fix(ci): mitigate 11 upstream CVEs at source instead of suppressing

- docker/postgres/Dockerfile: build gosu from source with Go 1.26 via multi-stage build (eliminates 1 CRITICAL + 5 HIGH Go stdlib CVEs) - apps/{api,web,orchestrator}/Dockerfile: remove npm from production images (eliminates 5 HIGH CVEs in npm's bundled cross-spawn/glob/tar) - .trivyignore: trimmed from 16 to 5 CVEs (OpenBao only — 4 false positives from Go pseudo-version + 1 real Go stdlib waiting on upstream) Fixes #363 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 17:10:44 -06:00
parent 08f62f1787
commit 3833805a93
6 changed files with 44 additions and 33 deletions
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,18 +1,12 @@
 # Trivy CVE Suppressions — Upstream Dependencies
-# These CVEs exist in upstream base images/binaries we don't control.
 # Reviewed: 2026-02-12 | Milestone: M11-CIPipeline
 #
-# Re-evaluate when upgrading: node base image, openbao image, or postgres/gosu image.
-
-# === Go stdlib CVEs in upstream binaries ===
-# Affects: openbao bin/bao (Go 1.25.6), postgres gosu (Go 1.24.6)
-# Fix requires upstream to rebuild with Go >= 1.25.7 / 1.24.13
-CVE-2025-68121  # CRITICAL: crypto/tls session resumption
-CVE-2025-58183  # HIGH: archive/tar unbounded allocation
-CVE-2025-61726  # HIGH: net/url memory exhaustion
-CVE-2025-61728  # HIGH: archive/zip CPU exhaustion
-CVE-2025-61729  # HIGH: crypto/x509 DoS
-CVE-2025-61730  # HIGH: TLS 1.3 handshake vulnerability
+# MITIGATED in this sprint:
+#   - Go stdlib CVEs (6): gosu rebuilt from source with Go 1.26
+#   - npm bundled CVEs (5): npm removed from production Node.js images
+#
+# REMAINING: OpenBao only (5 CVEs — 4 false positives + 1 upstream Go stdlib)
+# Re-evaluate when upgrading openbao image beyond 2.5.0.

 # === OpenBao false positives ===
 # Trivy reads Go module pseudo-version (v0.0.0-20260204...) from bin/bao
@@ -22,11 +16,7 @@ CVE-2024-9180   # HIGH: privilege escalation (fixed in 2.0.3)
 CVE-2025-59043  # HIGH: DoS via malicious JSON (fixed in 2.4.1)
 CVE-2025-64761  # HIGH: identity group root escalation (fixed in 2.4.4)

-# === npm bundled packages in node:20-alpine base image ===
-# These are npm's own transitive deps at usr/local/lib/node_modules/npm/
-# Not used by our application code. Fix requires newer Node.js base image.
-CVE-2024-21538  # HIGH: cross-spawn ReDoS (npm bundled 7.0.3, need 7.0.5)
-CVE-2025-64756  # HIGH: glob command injection (npm bundled 10.4.2, need 10.5.0)
-CVE-2026-23745  # HIGH: tar symlink poisoning (npm bundled 6.2.1, need 7.5.3)
-CVE-2026-23950  # HIGH: tar Unicode path collision (npm bundled 6.2.1, need 7.5.4)
-CVE-2026-24842  # HIGH: tar path traversal via hardlink (npm bundled 6.2.1, need 7.5.7)
+# === OpenBao Go stdlib (waiting on upstream rebuild) ===
+# OpenBao 2.5.0 compiled with Go 1.25.6, fix needs Go >= 1.25.7.
+# Cannot build OpenBao from source (large project). Waiting for upstream release.
+CVE-2025-68121  # CRITICAL: crypto/tls session resumption
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -55,6 +55,10 @@ RUN pnpm turbo build --filter=@mosaic/api --force
 # ======================
 FROM node:20-alpine AS production

+# Remove npm (unused in production — we use pnpm) to eliminate bundled CVEs
+# (cross-spawn CVE-2024-21538, glob CVE-2025-64756, tar CVE-2026-23745/23950/24842)
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init

--- a/apps/orchestrator/Dockerfile
+++ b/apps/orchestrator/Dockerfile
@@ -63,6 +63,10 @@ LABEL org.opencontainers.image.vendor="Mosaic Stack"
 LABEL org.opencontainers.image.title="Mosaic Orchestrator"
 LABEL org.opencontainers.image.description="Agent orchestration service for Mosaic Stack"

+# Remove npm (unused in production — we use pnpm) to eliminate bundled CVEs
+# (cross-spawn CVE-2024-21538, glob CVE-2025-64756, tar CVE-2026-23745/23950/24842)
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+
 # Install wget and dumb-init
 RUN apk add --no-cache wget dumb-init

--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -77,6 +77,10 @@ RUN mkdir -p ./apps/web/public
 # ======================
 FROM node:20-alpine AS production

+# Remove npm (unused in production — we use pnpm) to eliminate bundled CVEs
+# (cross-spawn CVE-2024-21538, glob CVE-2025-64756, tar CVE-2026-23745/23950/24842)
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+
 # Install pnpm (needed for pnpm start command)
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate

--- a/docker/postgres/Dockerfile
+++ b/docker/postgres/Dockerfile
@@ -1,22 +1,22 @@
-# PostgreSQL with pgvector and up-to-date gosu
+# PostgreSQL with pgvector and gosu built from source
 #
-# Override the base image's gosu binary with the latest from tianon/gosu.
-# The postgres base image bundles gosu built with Go 1.24.6, which contains:
-#   - CVE-2025-68121 (CRITICAL): crypto/tls vulnerability
-#   - CVE-2025-58183 (HIGH): archive/tar unbounded allocation
-#   - CVE-2025-61726 (HIGH): net/url memory exhaustion
-#   - CVE-2025-61728 (HIGH): archive/zip CPU exhaustion
-#   - CVE-2025-61729 (HIGH): crypto/x509 DoS
-#   - CVE-2025-61730 (HIGH): TLS 1.3 handshake vulnerability
-# The tianon/gosu image is rebuilt with recent Go toolchains, eliminating these CVEs.
-# Using COPY --from avoids `go install` failures (gosu lacks semver Go module tags).
+# gosu is built from source with Go 1.26 to eliminate 6 Go stdlib CVEs
+# (CVE-2025-68121 CRITICAL + 5 HIGH) present in the tianon/gosu pre-built binary.
+
+# Stage 1: Build gosu from source with Go 1.26
+FROM golang:1.26-alpine AS gosu-builder
+RUN apk add --no-cache git
+RUN git clone --branch 1.17 https://github.com/tianon/gosu.git /src/gosu
+WORKDIR /src/gosu
+RUN go build -v -ldflags '-s -w' -o /bin/gosu .
+
 FROM postgres:17.7-alpine3.22

 LABEL maintainer="Mosaic Stack <dev@mosaic.local>"
 LABEL description="PostgreSQL 17 with pgvector extension and patched gosu"

-# Replace vulnerable gosu binary with latest pre-built version from tianon/gosu
-COPY --from=tianon/gosu /gosu /usr/local/bin/gosu
+# Copy gosu binary built from source in the gosu-builder stage
+COPY --from=gosu-builder /bin/gosu /usr/local/bin/gosu
 RUN chmod +x /usr/local/bin/gosu && gosu nobody true

 # Update Alpine packages for any remaining OS-level patches
--- a/docs/tasks.md
+++ b/docs/tasks.md
@@ -44,3 +44,12 @@
 | CI-FIX3-001 | done   | Create .trivyignore for upstream CVEs (Go stdlib in openbao/gosu, npm bundled pkgs in node:20-alpine) |       | ci   | develop |                         | CI-FIX3-002 | orch  | 2026-02-12T17:00Z | 2026-02-12T17:02Z | 5K       | 3K   |
 | CI-FIX3-002 | done   | Update all Trivy CI steps (6 steps across 5 pipelines) to use --ignorefile .trivyignore               |       | ci   | develop | CI-FIX3-001             | CI-FIX3-003 | orch  | 2026-02-12T17:02Z | 2026-02-12T17:04Z | 5K       | 3K   |
 | CI-FIX3-003 | done   | Verification: validate all pipeline #363 fixes                                                        |       | all  | develop | CI-FIX3-001,CI-FIX3-002 |             | orch  | 2026-02-12T17:04Z | 2026-02-12T17:05Z | 3K       | 1K   |
+
+## Pipeline #363 CVE Mitigation (proper fixes, not just suppression)
+
+| id         | status | description                                                                              | issue | repo   | branch  | depends_on                       | blocks     | agent     | started_at        | completed_at      | estimate | used |
+| ---------- | ------ | ---------------------------------------------------------------------------------------- | ----- | ------ | ------- | -------------------------------- | ---------- | --------- | ----------------- | ----------------- | -------- | ---- |
+| CI-MIT-001 | done   | Build gosu from source with Go 1.26 (eliminates 6 Go stdlib CVEs in postgres image)      | #363  | docker | develop |                                  | CI-MIT-003 | worker-10 | 2026-02-12T17:10Z | 2026-02-12T17:12Z | 8K       | 5K   |
+| CI-MIT-002 | done   | Remove npm from 3 Node.js production images (eliminates 5 npm bundled CVEs)              |       | apps   | develop |                                  | CI-MIT-003 | worker-11 | 2026-02-12T17:10Z | 2026-02-12T17:12Z | 5K       | 5K   |
+| CI-MIT-003 | done   | Trim .trivyignore to OpenBao-only (5 CVEs: 4 false positives + 1 upstream Go stdlib)     |       | ci     | develop | CI-MIT-001,CI-MIT-002            | CI-MIT-004 | orch      | 2026-02-12T17:13Z | 2026-02-12T17:14Z | 3K       | 2K   |
+| CI-MIT-004 | done   | Verification: 11 of 16 CVEs eliminated at source, 5 remaining documented in .trivyignore |       | all    | develop | CI-MIT-001,CI-MIT-002,CI-MIT-003 |            | orch      | 2026-02-12T17:14Z | 2026-02-12T17:15Z | 3K       | 1K   |