coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
user-engine/workplans/USER-WP-0038-runtime-image-os-package-hardening.md
tegwick 71feaf391b USER-WP-0038: record State Hub ids from fix-consistency 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
2026-10-14 09:31:17 +02:00

2.2 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated related state_hub_workstream_id
USER-WP-0038 workplan Runtime image OS-package hardening for RISK-F-0016 communication user-engine ready codex communication 2026-10-14 2026-10-14
RISK-F-0016
RAPP-USER-ENGINE-WP-0004
USER-WP-ADHOC-2026-10-11
5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0

Runtime image OS-package hardening

Durable owner record for the permanent fix of RiskNexus finding RISK-F-0016 (~/risk-nexus/findings/RISK-F-0016-user-engine-os-runtime-findings.md). RAPP-USER-ENGINE-WP-0004 tracked the runtime-package rollout only and is closing; image content is user-engine source work and is owned here.

Baseline: live image forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b on Python 3.12 slim-trixie base a6e34c59 (docs/evidence/2026-10-11-runtime-base-refresh.md). Fresh scan 2026-10-14 (rapp-user-engine 7567e7e, docs/evidence/2026-10-14-risk-review/): 0 CRITICAL, 44 HIGH across 8 CVEs, none with a fixed version.

Remove or replace unfixed-HIGH OS packages in the runtime image

id: USER-WP-0038-T01
status: todo
priority: high
state_hub_task_id: "59584b44-a7b7-5637-98fb-a746b5bc6c00"

Target the 2026-10-14 HIGH set: util-linux family (bsdutils, mount, libblkid, libmount, libuuid, related) CVE-2026-76642/78408/78409/78410 (36 occurrences); ncurses CVE-2025-69720 (4); libsystemd0 CVE-2026-16742 (2); libacl1 CVE-2026-54369; perl-base CVE-2026-9538 (fix_deferred). Either prune packages the runtime does not need from the final stage, or move to a supported smaller Python 3.12 base (distroless/chainguard-style), preserving exact application bytes and resolved dependency versions. No scanner suppression, ignore-unfixed or allowlist may be used to reach acceptance.

Acceptance: clean owner CI publication of a new digest from a committed source revision with provenance; unsuppressed fresh scan shows zero CRITICAL and every remaining HIGH either resolved or individually dispositioned with reason; full source and image test suites pass. Live rollout is out of scope: hand the digest to rapp-user-engine as a separate, scoped approval. Then update RISK-F-0016 fix_tracking to this task.