stacklok / toolhive / 30101091511

71%

Build Type

push

github

Committed by web-flow

Commit Message

Harden Envoy backend: pin image digest, disable admin interface (#5949)

Pin defaultEnvoyImage to tag+digest for supply-chain integrity. Add a
comment documenting the TOOLHIVE_ENVOY_IMAGE override for users with
image-policy requirements.

Fix PullImage in RegistryImageManager to handle tag@digest references.
name.ParseReference returns name.Digest (not name.Tag) for these, and
the previous name.NewTag(ref.String()) fallback errored because the
@sha256:... suffix is not valid in a tag reference. Now extracts the
tag portion (everything before the '@') from the digest reference.

Remove the admin interface block from the bootstrap. Envoy does not
start an admin server when the field is absent, eliminating the 9901
port surface area with no functional impact on the proxy. Use a
structural JSON assertion (unmarshal → key check) instead of substring
matching to verify the admin block is absent.

Closes #5903

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

0 of 16 new or added lines in 1 file covered. (0.0%)

85 existing lines in 6 files now uncovered.

78787 of 113635 relevant lines covered (69.33%)

80.56 hits per line