govoplan/docs/security/RUNTIME_IMAGE_AUDIT_2026-09-08.md

Runtime image candidate audit — 8 September 2026

Release coordination: GovOPlaN #51. Canonical remediation: GovOPlaN #52. This follow-up to the source security/performance review records registry-only scans of nine proposed runtime dependencies and two same-minor patch candidates. Runtime publication is held: patch-only updates do not resolve the baseline. Source/package publication is a separate outcome. No images were executed, rebuilt, selected for CI, or published by this audit.

Method and reproducible evidence

Official Trivy 0.74.0 was installed only in a private local task directory, without sudo or Docker access. Its Linux-64bit release archive matched both the official checksums file and GitHub release asset metadata:

• Archive SHA256: 2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a.
• Checksums-file SHA256: bc701c3c3ee8b9acbea2c23257e41381e3854888f51281616a6ba5dc96963821.
• Vulnerability database schema 2, updated 2026-09-07T19:06:01.154199452Z, downloaded from mirror.gcr.io/aquasec/trivy-db:2.
• Scan flags: --image-src remote --platform linux/amd64 --scanners vuln --format json --no-progress --timeout 8m --max-image-size 2GB --exit-code 0. Findings were counted from validated JSON; exit zero did not mean clean.
• Existing Docker credentials were not read; no private keys or secrets were used. Checksums over official HTTPS metadata were verified, not independent Sigstore signatures. See the official release and registry-only scan documentation.

Raw evidence is retained locally, not committed: /home/zemion/.cache/govoplan-trivy-remote.yKZgjDOg/scan/. It contains eleven reports/*-amd64.json reports/logs, scanner scripts, patch-candidate-inspection.json, exact successor registry indices, and evidence-checksums.json. Summary SHA256 values:

• summary.json: f2785a731d637452ab9c0b1f5399772c0f8828a63ca83d5fa7496abdad1c757a.
• patch-summary.json: b3fc6273fcdad98864040ccdf3477ecf379afd46e9f94444b1f2910f48c1d85b.

All eleven executions succeeded without timeout/rate-limit failure. Initial summary fields distinguish scan_execution_complete: true from coverage_complete: false: Garage has no detectable package inventory. Checksums preserve evidence identity, not indefinite storage availability.

Exact requested pins and results

All references below use docker.io/. Counts are package-vulnerability records, not distinct CVEs or confirmed exploitable application defects. A vulnerability can appear against several installed packages. Unfixed/unknown records remain.

Image tag	Exact index SHA256	Critical / High / Medium / Low / Unknown	Fixable C/H
library/python:3.12-slim-bookworm	782412e85d0f0984994c290652577d4018aff08145c85b262bb63dc0c7522254	5 / 55 / 102 / 103 / 5	0
library/postgres:16-alpine	cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685	1 / 30 / 28 / 14 / 1	31
library/redis:7-alpine	ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf	0 / 0 / 0 / 0 / 0	0
nginxinc/nginx-unprivileged:1.29-alpine	0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6	0 / 33 / 74 / 37 / 20	33
library/haproxy:3.2.21-alpine	66e25cc9a8332635f4e897f7f4b1e5622c25f09f0ee23cddc6ce9bdb3a24772a	0 / 2 / 6 / 12 / 0	2
library/caddy:2.10.2-alpine	4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d	7 / 75 / 67 / 37 / 4	82
dxflrs/garage:v2.3.0	866bd13ed2038ba7e7190e840482bc27234c4afaf77be8cfa439ae088c1e4690	Unknown: no inventory	—
greenmail/standalone:2.1.9	3ac5a83dd6727cf95e4d50e18907fb8ee7bbf5f67e8534714dee2fb1b5b2e1d4	0 / 0 / 116 / 35 / 0	0
tonistiigi/binfmt:qemu-v10.2.3-68	400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0	0 / 9 / 2 / 1 / 1	9

Patch-only options and limits

Complete publisher tag listings were inspected for nginx 1.29, Caddy 2.10, HAProxy 3.2, GreenMail 2.1 and binfmt qemu10.2. Two newer candidates were scanned; their registry index bytes matched both registry and publisher digests, and contained amd64 and arm64 manifests:

• library/haproxy:3.2.23-alpine@sha256:6343ce34a132a5dceaa24767d739df2bd519f8f7c1079ae39e4821334e8eb42e: same Alpine 3.24.1, 24 detected OS packages, zero reported findings. This is a useful candidate, not a completed compatibility test or application audit.
• greenmail/standalone:2.1.13@sha256:3df66b7edd01c8a301343ca5e3601d8674760d4708655573560c24745e624fb2: upstream changes Ubuntu 22.04 to Debian 13.6; 3 C / 80 H / 98 M / 85 L / 5 unknown, 30 fixable C/H records. Not selected as a no-base-change update.
• nginx's newest matching Alpine patch is already 1.29.8 at the scanned pin; Caddy 2.10 remains 2.10.2; binfmt qemu10.2 remains 10.2.3-68. No newer matching publisher images were found. The current official Caddy image catalogue uses 2.11.4; switching minor lines requires new scans and compatibility checks.

Priority remediation: Caddy's own seven HIGH records require fixes through 2.11.4, with additional bundled Go/library fixes that must be re-scanned; nginx's packages include curl/libcurl fixes through 8.22.0-r0, OpenSSL 3.5.8-r0, c-ares 1.34.8-r0, expat 2.8.1-r0 and libuuid 2.41.6-r1. PostgreSQL's OS records require OpenSSL 3.5.8-r0 and libuuid 2.42.3-r1; its CRITICAL plus 21 HIGH Go records concern the gosu helper, not PostgreSQL server code. binfmt's nine HIGH records concern its Go 1.26.4 build, with fixes through 1.26.6. Package presence does not establish vulnerable-symbol reachability. No unscanned tag is claimed to meet every fix requirement.

Python triage and coverage caveats

Python image metadata identifies CPython 3.12.14, but Trivy inventories only Debian packages and pip, not CPython/stdlib. All 60 C/H records concern Debian packages: 21 CVEs, 50 affected records, 9 fix_deferred, 1 will_not_fix, without a recorded fixed Bookworm version. Five util-linux CVEs repeat across eight binary packages. These remain installed; they are not all removed build dependencies. Pip 25.0.1 separately has five MEDIUM/one LOW records, with fixes through 26.2.0; it is install tooling, and the API image uses an offline --no-index wheelhouse rather than an arbitrary package index.

Narrow triage examples, not blanket exemptions:

• Debian states CVE-2023-45853 does not affect the built Bookworm zlib binaries because vulnerable minizip code is not included. Other bundled minizip implementations are separate.
• CVE-2026-8376 explicitly requires 32-bit Perl; this scan targets amd64.
• CVE-2025-7458 requires crafted arbitrary SQLite SQL; the managed runtime uses PostgreSQL, but alternate SQLite use must be reviewed.
• Perl's regex and Archive::Tar records need exact binary/module applicability checks; vendor-deferred status alone is not a finding dismissal.

Only amd64 was scanned. arm64, newly built GovOPlaN API/Web layers and optional dependency combinations remain unverified. Garage has no inventory; Redis, HAProxy and PostgreSQL source-built executables, CPython and QEMU static binaries need supplemental SBOM/source coverage. Zero detected OS findings is not zero application vulnerabilities. Trivy also lacks Alpine 3.24 EOL metadata and nginx CVE-2026-80256 detail; unknowns are retained. There were no runtime, exploitability, secret, misconfiguration, malware or signature-policy checks.

Before lifting the runtime hold: approve and test maintained image-line changes where necessary, fix or narrowly disposition findings with evidence, close inventory gaps, scan both architectures and final runtime layers, then run deployment/ingress smoke checks. Do not silently change base OS, use unpinned latest, rebuild third-party images, or accept all HIGH/CRITICAL findings.