From 1b174e9cf286b7567fb7df4d70e38310c35204b0 Mon Sep 17 00:00:00 2001 From: Tom Hu Date: Tue, 14 Jul 2026 23:52:16 -0600 Subject: [PATCH 1/3] fix: remediate critical and high CVEs in codecov-slack-app image Rebuild berglas from source on Go 1.26 with patched x/crypto and x/net, upgrade Alpine OS packages, bump Django/urllib3/PyJWT floors, and add CI workflow to build and push PR images to AR for vulnerability verification. Co-authored-by: Cursor --- .github/workflows/ci.yml | 49 +++++++++++++++++++++++++++++++++ Dockerfile | 18 ++++++++---- Dockerfile.requirements | 22 +++++++-------- requirements.in | 7 +++-- requirements.txt | 59 ++++++++++++++++++++-------------------- 5 files changed, 107 insertions(+), 48 deletions(-) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..6429de8 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,49 @@ +name: CI + +on: + pull_request: + workflow_dispatch: + +jobs: + setup-build-publish: + name: Build and Push + runs-on: ubuntu-latest + environment: staging + + permissions: + contents: read + id-token: write + + steps: + - name: Enable experimental docker + run: | + sudo bash -c 'echo "{\"experimental\": true}" > /etc/docker/daemon.json' + sudo systemctl restart docker + + - name: Checkout + uses: actions/checkout@v3 + + - id: auth + name: Authenticate to Google Cloud + uses: google-github-actions/auth@v0.6.0 + with: + token_format: access_token + workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }} + service_account: ${{ secrets.CODECOV_GCP_WIDSA }} + + - name: Docker configuration + run: |- + echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev + + - name: Build + env: + ENV: ci + run: |- + make build-requirements + make build + + - name: Publish + env: + ENV: ci + run: |- + make push diff --git a/Dockerfile b/Dockerfile index d272c47..bf84091 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,13 +1,21 @@ # syntax=docker/dockerfile:1.3 ARG REQUIREMENTS_IMAGE -ARG BERGLAS_VERSION=2.0.8 -FROM us-docker.pkg.dev/berglas/berglas/berglas:$BERGLAS_VERSION as berglas +ARG BERGLAS_VERSION=v2.0.14 +ARG GO_IMAGE=golang:1.26-bookworm + +# Build berglas from source: the prebuilt image lags on Go stdlib and +# golang.org/x/crypto, which carry the critical SSH CVEs in AR scans. +FROM ${GO_IMAGE} as berglas +ARG BERGLAS_VERSION +RUN git clone --depth 1 --branch ${BERGLAS_VERSION} \ + https://github.com/GoogleCloudPlatform/berglas.git /src +WORKDIR /src +RUN go get golang.org/x/crypto@v0.54.0 golang.org/x/net@v0.57.0 && go mod tidy +RUN CGO_ENABLED=0 go build -trimpath -o /bin/berglas . FROM $REQUIREMENTS_IMAGE -# Set working directory WORKDIR /app -COPY --chmod=755 --from=berglas /bin/berglas /usr/local/bin/berglas - +COPY --chmod=755 --from=berglas /bin/berglas /usr/local/bin/berglas COPY . /app/ diff --git a/Dockerfile.requirements b/Dockerfile.requirements index 6529048..b63046d 100644 --- a/Dockerfile.requirements +++ b/Dockerfile.requirements @@ -4,6 +4,7 @@ FROM python:3.12-alpine3.21 as build RUN apk update \ + && apk upgrade --no-cache \ && apk add --update --no-cache \ git \ openssh \ @@ -19,20 +20,20 @@ RUN apk update \ build-base \ cargo \ curl-dev \ - && pip install --upgrade pip + && pip install --upgrade pip setuptools COPY requirements.txt / WORKDIR /pip-packages/ RUN pip wheel -r /requirements.txt -RUN pip install --upgrade setuptools pip --break-system-packages; # RUNTIME STAGE - Copy packages from build stage and install runtime dependencies FROM python:3.12-alpine3.21 -RUN apk -U upgrade binutils busybox expat libretls && \ - apk add --no-cache postgresql-libs && \ - apk add --no-cache --virtual .build-deps gcc \ +RUN apk update && apk upgrade --no-cache \ + && apk add --no-cache postgresql-libs \ + && apk add --no-cache --virtual .build-deps \ + gcc \ musl-dev \ postgresql-dev \ libxslt-dev \ @@ -47,11 +48,10 @@ RUN apk -U upgrade binutils busybox expat libretls && \ WORKDIR /pip-packages/ COPY --from=build /pip-packages/ /pip-packages/ -RUN rm -rf /pip-packages/src -RUN pip install --no-deps --no-index --find-links=/pip-packages/ /pip-packages/* -RUN pip install --upgrade setuptools pip --break-system-packages; +RUN rm -rf /pip-packages/src \ + && pip install --no-deps --no-index --find-links=/pip-packages/ /pip-packages/* \ + && pip install --upgrade 'setuptools>=82' pip --break-system-packages \ + && apk del .build-deps -# Currently expat will not bump to latest if this upgrade is done earlier -# https://unix.stackexchange.com/questions/769209/unable-to-install-or-upgrade-to-specific-version-of-alpine-expat-2-6-0-r0-in-alp +# expat must be upgraded after .build-deps removal; see alpine#15709 RUN apk add --upgrade expat - diff --git a/requirements.in b/requirements.in index bc0a431..e55c496 100644 --- a/requirements.in +++ b/requirements.in @@ -1,14 +1,15 @@ -Django +Django>=5.1,<5.2 asgiref -django-csp +django-csp>=3.8,<4 djangorestframework gunicorn httpx psycopg2-binary -pyjwt +pyjwt>=2.13.0 pytest-django requests sentry-sdk slack-sdk slack_bolt sqlparse +urllib3>=2.7.0 diff --git a/requirements.txt b/requirements.txt index 750b88e..e96722a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,80 +1,81 @@ # -# This file is autogenerated by pip-compile with Python 3.11 +# This file is autogenerated by pip-compile with Python 3.12 # by the following command: # -# pip-compile +# pip-compile --output-file=requirements.txt requirements.in # -anyio==3.7.0 +anyio==4.14.2 # via httpx -asgiref==3.7.2 +asgiref==3.12.1 # via # -r requirements.in # django -certifi==2024.7.4 +certifi==2026.6.17 # via # httpcore # httpx # requests # sentry-sdk -charset-normalizer==3.1.0 +charset-normalizer==3.4.9 # via requests -django==5.0.14 +django==5.1.15 # via # -r requirements.in # django-csp # djangorestframework -django-csp==3.7 +django-csp==3.8 # via -r requirements.in -djangorestframework==3.15.2 +djangorestframework==3.17.1 # via -r requirements.in -gunicorn==23.0.0 +gunicorn==26.0.0 # via -r requirements.in h11==0.16.0 # via httpcore httpcore==1.0.9 # via httpx -httpx==0.25.1 +httpx==0.28.1 # via -r requirements.in -idna==3.7 +idna==3.18 # via # anyio # httpx # requests -iniconfig==2.0.0 +iniconfig==2.3.0 # via pytest -packaging==23.1 +packaging==26.2 # via # gunicorn # pytest -pluggy==1.0.0 +pluggy==1.6.0 # via pytest -psycopg2-binary==2.9.6 +psycopg2-binary==2.9.12 # via -r requirements.in -pyjwt==2.7.0 +pygments==2.20.0 + # via pytest +pyjwt==2.13.0 # via -r requirements.in -pytest==7.3.1 +pytest==9.1.1 # via pytest-django -pytest-django==4.5.2 +pytest-django==4.12.0 # via -r requirements.in -requests==2.32.4 +requests==2.34.2 # via -r requirements.in -sentry-sdk==2.8.0 +sentry-sdk==2.65.0 # via -r requirements.in -slack-bolt==1.18.0 +slack-bolt==1.29.0 # via -r requirements.in -slack-sdk==3.21.3 +slack-sdk==3.43.0 # via # -r requirements.in # slack-bolt -sniffio==1.3.0 - # via - # anyio - # httpx -sqlparse==0.5.0 +sqlparse==0.5.5 # via # -r requirements.in # django -urllib3==1.26.19 +typing-extensions==4.16.0 + # via anyio +urllib3==2.7.0 # via + # -r requirements.in # requests # sentry-sdk From 674cd4674a76d51a5f1ca9079fcdf3cc97e46755 Mon Sep 17 00:00:00 2001 From: Tom Hu Date: Wed, 15 Jul 2026 00:01:14 -0600 Subject: [PATCH 2/3] fix: upgrade pip to 26.1.2 to clear remaining medium and low CVEs All five residual AR findings on the CI image were fixable pip 25.0.1 CVEs; bump pip in both Dockerfile.requirements stages. Co-authored-by: Cursor --- Dockerfile.requirements | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.requirements b/Dockerfile.requirements index b63046d..352cbfe 100644 --- a/Dockerfile.requirements +++ b/Dockerfile.requirements @@ -20,7 +20,7 @@ RUN apk update \ build-base \ cargo \ curl-dev \ - && pip install --upgrade pip setuptools + && pip install --upgrade 'pip>=26.1.2' setuptools COPY requirements.txt / WORKDIR /pip-packages/ @@ -50,7 +50,7 @@ COPY --from=build /pip-packages/ /pip-packages/ RUN rm -rf /pip-packages/src \ && pip install --no-deps --no-index --find-links=/pip-packages/ /pip-packages/* \ - && pip install --upgrade 'setuptools>=82' pip --break-system-packages \ + && pip install --upgrade 'setuptools>=82' 'pip>=26.1.2' --break-system-packages \ && apk del .build-deps # expat must be upgraded after .build-deps removal; see alpine#15709 From 5be7d04866126b7a58d1b8b58dacc70bfc7a4627 Mon Sep 17 00:00:00 2001 From: Tom Hu Date: Wed, 15 Jul 2026 00:18:48 -0600 Subject: [PATCH 3/3] fix: remove bundled ensurepip wheel after pip upgrade AR still flagged pip 25.0.1 from the ensurepip bundled wheel left in the Python base image even after upgrading runtime pip to 26.1.2. Co-authored-by: Cursor --- Dockerfile.requirements | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile.requirements b/Dockerfile.requirements index 352cbfe..ca3ed56 100644 --- a/Dockerfile.requirements +++ b/Dockerfile.requirements @@ -51,6 +51,7 @@ COPY --from=build /pip-packages/ /pip-packages/ RUN rm -rf /pip-packages/src \ && pip install --no-deps --no-index --find-links=/pip-packages/ /pip-packages/* \ && pip install --upgrade 'setuptools>=82' 'pip>=26.1.2' --break-system-packages \ + && rm -rf /usr/local/lib/python3.12/ensurepip/_bundled/pip-*.whl \ && apk del .build-deps # expat must be upgraded after .build-deps removal; see alpine#15709