coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: raise musl and zlib floors so the release scan can pass

Browse source 
The pinned Alpine 3.24.1 image carries musl 1.2.6-r2 and zlib 1.3.2-r0.
Both have HIGH fixes. The scan gate blocks the push until those floors
are installed.

Assistant: grok
Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595
This commit is contained in:
tegwick 2026-11-07 14:12:22 +01:00
parent 4aa0b75449
commit 2745cd7fdd
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Containerfile
View file

@ -36,11 +36,16 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
PYTHONUNBUFFERED=1 \
PATH=/opt/venv/bin:$PATH
# libuuid is patched explicitly rather than left to the base's pinned version:
# the pinned Alpine 3.24.1 ships 2.42.1-r0, which carries every remaining HIGH
# finding, all fixed in 2.42.3. The floor is a minimum version, not a floating
# upgrade, so the build stays reproducible while refusing a vulnerable libuuid.
RUN apk add --no-cache 'libuuid>=2.42.3-r1' \
# Packages are patched explicitly rather than left to the base's pinned
# versions. The pinned Alpine 3.24.1 ships libuuid 2.42.1-r0 (fixed in
# 2.42.3), musl 1.2.6-r2 (CVE-2026-107891, fixed in 1.2.6-r3) and zlib
# 1.3.2-r0 (CVE-2026-85091, fixed in 1.3.2-r1). Each floor is a minimum
# version, not a floating upgrade.
RUN apk add --no-cache \
'libuuid>=2.42.3-r1' \
'musl>=1.2.6-r3' \
'musl-utils>=1.2.6-r3' \
'zlib>=1.3.2-r1' \
&& addgroup -S -g 10001 approval \
&& adduser -S -u 10001 -G approval -H approval \
&& rm -rf /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \