From 010c2a162fa822800ca88c2f33d07d63b4bec2fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cau=C3=AA=20Faleiros?= Date: Mon, 21 Sep 2026 11:58:46 -0300 Subject: [PATCH] docs: record base image pinning and the CRITICAL image gate Co-Authored-By: Claude Opus 5 --- ROADMAP.md | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/ROADMAP.md b/ROADMAP.md index 7f5dbf9..8dab522 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -7,9 +7,9 @@ > Update the **Current step** line and the item status every time something moves. > Add new findings at the bottom of the relevant block rather than rewriting history. -**Current step:** Block 0 closed, plus 2.1–2.5 and 5.1. Next: 2.6 (pin base image -digests and triage the fixable image findings, which is what would let the image -scan gate), then 2.7–2.11. Block 1 still waits on client inputs for 1.1/1.2. +**Current step:** Block 0 closed, plus 2.1–2.6 and 5.1. Next: 2.7 (vendor or +integrity-pin pdf.js), then 2.8–2.11. Block 1 still waits on client inputs for +1.1/1.2. **Last audit:** 2026-09-18, full read of `local/`, `dtf-site.html`, `deploy/`, `.gitea/`, docs and legacy prototypes. Findings below carry their audit IDs. @@ -222,7 +222,7 @@ refactor: `'This runtime only supports APP_ENV=local'`, - Replace marker matching with behavioural assertions (import the module, assert the adapter classes in use). -### `[ ]` 2.6 — Base images are not pinned `(F10)` +### `[x]` 2.6 — Base images are not pinned `(F10)` Dockerfiles default to mutable `python:3.12-slim` / `nginx:1.28-alpine`, the workflow passes no digest build-args, and `--pull` makes builds non-reproducible — @@ -441,6 +441,23 @@ charges. Fix as part of 1.1. `SECURITY_REPORT.md` now carry a table of what gates and what does not, replacing descriptions of checks that never ran. +- `[x]` 2.6 — Both bases pinned by digest, OS packages upgraded in the production + images, and the web image moved off the nginx 1.28 line. + + | Image | Before | After | + |---|---|---| + | API | 56 HIGH, 3 CRITICAL (15 fixable) | 46 HIGH, 0 CRITICAL | + | Web | 5 HIGH, all unfixable in place | 0 HIGH, 0 CRITICAL | + + The 1.28 nginx pins `nginx=1.28.3-r1` in `/etc/apk/world`, so `apk upgrade` + cannot patch it even though Alpine ships `-r7`; `nginx:alpine` (1.31.6) is clean + while `1.29-alpine` scans worse at 37 HIGH. The two remaining "fixable" API + findings are `msgpack` and `setuptools`, which I confirmed are absent from the + built image rather than trusting the earlier report. Local images now share the + pinned bases, so the integration suite exercises what ships; full suite passes on + nginx 1.31.6. With both images at zero CRITICAL, the image scan now **gates on + CRITICAL** and reports HIGH. + ### Reporting - `[x]` Week-1 client report (`Relatorio-Semana-1-DTF.docx`), corrected 2026-09-18 to