tegwick
1bb7cacc98
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
31 lines
1.9 KiB
Markdown
31 lines
1.9 KiB
Markdown
# Runtime base refresh — 2026-10-11
|
|
|
|
The exact source-bound application readback candidate failed its independent
|
|
scan with 88 HIGH and three CRITICAL OS findings. Preserve that scan and OCI
|
|
index bea54ccf in the managed runtime release record. This remediation changes
|
|
only the Containerfile's immutable official Python base index from d764629c
|
|
to a6e34c59. It preserves Python 3.12, updates patch 3.12.13 to 3.12.15, and
|
|
uses current Docker Official Image source commit
|
|
2a3b794c223ab067d122719541cdd54a068732a5 (3.12/slim-trixie). The native new
|
|
base contains perl-base 5.40.1-6+deb13u1, libc6 deb13u4 and OpenSSL 3.5.7.
|
|
|
|
Detailed registry/source, exact context, installed file hashes, dependency
|
|
snapshot and unfiltered scan are in
|
|
`rapp-user-engine/docs/evidence/2026-10-11-readback-base-refresh/`. All 47
|
|
copied application inputs and all 45 installed package files match the prior
|
|
source. Resolved Python package versions are unchanged. All 20 image readback
|
|
tests pass; all 323 source tests pass with 8 optional skips and accepted-v0.8
|
|
layer conformance passes. Native consumer acceptance remains USER-WP-0026-T03.
|
|
|
|
The refreshed scan has zero CRITICAL and 44 HIGH findings across 8 distinct
|
|
CVEs, all without a published fixed version in the fresh recorded database.
|
|
These findings remain visible; no severity reduction, ignore-unfixed option
|
|
or suppression was applied. This does not claim a vulnerability-free or
|
|
approved release. Clean accepted source commit, publication and independent
|
|
release review remain required, alongside exact scoped live rollout permission.
|
|
|
|
CI source preparation also replaces short-revision archive lookup with the
|
|
validated full 40-hex GITHUB_SHA and labels the built image with that exact
|
|
revision. Both workflow shell blocks pass bash syntax checks. This workflow
|
|
change is outside the local image runtime context and was not published or
|
|
executed; owner CI must produce a new publication receipt from a clean commit.
|