tegwick
71feaf391b
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
---
|
|
id: USER-WP-0038
|
|
type: workplan
|
|
title: "Runtime image OS-package hardening for RISK-F-0016"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: ready
|
|
owner: codex
|
|
topic_slug: communication
|
|
created: "2026-10-14"
|
|
updated: "2026-10-14"
|
|
related:
|
|
- RISK-F-0016
|
|
- RAPP-USER-ENGINE-WP-0004
|
|
- USER-WP-ADHOC-2026-10-11
|
|
state_hub_workstream_id: "5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0"
|
|
---
|
|
|
|
# Runtime image OS-package hardening
|
|
|
|
Durable owner record for the permanent fix of RiskNexus finding RISK-F-0016
|
|
(`~/risk-nexus/findings/RISK-F-0016-user-engine-os-runtime-findings.md`).
|
|
RAPP-USER-ENGINE-WP-0004 tracked the runtime-package rollout only and is
|
|
closing; image content is user-engine source work and is owned here.
|
|
|
|
Baseline: live image
|
|
`forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b`
|
|
on Python 3.12 slim-trixie base `a6e34c59`
|
|
(`docs/evidence/2026-10-11-runtime-base-refresh.md`). Fresh scan 2026-10-14
|
|
(rapp-user-engine 7567e7e, `docs/evidence/2026-10-14-risk-review/`): 0 CRITICAL,
|
|
44 HIGH across 8 CVEs, none with a fixed version.
|
|
|
|
## Remove or replace unfixed-HIGH OS packages in the runtime image
|
|
|
|
```task
|
|
id: USER-WP-0038-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "59584b44-a7b7-5637-98fb-a746b5bc6c00"
|
|
```
|
|
|
|
Target the 2026-10-14 HIGH set: util-linux family (bsdutils, mount, libblkid,
|
|
libmount, libuuid, related) CVE-2026-76642/78408/78409/78410 (36 occurrences);
|
|
ncurses CVE-2025-69720 (4); libsystemd0 CVE-2026-16742 (2); libacl1
|
|
CVE-2026-54369; perl-base CVE-2026-9538 (fix_deferred). Either prune packages
|
|
the runtime does not need from the final stage, or move to a supported smaller
|
|
Python 3.12 base (distroless/chainguard-style), preserving exact application
|
|
bytes and resolved dependency versions. No scanner suppression, ignore-unfixed
|
|
or allowlist may be used to reach acceptance.
|
|
|
|
Acceptance: clean owner CI publication of a new digest from a committed source
|
|
revision with provenance; unsuppressed fresh scan shows zero CRITICAL and every
|
|
remaining HIGH either resolved or individually dispositioned with reason; full
|
|
source and image test suites pass. Live rollout is out of scope: hand the digest
|
|
to rapp-user-engine as a separate, scoped approval. Then update RISK-F-0016
|
|
fix_tracking to this task.
|