From c2a634c13f020ede5241639e43367835250bfad3 Mon Sep 17 00:00:00 2001 From: Maksim Shulga Date: Mon, 3 Aug 2026 05:16:42 +0000 Subject: [PATCH] Scan the built image for vulnerabilities and fix what's fixable (#29) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Scan the built image for vulnerabilities and fix what's fixable Ran trivy against the built image locally: 67 HIGH/CRITICAL findings, 65 of them in debian:bookworm-slim packages with no upstream fix yet. The remaining 2 were both setuptools 66.1.1 (CVE-2024-6345, CVE-2025-47273) — bundled by ensurepip when the venv is created, not pinned by requirements.txt, so nothing was upgrading it. - Upgrade setuptools to >=78.1.1 in the Dockerfile, which fixes both CVEs. Verified with a local rebuild + rescan: 0 HIGH/CRITICAL fixable findings remain. - Add a Trivy scan step to the CI `test` job, after the smoke test. Uses --ignore-unfixed so the build fails only on findings this repo can act on, not on upstream Debian CVEs with no available patch. - Check off the corresponding P0 item in IMPROVEMENTS.md; note that scheduled (as opposed to PR/push-triggered) scanning is still open. * Fix trivy-action tag (needs v prefix) * Tighten scan-coverage wording per review Copilot review on PR #29 flagged "every pull request and push" as ambiguous: the test job's push trigger is scoped to master and tags, not every branch. Spell that out. --------- Co-authored-by: Maxim Shulga --- .github/workflows/docker-publish.yml | 12 ++++++++++++ Dockerfile | 6 +++++- IMPROVEMENTS.md | 12 ++++++++++-- 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 80737f5..7804326 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -57,6 +57,18 @@ jobs: - name: Container smoke test run: tests/smoke.sh ${{ env.IMAGE }}:ci + # ignore-unfixed: the debian:bookworm-slim base carries CVEs with no + # upstream fix yet; failing on those would block every build on + # findings nothing in this repo can act on. A fixable HIGH/CRITICAL + # finding still fails the build. + - name: Scan image for vulnerabilities + uses: aquasecurity/trivy-action@v0.36.0 + with: + image-ref: ${{ env.IMAGE }}:ci + severity: HIGH,CRITICAL + ignore-unfixed: true + exit-code: '1' + push: needs: [unit-test, test] diff --git a/Dockerfile b/Dockerfile index 5943cb8..df72a15 100644 --- a/Dockerfile +++ b/Dockerfile @@ -52,7 +52,11 @@ RUN python3 -c "import pathlib, site; \ # Install app requirements WORKDIR /dsc COPY requirements.txt ./ -RUN pip install --no-cache-dir -r requirements.txt +# venv creation bootstraps its own setuptools via ensurepip, which +# requirements.txt does not cover. 66.1.1 carries CVE-2024-6345 and +# CVE-2025-47273; 78.1.1 fixes both. +RUN pip install --no-cache-dir --upgrade "setuptools>=78.1.1" && \ + pip install --no-cache-dir -r requirements.txt # Copy app COPY dsc ./dsc/ diff --git a/IMPROVEMENTS.md b/IMPROVEMENTS.md index 6e45f7b..aea6d8b 100644 --- a/IMPROVEMENTS.md +++ b/IMPROVEMENTS.md @@ -22,7 +22,12 @@ exploit scenarios are discussed in public issues. `seaf-cli` has no `--version` flag; use `seaf-cli --help` and assert the expected subcommands, and record the installed version from the package manager instead. -- [ ] Scan the resulting image and review every high or critical finding. +- [x] Scan the resulting image and review every high or critical finding. Of + 67 HIGH/CRITICAL findings (`trivy image`), 65 are in `debian:bookworm-slim` + packages with no upstream fix yet; the CI scan uses `--ignore-unfixed` so it + fails only on findings this repo can act on. The other 2, both `setuptools` + (bundled by `ensurepip` in the venv, not from `requirements.txt`), had + fixes and are resolved: see `Dockerfile`. - [ ] Establish a stronger trust anchor for the AppImage than a self-derived checksum: an upstream digest or signature, or a verified artifact mirrored somewhere we control. @@ -207,7 +212,10 @@ Acceptance criteria: Dependabot configuration covers `requirements.txt`, the Dockerfile base image, and the workflow actions. The Seafile AppImage is fetched by URL and checksum, so it still has to be bumped by hand. -- [ ] Run dependency and image scans on pull requests and on a schedule. +- [ ] Run dependency and image scans on pull requests and on a schedule. The + `test` job now runs the Trivy image scan on every pull request and on every + push to `master` or a tag (see P0), which covers new code; a scheduled run + to catch newly disclosed CVEs against unchanged code is still missing. Acceptance criteria: