal.sh b/tests/tls-rehearsal.sh index 89e6fda..d72510a 100644 --- a/tests/tls-rehearsal.sh +++ b/tests/tls-rehearsal.sh @@ -2,7 +2,7 @@ set -Eeuo pipefail runtime="${CONTAINER_RUNTIME:-podman}" -image="${IMAGE:-ghcr.io/datopsis/clickhouse-server-ubi9:test}" +image="${IMAGE:-ghcr.io/datopsis/clickhouse-ubi:test}" repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" run_id="${RANDOM}-$$" prefix="clickhouse-ubi9-tls-${run_id}"