GovOPlaN/govoplan
2
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

[Security audit] Remediate pinned runtime images and complete deployment scan coverage #52

New Issue
Open
opened 2026-09-08 01:54:35 +02:00 by zemion · 1 comment
zemion commented 2026-09-08 01:54:35 +02:00
Owner
Copy Link
Copy Source

Coordination and current status

Follow-up to release #51. Runtime publication is held independently of the source/package release. The canonical audit record is docs/security/RUNTIME_IMAGE_AUDIT_2026-09-08.md, being included in the release documentation. This issue owns runtime-image remediation and the evidence needed to lift that hold; it does not authorize production deployment.

Completed evidence

Verified official Trivy 0.74.0 archive SHA256 2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a; vulnerability DB schema 2 updated 2026-09-07T19:06:01.154199452Z. Registry-only vulnerability scans of nine exact pinned candidates plus two same-minor successors all succeeded for linux/amd64. No image execution, Docker access, image rebuild, CI input change or runtime publication occurred.

Package-record counts (Critical/High; not confirmed exploitable defects): Python 5/55, PostgreSQL 1/30, Redis 0/0 (OS inventory only), nginx 0/33, HAProxy old 0/2, Caddy 7/75, GreenMail old 0/0, binfmt 0/9. Garage has no detectable package inventory, not a clean result. Every exact digest, all severity counts and scanner/report checksums are in the owning document. Raw JSON/log evidence: /home/zemion/.cache/govoplan-trivy-remote.yKZgjDOg/scan/; local retention is not a permanent artifact-hosting guarantee.

Why a patch-only refresh is insufficient

  • Exhaustive matching publisher tag listings found no newer nginx 1.29 Alpine, Caddy 2.10 Alpine or binfmt qemu10.2 publication. Caddy's own fixes require a maintained minor line through at least 2.11.4, plus re-scanning bundled dependencies; no unscanned tag is claimed clean.
  • HAProxy 3.2.23-alpine@sha256:6343ce34a132a5dceaa24767d739df2bd519f8f7c1079ae39e4821334e8eb42e keeps Alpine 3.24.1 and removes findings from the 24 detected OS packages. Both architecture manifests exist; runtime behavior and source-built HAProxy coverage still need checking.
  • GreenMail 2.1.13 changes upstream Ubuntu22.04 to Debian13.6 and reports 3C/80H. It was not selected as a no-base-change replacement.
  • Python's 60 C/H records are 21 Debian CVEs, not CPython findings: 50 affected, 9 deferred, 1 will_not_fix, without fixed Bookworm versions. Vendor-supported narrow triage includes unbuilt Bookworm minizip code and a 32-bit-only Perl advisory. Do not blanket-dismiss installed OS libraries as build-only or accept all vendor-deferred findings.
  • PostgreSQL's critical Go finding and 21 high Go records concern the gosu helper, not the PostgreSQL server. binfmt findings concern its Go helper; QEMU static binaries remain uninventoried. Reachability must be assessed before calling these remotely exploitable server issues.

Remaining work / acceptance criteria

  • Choose and approve a maintained, digest-pinned image set; document any minor-line/base-OS changes and compatibility implications. Do not silently use latest, custom-rebuild third-party images or alter infrastructure families.
  • Re-scan chosen candidates and fix actionable findings; record narrow exact-package/CVE non-applicability or accepted-risk decisions with vendor evidence and review ownership, without severity-wide ignores.
  • Close source-built/static inventory gaps using trustworthy SBOM/source dependency evidence, especially Garage, CPython, PostgreSQL, Redis, HAProxy and QEMU.
  • Scan linux/amd64 and linux/arm64 final GovOPlaN API/Web images and selected managed dependencies; keep vulnerability coverage distinct from secrets/misconfiguration/signature checks. Record DB date, immutable image/report digests, findings and scan failures.
  • Run supported-runtime migration/readiness/worker and managed-ingress compatibility smoke checks for the selected composition, with no real campaign sends or production changes.
  • Lift the runtime hold only after these gates or explicit narrow risk dispositions are recorded; publish immutable signed runtime artifacts and link their exact successful workflow/evidence back to #51. Source/package/catalog publication status remains independently recorded.

Scope limits: this initial pass is not a penetration test, exploitability guarantee, complete toolbox scan, arm64 scan or final-runtime audit. Alpine3.24 EOL metadata and one nginx CVE detail were missing; unknowns remain visible.

## Coordination and current status Follow-up to [release #51](https://git.add-ideas.de/GovOPlaN/govoplan/issues/51). **Runtime publication is held independently of the source/package release.** The canonical audit record is [docs/security/RUNTIME_IMAGE_AUDIT_2026-09-08.md](https://git.add-ideas.de/GovOPlaN/govoplan/src/branch/main/docs/security/RUNTIME_IMAGE_AUDIT_2026-09-08.md), being included in the release documentation. This issue owns runtime-image remediation and the evidence needed to lift that hold; it does not authorize production deployment. ## Completed evidence Verified official Trivy 0.74.0 archive SHA256 `2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a`; vulnerability DB schema 2 updated 2026-09-07T19:06:01.154199452Z. Registry-only vulnerability scans of nine exact pinned candidates plus two same-minor successors all succeeded for linux/amd64. No image execution, Docker access, image rebuild, CI input change or runtime publication occurred. Package-record counts (Critical/High; not confirmed exploitable defects): Python 5/55, PostgreSQL 1/30, Redis 0/0 (OS inventory only), nginx 0/33, HAProxy old 0/2, Caddy 7/75, GreenMail old 0/0, binfmt 0/9. Garage has **no detectable package inventory**, not a clean result. Every exact digest, all severity counts and scanner/report checksums are in the owning document. Raw JSON/log evidence: `/home/zemion/.cache/govoplan-trivy-remote.yKZgjDOg/scan/`; local retention is not a permanent artifact-hosting guarantee. ## Why a patch-only refresh is insufficient - Exhaustive matching publisher tag listings found no newer nginx 1.29 Alpine, Caddy 2.10 Alpine or binfmt qemu10.2 publication. Caddy's own fixes require a maintained minor line through at least 2.11.4, plus re-scanning bundled dependencies; no unscanned tag is claimed clean. - HAProxy `3.2.23-alpine@sha256:6343ce34a132a5dceaa24767d739df2bd519f8f7c1079ae39e4821334e8eb42e` keeps Alpine 3.24.1 and removes findings from the 24 detected OS packages. Both architecture manifests exist; runtime behavior and source-built HAProxy coverage still need checking. - GreenMail 2.1.13 changes upstream Ubuntu22.04 to Debian13.6 and reports 3C/80H. It was not selected as a no-base-change replacement. - Python's 60 C/H records are 21 Debian CVEs, not CPython findings: 50 affected, 9 deferred, 1 will_not_fix, without fixed Bookworm versions. Vendor-supported narrow triage includes unbuilt Bookworm minizip code and a 32-bit-only Perl advisory. Do not blanket-dismiss installed OS libraries as build-only or accept all vendor-deferred findings. - PostgreSQL's critical Go finding and 21 high Go records concern the gosu helper, not the PostgreSQL server. binfmt findings concern its Go helper; QEMU static binaries remain uninventoried. Reachability must be assessed before calling these remotely exploitable server issues. ## Remaining work / acceptance criteria - [ ] Choose and approve a maintained, digest-pinned image set; document any minor-line/base-OS changes and compatibility implications. Do not silently use latest, custom-rebuild third-party images or alter infrastructure families. - [ ] Re-scan chosen candidates and fix actionable findings; record narrow exact-package/CVE non-applicability or accepted-risk decisions with vendor evidence and review ownership, without severity-wide ignores. - [ ] Close source-built/static inventory gaps using trustworthy SBOM/source dependency evidence, especially Garage, CPython, PostgreSQL, Redis, HAProxy and QEMU. - [ ] Scan linux/amd64 **and** linux/arm64 final GovOPlaN API/Web images and selected managed dependencies; keep vulnerability coverage distinct from secrets/misconfiguration/signature checks. Record DB date, immutable image/report digests, findings and scan failures. - [ ] Run supported-runtime migration/readiness/worker and managed-ingress compatibility smoke checks for the selected composition, with no real campaign sends or production changes. - [ ] Lift the runtime hold only after these gates or explicit narrow risk dispositions are recorded; publish immutable signed runtime artifacts and link their exact successful workflow/evidence back to #51. Source/package/catalog publication status remains independently recorded. Scope limits: this initial pass is not a penetration test, exploitability guarantee, complete toolbox scan, arm64 scan or final-runtime audit. Alpine3.24 EOL metadata and one nginx CVE detail were missing; unknowns remain visible.
zemion added the source/security-auditarea/releaseaudit/needs-designarea/security labels 2026-09-08 01:54:35 +02:00
zemion commented 2026-09-08 08:09:36 +02:00
Author
Owner
Copy Link
Copy Source

Additional source remediation and evidence are published in govoplan 58d320d9b34a.

Eight registry-only scans cover four exact successor candidates on amd64 and arm64, with image/report digests and unknown inventory areas retained. New installer specifications select the same-line patched HAProxy 3.2.23 pin; existing explicit image specifications remain unchanged. The nginx successor remains a compatibility/OS-review candidate. Caddy and Node successors retain findings and were not selected. All 45 installer configuration tests passed with Core available.

Exact candidate evidence, inventory limitations and runtime gates. No images were built, executed, published or deployed; no container daemon was installed.

Keeping this open. Source-built/static inventories, final built API/Web/dependency images on both architectures, narrow finding dispositions, exact-image ingress/migration/readiness/worker checks and immutable signed runtime publication remain outstanding. Zero findings in detected package subsets and successful source publication do not lift this hold.

Full implementation, verification and remaining adoption gates. Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

Additional source remediation and evidence are published in [govoplan 58d320d9b34a](https://git.add-ideas.de/GovOPlaN/govoplan/commit/58d320d9b34a618aab6ce0b9e48daf943961af66). Eight registry-only scans cover four exact successor candidates on amd64 and arm64, with image/report digests and unknown inventory areas retained. New installer specifications select the same-line patched HAProxy 3.2.23 pin; existing explicit image specifications remain unchanged. The nginx successor remains a compatibility/OS-review candidate. Caddy and Node successors retain findings and were not selected. All 45 installer configuration tests passed with Core available. [Exact candidate evidence, inventory limitations and runtime gates](https://git.add-ideas.de/GovOPlaN/govoplan/src/commit/58d320d9b34a618aab6ce0b9e48daf943961af66/docs/security/RUNTIME_IMAGE_REMEDIATION_2026-09-08.md). No images were built, executed, published or deployed; no container daemon was installed. Keeping this open. Source-built/static inventories, final built API/Web/dependency images on both architectures, narrow finding dispositions, exact-image ingress/migration/readiness/worker checks and immutable signed runtime publication remain outstanding. Zero findings in detected package subsets and successful source publication do not lift this hold. [Full implementation, verification and remaining adoption gates](https://git.add-ideas.de/GovOPlaN/govoplan/src/commit/58d320d9b34a618aab6ce0b9e48daf943961af66/docs/security/SECURITY_FOLLOWUP_2026-09-08.md). Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment. <!-- govoplan-security-followup-20260908-source58d320d -->
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
HTTP API contracts, routers, schemas, or API smoke behavior.
 area/auth
Authentication, sessions, access bootstrap, or login behavior.
 area/db
Database sessions, models, transactions, or persistence primitives.
 area/devex
Local developer workflow, scripts, tests, tooling, or release helpers.
 area/docs
Durable documentation and project guidance.
 area/governance
Governance policy, audit, privacy, retention, or compliance behavior.
 area/marketing
Public website, product messaging, publication copy, or legal page content.
 area/migrations
Alembic migrations, schema bootstrap, or persistence evolution.
 area/module-system
Module discovery, manifests, capabilities, routing, or optional integrations.
 area/rbac
Permissions, roles, delegation, or authorization policy.
 area/release
Versioning, release locks, tags, packaging, or dependency pins.
 area/security
Security posture, static analysis, supply-chain hardening, or vulnerability remediation.
 area/tenancy
Tenant boundaries, provisioning, or tenant-scoped data behavior.
 area/webui
Shared WebUI shell, frontend components, routing, or frontend tests.
 audit/complexity
Complexity finding from Radon, Xenon, or equivalent maintainability scans.
 audit/duplication
Duplicated-code finding from jscpd or equivalent similarity scans.
 audit/false-positive
Audit finding reviewed as a narrow false positive or acceptable risk.
 audit/needs-design
Audit finding that needs an architectural or product decision before implementation.
 audit/quick-fix
Audit finding that appears narrow and directly fixable.
 audit/structural
Audit finding that needs design, refactoring, or behavior review.
 codex/needs-human
Needs an explicit human decision before Codex should implement.
 codex/ready
Suitable for Codex to pick up with the existing issue context.
 module/access
GovOPlaN access, identity, authentication, RBAC, and administration behavior.
 module/addresses
GovOPlaN Addresses module behavior or integration.
 module/admin
GovOPlaN Admin module behavior or integration.
 module/appointments
GovOPlaN Appointments module behavior or integration.
 module/approvals
GovOPlaN Approvals module behavior or integration.
 module/audit
GovOPlaN Audit module behavior or integration.
 module/calendar
GovOPlaN Calendar module behavior or integration.
 module/campaign
GovOPlaN campaign module behavior or integration.
 module/cases
GovOPlaN Cases module behavior or integration.
 module/committee
GovOPlaN Committee module behavior or integration.
 module/connectors
GovOPlaN Connectors module behavior or integration.
 module/core
GovOPlaN core runner, shared primitives, shell, or extension points.
 module/dashboard
GovOPlaN Dashboard module behavior or integration.
 module/dataflow
GovOPlaN Dataflow module behavior or integration.
 module/datasources
GovOPlaN governed datasource contracts, catalogs, and integrations.
 module/decisions
GovOPlaN formal Decisions module behavior or integration.
 module/dist-lists
GovOPlaN Distribution Lists module behavior or integration.
 module/dms
GovOPlaN Dms module behavior or integration.
 module/docs
GovOPlaN Docs module behavior or integration.
 module/encryption
GovOPlaN Encryption key custody, cryptographic policy, and E2EE integration.
 module/erp
GovOPlaN Erp module behavior or integration.
 module/evaluation
GovOPlaN Evaluation module behavior or integration.
 module/files
GovOPlaN files module behavior or integration.
 module/fit-connect
GovOPlaN Fit Connect module behavior or integration.
 module/forms
GovOPlaN Forms module behavior or integration.
 module/forms-runtime
GovOPlaN Forms Runtime module behavior or integration.
 module/helpdesk
GovOPlaN Helpdesk module behavior or integration.
 module/identity
GovOPlaN Identity module behavior or integration.
 module/identity-trust
GovOPlaN Identity Trust module behavior or integration.
 module/idm
GovOPlaN Idm module behavior or integration.
 module/ledger
GovOPlaN Ledger module behavior or integration.
 module/mail
GovOPlaN mail module behavior or integration.
 module/mandates
GovOPlaN Mandates, jurisdiction, responsibility, and authority behavior or integration.
 module/notifications
GovOPlaN Notifications module behavior or integration.
 module/ops
GovOPlaN Ops module behavior or integration.
 module/organizations
GovOPlaN Organizations module behavior or integration.
 module/parties
GovOPlaN procedure Parties, representation, and delivery-authority behavior or integration.
 module/payments
GovOPlaN Payments module behavior or integration.
 module/permits
GovOPlaN Permits module behavior or integration.
 module/policy
GovOPlaN Policy module behavior or integration.
 module/poll
GovOPlaN Poll module behavior or integration.
 module/portal
GovOPlaN Portal module behavior or integration.
 module/postbox
GovOPlaN Postbox module behavior or integration.
 module/projects
GovOPlaN Projects module behavior or integration.
 module/quick-access
GovOPlaN configurable task-local Quick Access behavior and integrations.
 module/records
GovOPlaN Records and eAkte lifecycle behavior or integration.
 module/reporting
GovOPlaN Reporting module behavior or integration.
 module/risk-compliance
GovOPlaN Risk Compliance module behavior or integration.
 module/scheduling
GovOPlaN Scheduling module behavior or integration.
 module/search
GovOPlaN Search module behavior or integration.
 module/services
GovOPlaN versioned institutional Services behavior or integration.
 module/tasks
GovOPlaN Tasks module behavior or integration.
 module/templates
GovOPlaN Templates module behavior or integration.
 module/tenancy
GovOPlaN Tenancy module behavior or integration.
 module/tickets
GovOPlaN Tickets module behavior or integration.
 module/views
GovOPlaN governed task views, interface projections, and workflow view integration.
 module/voting
GovOPlaN Voting module behavior or integration.
 module/wiki
GovOPlaN Wiki module behavior or integration.
 module/workflow
GovOPlaN Workflow module behavior or integration.
 module/workflow-engine
GovOPlaN Workflow Engine runtime, persistence, or integration.
 module/xoev
GovOPlaN Xoev module behavior or integration.
 module/xrechnung
GovOPlaN Xrechnung module behavior or integration.
 module/xta-osci
GovOPlaN Xta Osci module behavior or integration.
priority
p0
Immediate stop-the-line priority.
priority
p1
High priority for the next focused work window.
priority
p2
Normal planned priority.
priority
p3
Low priority or opportunistic cleanup.
source/backlog-import
Imported from markdown backlog, roadmap, plan, or TODO files.
 source/security-audit
Created from a structured security or code-quality audit report.
 source/todo-scan
Imported from inline TODO/FIXME/HACK markers by the Gitea TODO importer.
status
blocked
Cannot progress without a decision, dependency, credential, or external change.
status
in-progress
Currently being worked.
status
needs-info
Needs clarifying input before implementation can proceed safely.
status
ready
Ready for implementation.
status
triage
Needs review, ownership, priority, or acceptance criteria.
type
bug
A reproducible defect, regression, or incorrect behavior.
type
debt
Cleanup, refactoring, risk reduction, or deferred engineering work.
type
docs
Documentation, process, or developer workflow work.
type
feature
New user-visible behavior or platform capability.
type
task
Implementation, maintenance, migration, or operational work.
type
user-story
End-to-end user journey or real-world process story used to steer product slices.
No labels area/release area/security audit/needs-design source/security-audit
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
govoplan-package-publisher zemion (Albrecht Degering)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#52