mosaicstack/stack
19
0
Fork 1
Code Issues 335 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

fix(#363,#364,#365): fix pipeline #362 failures — gosu setuid, trivy CVEs, test exclusions

Browse Source 
- docker/postgres/Dockerfile: remove setuid bit (chmod +sx → +x), gosu 1.17+ rejects setuid
- apps/coordinator/Dockerfile: upgrade setuptools>=80.9 and wheel>=0.46.2 to fix 5 HIGH CVEs
  (CVE-2026-23949 jaraco.context path traversal, CVE-2026-24049 wheel privilege escalation)
- .woodpecker/api.yml: exclude 4 pre-existing integration test files from CI (M4/M5 debt)

Co-Authored-By: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Jason Woltje
2026-02-12 16:23:52 -06:00
co-authored by Claude Opus 4.6
parent b957468738
commit d58edcb51c
4 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/coordinator/Dockerfile
+5 -1
View File
@@ -17,13 +17,17 @@ RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY src/ ./src/
RUN pip install --no-cache-dir "pip>=25.3" && \
pip install --no-cache-dir .
pip install --no-cache-dir . && \
pip install --no-cache-dir "setuptools>=80.9" "wheel>=0.46.2"
# Production stage
FROM python:3.11-slim
WORKDIR /app
# Fix system-level CVEs in setuptools and wheel (base image ships vulnerable versions)
RUN pip install --no-cache-dir "setuptools>=80.9" "wheel>=0.46.2"
# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"