From cb39ad8c25f3a07ac1adba094614217163f6f401 Mon Sep 17 00:00:00 2001 From: groupthinking <154503486+groupthinking@users.noreply.github.com> Date: Fri, 13 Nov 2026 09:45:16 +0000 Subject: [PATCH 1/2] fix(security): apply Debian security updates in runtime image The runtime stage builds on python:3.11-slim, whose base layer predates DSA-6613-1. Security run 43343802638 (artifact 14000154856, image sha256:99a1cbcd...) reports zlib1g 1:1.3.dfsg+really1.3.1-1+b1 with CVE-2026-76844 and CVE-2026-85091 (HIGH), both fixed in trixie-security 1:1.3.dfsg+really1.3.1-1+deb13u1; the build log shows '1 not upgraded'. Run apt-get upgrade before installing runtime packages and lock the ordering with a policy test. Refs #2396 --- Dockerfile | 6 +++++- tests/unit/test_merge_policy_security_scan_wording.py | 11 +++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3b9d3d185..bd8c0fb7d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -50,7 +50,11 @@ WORKDIR /app # Install runtime system dependencies (ffmpeg and nodejs v22) # gnupg is required for the Nodesource setup script -RUN apt-get update && apt-get install -y --no-install-recommends \ +# `apt-get upgrade` applies Debian security updates the pinned base layer +# predates (e.g. zlib1g 1:1.3.dfsg+really1.3.1-1+deb13u1, DSA-6613-1). +# Refs #2396: fixable OS findings must not ride in from a stale base layer. +RUN apt-get update && apt-get upgrade -y --no-install-recommends \ + && apt-get install -y --no-install-recommends \ ffmpeg \ curl \ gnupg \ diff --git a/tests/unit/test_merge_policy_security_scan_wording.py b/tests/unit/test_merge_policy_security_scan_wording.py index c1fc023b2..e3423155d 100644 --- a/tests/unit/test_merge_policy_security_scan_wording.py +++ b/tests/unit/test_merge_policy_security_scan_wording.py @@ -100,6 +100,17 @@ def test_image_build_constrains_python_and_runtime_npm(self): self.assertIn("npm install --global npm@12.2.2", dockerfile) self.assertIn("rm -rf /usr/local/lib/python3.11/site-packages/*", dockerfile) + def test_runtime_stage_applies_debian_security_updates(self): + root = Path(__file__).resolve().parents[2] + dockerfile = (root / "Dockerfile").read_text() + runtime = dockerfile.split("AS runtime", 1)[1] + update = runtime.index("apt-get update") + upgrade = runtime.index("apt-get upgrade -y --no-install-recommends") + install = runtime.index("apt-get install -y --no-install-recommends") + self.assertLess(update, upgrade) + self.assertLess(upgrade, install) + self.assertNotIn("dist-upgrade", runtime) + if __name__ == "__main__": unittest.main() From eb70e546059c0585e737e8e6b97932ba54f34906 Mon Sep 17 00:00:00 2001 From: groupthinking <154503486+groupthinking@users.noreply.github.com> Date: Fri, 13 Nov 2026 09:46:29 +0000 Subject: [PATCH 2/2] fix(security): drop pip from the runtime image pip 26.3 (newest on PyPI) ships pip/_vendor/bom.cdx.json declaring its vendored pkg_resources as setuptools 70.3.0. Security run 43343802638 (artifact 14000154856) reports CVE-2025-47273 (HIGH, fixed 78.1.1) against that record, and no pip release clears it yet. The served app (uvicorn) never invokes pip; only the developer-only 'youtube-extension install' CLI shells out to it. Uninstall pip after the builder environment is copied, and lock the placement with a policy test. Refs #2396 --- Dockerfile | 7 +++++++ tests/unit/test_merge_policy_security_scan_wording.py | 10 ++++++++++ 2 files changed, 17 insertions(+) diff --git a/Dockerfile b/Dockerfile index bd8c0fb7d..67de92ad9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -76,6 +76,13 @@ RUN rm -rf /usr/local/lib/python3.11/site-packages/* COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages COPY --from=builder /usr/local/bin /usr/local/bin +# pip is an install-time tool. Its wheel ships pip/_vendor/bom.cdx.json, which +# declares the vendored pkg_resources as setuptools 70.3.0, so image scanners +# report CVE-2025-47273 against it even on the newest pip (26.3). The served +# app (uvicorn) never invokes pip, so drop it from the runtime image. +# Refs #2396. +RUN python -m pip uninstall --yes pip + # Copy installed Node.js packages from builder COPY --from=builder /app/node_modules ./node_modules COPY --from=builder /app/apps/web/node_modules ./apps/web/node_modules diff --git a/tests/unit/test_merge_policy_security_scan_wording.py b/tests/unit/test_merge_policy_security_scan_wording.py index e3423155d..736a1f865 100644 --- a/tests/unit/test_merge_policy_security_scan_wording.py +++ b/tests/unit/test_merge_policy_security_scan_wording.py @@ -111,6 +111,16 @@ def test_runtime_stage_applies_debian_security_updates(self): self.assertLess(upgrade, install) self.assertNotIn("dist-upgrade", runtime) + def test_runtime_stage_drops_pip_after_copying_builder_env(self): + root = Path(__file__).resolve().parents[2] + dockerfile = (root / "Dockerfile").read_text() + runtime = dockerfile.split("AS runtime", 1)[1] + copy_bin = runtime.index("COPY --from=builder /usr/local/bin /usr/local/bin") + uninstall = runtime.index("RUN python -m pip uninstall --yes pip") + self.assertLess(copy_bin, uninstall) + self.assertLess(uninstall, runtime.index("USER appuser")) + self.assertNotIn("pip install", runtime) + if __name__ == "__main__": unittest.main()