---
id: USER-WP-0038
type: workplan
title: "Runtime image OS-package hardening for RISK-F-0016"
domain: communication
repo: user-engine
status: ready
owner: codex
topic_slug: communication
created: "2026-10-14"
updated: "2026-10-14"
related:
  - RISK-F-0016
  - RAPP-USER-ENGINE-WP-0004
  - USER-WP-ADHOC-2026-10-11
state_hub_workstream_id: "5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0"
---

# Runtime image OS-package hardening

Durable owner record for the permanent fix of RiskNexus finding RISK-F-0016
(`~/risk-nexus/findings/RISK-F-0016-user-engine-os-runtime-findings.md`).
RAPP-USER-ENGINE-WP-0004 tracked the runtime-package rollout only and is
closing; image content is user-engine source work and is owned here.

Baseline: live image
`forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b`
on Python 3.12 slim-trixie base `a6e34c59`
(`docs/evidence/2026-10-11-runtime-base-refresh.md`). Fresh scan 2026-10-14
(rapp-user-engine 7567e7e, `docs/evidence/2026-10-14-risk-review/`): 0 CRITICAL,
44 HIGH across 8 CVEs, none with a fixed version.

## Remove or replace unfixed-HIGH OS packages in the runtime image

```task
id: USER-WP-0038-T01
status: todo
priority: high
state_hub_task_id: "59584b44-a7b7-5637-98fb-a746b5bc6c00"
```

Target the 2026-10-14 HIGH set: util-linux family (bsdutils, mount, libblkid,
libmount, libuuid, related) CVE-2026-76642/78408/78409/78410 (36 occurrences);
ncurses CVE-2025-69720 (4); libsystemd0 CVE-2026-16742 (2); libacl1
CVE-2026-54369; perl-base CVE-2026-9538 (fix_deferred). Either prune packages
the runtime does not need from the final stage, or move to a supported smaller
Python 3.12 base (distroless/chainguard-style), preserving exact application
bytes and resolved dependency versions. No scanner suppression, ignore-unfixed
or allowlist may be used to reach acceptance.

Acceptance: clean owner CI publication of a new digest from a committed source
revision with provenance; unsuppressed fresh scan shows zero CRITICAL and every
remaining HIGH either resolved or individually dispositioned with reason; full
source and image test suites pass. Live rollout is out of scope: hand the digest
to rapp-user-engine as a separate, scoped approval. Then update RISK-F-0016
fix_tracking to this task.