Martin Vogel
98a2856a90
Two open security alerts. Dependabot #13 (GHSA-r28c-9q8g-f849, high): postcss path traversal via sourceMappingURL auto-loading. Transitive dev dependency of vite, so it never ships in the binary, but the fix is a clean lockfile bump -- vite requires ^8.5.3 and the patch floor is 8.5.18, so 8.5.24 satisfies it with no dependency graph change. Verified: npm ci resolves and the UI still builds. Scorecard #76 (PinnedDependenciesID): Dockerfile.glibc22 used a floating `ubuntu:22.04`. Every other venue image is digest-pinned; this one was missed. It matters more here than the checkbox suggests -- that image IS the glibc-floor assertion, the oldest userland we claim the portable binary runs on. A floating tag means the floor silently drifts to whatever 22.04 points at, and a floor that moves is not a floor. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
29 lines
1.2 KiB
Docker
29 lines
1.2 KiB
Docker
# Dockerfile.glibc22 — the glibc-FLOOR venue (ubuntu-22.04, glibc 2.35).
|
|
#
|
|
# Mirrors CI's broad-matrix ubuntu-22.04 legs: the OLDEST userland we claim
|
|
# the portable (musl-static) binary runs on. Two assertions live here:
|
|
# 1. the portable binary passes the full canonical smoke on glibc 2.35;
|
|
# 2. the DYNAMIC binary refuses to start (its glibc 2.38+ floor is by
|
|
# design — old-glibc coverage is the portable binary's job, and a
|
|
# dynamic binary that silently ran here would mask a floor regression).
|
|
# Pinned by digest like every other venue image: a floating tag means the
|
|
# glibc-FLOOR assertion silently drifts to whatever ubuntu:22.04 points at, and
|
|
# a floor that moves is not a floor. (Scorecard PinnedDependenciesID #76 — this
|
|
# was the one image the pinning pass missed.)
|
|
FROM ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
bash \
|
|
ca-certificates \
|
|
coreutils \
|
|
curl \
|
|
file \
|
|
git \
|
|
python3 \
|
|
tar \
|
|
zlib1g \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /src
|
|
ENTRYPOINT ["bash"]
|