mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-22 16:16:41 +00:00
Anso
7e4ea714c1
* feat(security): rebuild Docker CLI/Compose from source, pin base image digests Build Docker CLI v29.4.0 and Compose v5.1.2 from source against Go 1.26.2 to resolve 7 CVEs that were accepted in .trivyignore: - CVE-2026-32280/32281/32282/32283/33810: Go stdlib x509/TLS and DNS issues in the upstream static CLI binary (compiled with Go 1.26.1). All fixed by rebuilding with Go 1.26.2. - CVE-2026-33186: grpc 1.78.0 in Docker CLI. Eliminated from the SBOM by building with the patched Go toolchain and updated module graph. - CVE-2026-33671: picomatch ReDoS in npm bundled with node:22-alpine. Resolved by removing npm/npx from the runtime image entirely (npm is only needed at build time). Remaining 5 entries in .trivyignore are vendored deps inside Compose v5.1.2 (buildkit, moby/docker, otel) that cannot be patched without an upstream Compose release. These will be expressed as OpenVEX not_affected statements in the follow-up PR (feat/security-sbom-vex). Also in this commit: - Pin all Dockerfile FROM lines to @sha256: digests (node:22-alpine, tonistiigi/xx, golang:1.26-alpine) to prevent silent base image changes between scan and publish. - SHA-pin all GitHub Actions in docker-publish.yml and ci.yml that were previously referenced by mutable @vN tags. - Add a binary version smoke test to confirm docker/compose produce expected output before the multi-arch push proceeds. * fix(docker): fix cli-builder vendor mode and compose-builder cache path docker/cli v29.4.0 uses CalVer and ships vendor.mod instead of go.mod, so plain `go build` fails with "cannot find main module." Fix: copy vendor.mod -> go.mod and vendor.sum -> go.sum before building, then pass -mod=vendor so all deps come from the vendored tree with no network access. Cache mount is not needed with vendor mode and is removed. compose-builder used /root/go/pkg/mod as the cache mount target, but golang:alpine sets GOPATH=/go, so the module cache lives at /go/pkg/mod. The wrong path caused a silent cache miss on every build. Corrected.
76 lines
3.9 KiB
Plaintext
76 lines
3.9 KiB
Plaintext
# Trivy ignore list
|
|
#
|
|
# Every entry in this file is a known HIGH or CRITICAL CVE that we have
|
|
# consciously accepted risk on and decided not to block CI over. Format:
|
|
#
|
|
# CVE-YYYY-NNNNN
|
|
# # Justification: why we're accepting this risk, and a link or note about
|
|
# # when to revisit (e.g. "blocked on upstream base image update, revisit
|
|
# # when alpine/node:22 ships a fix").
|
|
#
|
|
# Rules:
|
|
# - Every CVE MUST have a justification comment directly above it.
|
|
# - If there is no justification, the CVE is not ignored - add it here only
|
|
# after a human review and a decision to accept the risk.
|
|
# - Review this file on every release; remove entries whose upstream fix has
|
|
# landed.
|
|
#
|
|
# Picked up automatically by aquasecurity/trivy-action from the repo root
|
|
# working directory. Both the pre-push PR scan (.github/workflows/ci.yml) and
|
|
# the release-time re-scan (.github/workflows/docker-publish.yml) honor it.
|
|
#
|
|
# Note: The following CVEs that were previously accepted here have been resolved
|
|
# by building Docker CLI and Compose from source against Go 1.26.2 (PR feat/security-pin-and-rebuild):
|
|
# CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283 (Go stdlib x509/TLS, fixed in Go 1.26.2)
|
|
# CVE-2026-33810 (Go stdlib DNS name constraint bypass, fixed in Go 1.26.2)
|
|
# CVE-2026-33186 (grpc 1.78.0 HTTP/2 server attack, eliminated by source rebuild)
|
|
# CVE-2026-33671 (picomatch ReDoS in npm, eliminated by removing npm from runtime image)
|
|
#
|
|
# The remaining entries below are vendored inside docker/compose v5.1.2 and
|
|
# cannot be patched without a new upstream compose release. They will be
|
|
# migrated to security/vex/sencho.openvex.json (OpenVEX format) in the
|
|
# follow-up PR (feat/security-sbom-vex), after which this file will be deleted.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/docker/cli-plugins/docker-compose (v5.1.2)
|
|
# ---------------------------------------------------------------------------
|
|
# Compose v5.1.2 is the latest upstream release. It statically links older
|
|
# copies of github.com/docker/docker, buildkit, and otel. We cannot bump
|
|
# these transitively without waiting for a new upstream Compose release.
|
|
# Revisit this block on every Compose release; remove entries as upstream
|
|
# rebuilds ship the fixes.
|
|
|
|
# Justification: github.com/docker/docker v28.5.2 statically bundled in
|
|
# compose v5.1.2. Moby authz bypass applies to a Docker daemon, not to the
|
|
# compose CLI plugin; compose never runs as a daemon. Revisit on next
|
|
# Compose upstream release.
|
|
CVE-2026-34040
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. BuildKit arbitrary file write via untrusted frontend is
|
|
# exploited at buildkit build time with attacker-controlled frontends; our
|
|
# compose invocations only call up/down/ps against local user-authored
|
|
# compose files, never as a build frontend. Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33747
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. Same exposure profile as CVE-2026-33747 (Git URL fragment
|
|
# subdir exploitation requires invoking buildkit on untrusted repo URLs,
|
|
# which compose does not do in our flow). Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33748
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. PATH hijacking requires the attacker to control the
|
|
# process PATH before compose starts; our container starts compose from a
|
|
# fixed PATH with only /usr/local/bin and /usr/bin on it, both owned by
|
|
# root. Revisit on next Compose upstream release.
|
|
CVE-2026-24051
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. BSD kenv PATH hijacking only applies on BSD systems; we
|
|
# ship linux/amd64 and linux/arm64. Not applicable in our runtime. Revisit
|
|
# on next Compose upstream release.
|
|
CVE-2026-39883
|