From 4a5b10bc744a5b0a244329a2e542d7200d74c3ea Mon Sep 17 00:00:00 2001 From: Phil Ruff Date: Fri, 21 Aug 2026 09:25:23 +0100 Subject: [PATCH] fix(ci): resolve Trivy HIGH CVEs blocking Tier 2 Governance on main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Tier 2 Governance's Trivy scan has been failing on every main push (predates #376) on two HIGH CVEs neither traceable to app code: - msgpack 1.1.2 (GHSA-6v7p-g79w-8964): not our dependency — it's pip's own vendored copy at pip/_vendor/msgpack. - setuptools 70.3.0 (CVE-2025-47273): not installed anywhere — it's a version string in pip's _vendor/vendor.txt that Trivy's scanner parses as an installed package. pip is never invoked at runtime (entrypoint.sh only runs manage.py/ gunicorn), so strip it from the final image after the existing setuptools/wheel patch step. Also drop the now-pointless ensurepip bundled wheel, and pin msgpack==1.2.1 directly (transitive via pytest-bdd->gherkin-official, flagged separately). Verified locally: rebuilt image, Trivy --severity HIGH,CRITICAL --ignore-unfixed exits 0, and Django still boots with pip removed. Co-Authored-By: Claude Sonnet 5 --- Dockerfile | 12 ++++++++++++ requirements.txt | 1 + 2 files changed, 13 insertions(+) diff --git a/Dockerfile b/Dockerfile index 772ba5c..0b1661e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -30,6 +30,11 @@ RUN apt-get update && \ apt-get remove --purge -y --auto-remove perl libperl* && \ rm -rf /var/lib/apt/lists/* +# Drop ensurepip's bundled setuptools/pip wheels — unused at runtime (nothing +# in this image creates a venv) but their frozen versions still trip Trivy +# (e.g. CVE-2025-47273) even after the site-packages copy is patched below. +RUN rm -f /usr/local/lib/python3.*/ensurepip/_bundled/*.whl + WORKDIR /app # ── deps layer (cached unless requirements.txt changes) ─────────────────── @@ -59,6 +64,13 @@ COPY --from=deps /usr/local/bin /usr/local/bin # jaraco.context 5.3.0 for CVE-2026-23949; wheel 0.46.2+ for CVE-2026-24049). # Don't pin pip — the base image ships 26.2.1+ and downgrading breaks imports. RUN pip install --upgrade setuptools==83.0.0 wheel==0.46.2 +# Remove pip itself — unused at runtime (entrypoint.sh only calls manage.py/ +# gunicorn) and its pip/_vendor bundle carries its own frozen msgpack/setuptools +# copies that Trivy flags (GHSA-6v7p-g79w-8964, CVE-2025-47273) independent of +# the real site-packages copies patched above. +RUN rm -rf /usr/local/lib/python3.*/site-packages/pip \ + /usr/local/lib/python3.*/site-packages/pip-*.dist-info \ + /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.* COPY . . # Bake version into files so the runtime can read them without a .git dir diff --git a/requirements.txt b/requirements.txt index f7ae10c..0af0802 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12,6 +12,7 @@ gunicorn==26.0.0 pytest==9.1.1 pytest-django==4.12.0 pytest-bdd==8.1.0 +msgpack==1.2.1 # transitive via pytest-bdd→gherkin-official; pin for GHSA-6v7p-g79w-8964 coverage==7.15.4 pytest-asyncio==1.4.0 pytest-rerunfailures==16.5 # flaky test retry (Phase C)