Conversation
Drop the runtime stage's first apt-get block: g++ pulled 43 transitive packages including linux-libc-dev, and the WeasyPrint system stack backed an app the embedded profile does not activate. Raise the base pin to python:3.11.16-slim (Debian 13.6) and pair it with apt-get upgrade, since the tag still ships util-linux 2.41-5. Drop the no-op pip install wheel — the bumped base already supplies wheel 0.46.3. Together these clear 84 of the 101 HIGH/CRITICAL findings. The remaining 17 ship as purl-scoped exceptions in .trivyignore.yaml, each carrying a reachability argument and a six-month expiry.
yyyyyyyan
added
the
qa in progress
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the side-car image to remediate container vulnerabilities and document residual exceptions. The gzip exception’s call-site inventory is incomplete and needs correction.
Changes:
- Refreshes the Python/Debian base and upgrades system packages.
- Removes unused compiler and PDF-rendering dependencies.
- Adds scoped Trivy exceptions and a security changelog fragment.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
sidecar/Containerfile.sidecar |
Hardens and reduces the runtime image. |
.trivyignore.yaml |
Documents residual vulnerability exceptions. |
changelog.d/SEP-1864.security.md |
Records the security remediation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
yyyyyyyan
added
qa not required
Contributor
Author
|
Tracked the follow-up from the PR description as SEP-1869: Nothing in this repository consumes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Takes the published SEP side-car image from 101 HIGH/CRITICAL Trivy findings to 17, and dispositions each of the remaining 17 as a documented, purl-scoped exception. Three files change; no application code is touched.
sidecar/Containerfile.sidecar— three edits to the final stagepython:3.11.14-slim→python:3.11.16-slimopenssl(3.5.6-1~deb13u2),libcap2, andwheel0.46.3apt-getblock entirelyg++(which pulled 43 transitive packages includinglinux-libc-dev) and the WeasyPrint stack (libpango-1.0-0,libpangoft2-1.0-0,fontconfig,fonts-dejavu,shared-mime-info, which broughtlibglib2.0-0t64andlibxml2).netcat-openbsdis installed separately further down and staysapt-get upgrade -yto the surviving layerutil-linux 2.41-5; Debian published2.41.5-0+deb13u1after the tag was cut.update → upgrade → install → cleanstay in oneRUNso the upgrade never runs against a stale indexRUN pip install --no-cache-dir wheelis also dropped. It was a no-op:python:3.11.14-slimalready shippedwheel0.45.1, so the line resolved as already-satisfied and installed nothing. The bumped base ships 0.46.3, past the 0.46.2 fix, so the base bump is what clears that finding..trivyignore.yaml(new, repository root) — 12 entries covering the 17 residual findings, each carryingid,purls,statementandexpired_at: 2027-02-19. Everystatementgives a reachability argument plus the condition under which the entry should be removed, not merely "no upstream fix".changelog.d/SEP-1864.security.md(new) — security fragment.Two things a reviewer should know
1. The exception file is inert unless the scan passes
--ignorefile. Trivy'sDefaultIgnoreFileis.trivyignore, so a baretrivy imagenever loads the YAML form — it parses the full schema only for a path handed to it explicitly. PMM's own scan (percona/percona-docker/.github/workflows/trivy_scan_pmm.yml) passes no such flag. The requirement is stated in the file's own header comment so the follow-up CI gate inherits it rather than rediscovering it.2.
purlson every entry is load-bearing, not decoration. In Trivy'spkg/result/ignore.go,matchPURL()returnstruewhen the list is empty, so an unscoped entry suppresses its CVE for every package — including one where the reachability argument does not hold. Every justification here is package-specific ("nothing executes perl", "SEP serves no QUIC", "the archive paths link zlib rather than invoking the gzip binary"), so each entry is scoped to exactly the packages it assessed. The constraints carry no version, so a Debian point release does not silently un-except a finding.setuptools: why no upgrade line
An earlier iteration added
RUN pip install --no-cache-dir --upgrade "setuptools>=81,<82"to clear thejaraco.context 5.3.0finding while preservingpkg_resources. It was measured to be inert and removed:requirements.txtpinssetuptools==83.0.0. The builder stage bakessetuptools-83.0.0-py3-none-any.whlinto/wheels, and the next recipe line —RUN pip install --no-cache-dir /wheels/*, untouched here — reinstalls it. Any bound placed above that line is overwritten.pkg_resourcesis consequently already absent from the pre-change image, through that same unchanged line. Verified directly: installing setuptools 83.0.0 on the old basepython:3.11.14-slimremoves it. Not a regression introduced here.jaraco_context-6.1.0, and the built image contains no stale 5.3.0 copy anywhere under/usr/local/lib/python3.11.Restoring a bound would mean downgrading against the lockfile. Constraining setuptools repo-wide is a separate decision.
Verification performed
Live evidence against the rebuilt image. Trivy pinned to v0.69.3, the version PMM installs, run as
docker.io/aquasec/trivy:0.69.3against apodman save --format docker-archiveexport ofsep:HEAD.make builderandRELEASE_VER=HEAD make imageboth exit 0g++and the WeasyPrint stack goneg++absent;linux-libc-dev,libglib2.0-0t64and all five rendering libs not-installed;libxml2reportsunknown ok not-installed/etc/debian_version13.6;util-linux 2.41.5-0+deb13u1;openssl 3.5.6-1~deb13u2;libcap2 1:2.75-10+deb13u1+b1setuptools 83.0.0,wheel 0.46.3; onlyjaraco_context-6.1.0.dist-infopresenthealthcheck.shprintedhealthy, exit 0. All five non-one-shot supervisord programs RUNNING; all three migrations complete with their sentinelsverified restricted: 5 app packages (atw, framework, inventory, mysql_backups, shared), exit 0--ignorefile .trivyignore.yaml --exit-code 1→ 0 findings, exit 0(cve, pkg)pairs vs 17 exception pairs — empty set difference in both directionspurls,id,statement,expired_atThe two rescans are deliberately separate runs. A single run with
--ignorefilecannot distinguish "correctly suppressed" from "wrote a file Trivy ignored".The rescan matched the projected residual set exactly — 4 CRITICAL and 13 HIGH across 12 distinct CVEs, no finding added or dropped — so the ticket's residual table needed no correction.
Residual set (all excepted)
perl-baseperl-baselibssl3t64,openssl,openssl-provider-legacylibncursesw6,libtinfo6,ncurses-base,ncurses-bingzipgzip/tarfilestdlib, which link zlib. All four/usr/bin/tar -czfcall sites run on a managed target host, not in this imagelibacl1sepuserFour CRITICALs ship as documented exceptions, so the Percona CVE Process § 7 sign-off (engineering leadership, Product, and security) is requested on the ticket and cross-posted to PMM-15297.
Backwards compatibility
No public contract changes — no API response models, DB schemas, enums, config keys, error responses, seed data, or task payloads.
One behavioural change, confined to a build mode that ships nothing: an unrestricted (
SEP_RESTRICT_APPS=0) build of this recipe would ship thereportapp without its system libraries, andapp/sep/apps/report/service.py:37importsweasyprintat module scope, so it would fail at load. This is not a regression to any shipped artifact — the app-restricted image is the only published one, and bothmake imageand.github/workflows/ci.ymlpassSEP_RESTRICT_APPS=1. The comment added beside the survivingapt-getlayer names the five libraries and the condition under which they must return, which is what makes a future unrestricted build recoverable rather than a puzzle.weasyprintstays inpyproject.tomland in the wheel set; it contributes no findings, only its system libraries did.Known limitations
.trivyignore.yamlyet. No tracked workflow or pipeline invokes Trivy at all, so until a scan gate ships, this file is validated only by the gated rescan above, on the implementer's machine — a later edit could merge with nothing parsing it. Adding a.trivyignore.yamlrow to.github/workflows/ci.yml'schangesfilter would not close this: the job that row triggers isbuild, which does static image inspection and runs no scanner. The recurring gate needs its own ticket — a workflow, a Trivy version pin, a failure threshold, the path filters, and the--ignorefile .trivyignore.yamlflag PMM's own scan does not carry — plus a revisit beforeexpired_at: 2027-02-19starts failing it.Out of scope
Removing
weasyprintfrom the Python dependency set; rebuilding or republishing released image tags; force-removing Debian-Essential packages (measured at 12 fewer findings and four fewer CRITICALs, and rejected on certainty grounds —--force-remove-essentialexists precisely because dpkg cannot verify the outcome, and debconf is itself a perl program, so any laterapt/dpkgoperation in the image would break).Tested
The side-car does not run standalone:
SECRET_KEYhas no default, and the three migration one-shots block onnc -z $SEP_DB_HOST $SEP_DB_PORT, whose host defaults topmm-server. The scenarios below therefore need one PostgreSQL container plus the image on a shared network.make builder, thenRELEASE_VER=HEAD make image. Confirm both exit 0 — the runtime stage now has no compiler, so a wheel needing one at install time would fail here.g++is absent, thatlinux-libc-dev,libglib2.0-0t64and the five WeasyPrint libraries report not-installed, and that/etc/debian_versionis 13.6 withutil-linux 2.41.5-0+deb13u1.postgres:16-alpineandsep:HEADon a shared container network withSECRET_KEY,SEP_DB_HOSTandSEP_DB_PASSWORDset, then exec the image's bundled healthcheck (sidecar/healthcheck.sh, installed at$APP_HOME/healthcheck.sh) inside the running container and confirm it printshealthyand exits 0. This asserts every non-one-shot supervisord program RUNNING, all three migrations complete, all three/healthendpoints answering, and the broker responding to PING.CONTAINER_RUNTIME=podman sidecar/verify_image_apps.sh sep:HEAD restricted.--severity HIGH,CRITICALwith no ignorefile, and confirm 17 findings, all in the Debian layer, with zero python-package findings.--ignorefile .trivyignore.yaml --exit-code 1and confirm it exits 0. Running both is what distinguishes a correctly suppressed set from a file Trivy never read.Checklist
New/modified functions have type hints and rST docstrings(N/A for this change — no Python touched)New tests added for new features or bug fixes(N/A for this change — a container-build recipe plus two non-Python files; verification is live evidence against the rebuilt image)Database migrations generated if models changed(N/A for this change — no models changed)User-facing changes documented (README, inline help, UI text)(N/A for this change)Configuration changes documented with examples(N/A for this change)changelog.d/