From 4743b678fc6f9567a29022580c1bde88d56ecf77 Mon Sep 17 00:00:00 2001
From: codex <codex@bstein.dev>
Date: Sun, 4 Oct 2026 06:42:38 -0500
Subject: [PATCH] ci: scope credential umask and preserve nonroot execution

---
 Dockerfile.runtime | 2 +-
 Jenkinsfile        | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile.runtime b/Dockerfile.runtime
index 0cec287..ce0f61e 100644
--- a/Dockerfile.runtime
+++ b/Dockerfile.runtime
@@ -1,6 +1,6 @@
 # Jenkins compiles on its scratch PVC; image assembly needs no toolchain layers.
 FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
-COPY soteria /soteria
+COPY --chown=65532:65532 soteria /soteria
 USER 65532:65532
 EXPOSE 8080
 ENTRYPOINT ["/soteria"]
diff --git a/Jenkinsfile b/Jenkinsfile
index 1431dba..88ba076 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -573,6 +573,7 @@ PY
             mkdir -p build/image internal/server/ui-dist
             cp -R web/dist/. internal/server/ui-dist/
             CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -p 2 -buildvcs=false -trimpath -ldflags="-s -w" -o build/image/soteria ./cmd/soteria
+            chmod 0755 build/image/soteria
             cp Dockerfile.runtime build/image/Dockerfile
           '''
         }
@@ -589,9 +590,8 @@ PY
               set -eu
               set +x
               VERSION_TAG=$(cut -d= -f2 build.env)
-              umask 077
               auth=$(printf '%s:%s' "${HARBOR_USERNAME}" "${HARBOR_PASSWORD}" | base64 | tr -d '\\n')
-              printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\\n' "${auth}" > /kaniko/.docker/config.json
+              (umask 077; printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\\n' "${auth}" > /kaniko/.docker/config.json)
               trap 'rm -f /kaniko/.docker/config.json' EXIT
               /kaniko/executor \
                 --context "${WORKSPACE}/build/image" \