peter
da554df7c7
The first Trivy scan of the shipped image (0.98.0) found four fixable HIGH advisories. One was pcre2: a Debian fix newer than the base snapshot, now taken by `apt-get upgrade` at build time. The others were urllib3 (bumped in the lock), and msgpack, setuptools and urllib3 vendored inside pip itself. pip is removed once it has installed the lock, since nothing runs it at runtime. A local build of this Dockerfile with --pull scans clean: 0 HIGH/CRITICAL with a fix, no secrets. .trivyignore.yaml is the publish gate's allowlist, empty today. Each entry must carry a statement and an expiry date.
16 lines
808 B
YAML
16 lines
808 B
YAML
# The CVE gate's allowlist (E32). The publish gate scans the built image and the committed tree with
|
|
# Trivy and fails on any HIGH or CRITICAL finding that has a fix available. A finding that cannot be
|
|
# fixed yet is let through ONLY by an entry here, and every entry carries both:
|
|
# statement — why it is acceptable for now (what is exposed, what is not)
|
|
# expired_at — the date it stops being accepted; after it, the gate fails again on its own
|
|
# A contract test (frontend/src/lib/gates.contract.test.ts) refuses an entry without either, and
|
|
# docs/gates.md lists them.
|
|
#
|
|
# Example:
|
|
# vulnerabilities:
|
|
# - id: CVE-2026-00000
|
|
# statement: in libfoo's XML path, which nothing in the image calls; no fixed Debian build yet
|
|
# expired_at: 2026-12-31
|
|
vulnerabilities: []
|
|
secrets: []
|