From d0a2feff204b83bf96f7799dcf99b862c0fa9478 Mon Sep 17 00:00:00 2001 From: magdev Date: Sat, 24 Oct 2026 00:36:26 +0200 Subject: [PATCH] Pull the base images fresh on every build (bau-pm BAU-191) Finding 41 of bau-pm's v0.22.3 security review called this a pin to move. It is not a pin: both bases here are floating tags, so what ships is whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8, past five October CVEs - none of them reachable in a static file server configured like this one, which is why --pull is the fix rather than a pin. The CI build gets it too: a gate running against a months-old cached base is not testing what the release builds. A release is what applies this. The running image does not change until one is cut. Co-Authored-By: Claude Opus 5 --- .gitea/workflows/ci.yml | 5 ++++- .gitea/workflows/release.yml | 7 ++++++- CHANGELOG.md | 4 ++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 19c5f80..c1078e4 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -28,7 +28,10 @@ jobs: # shared runner; the vendor stage downloads about 60 MB from npm. - name: build the image timeout-minutes: 60 - run: docker build --build-arg VERSION="ci-${GITHUB_SHA::8}" -t bau-pm-pdf-tools:ci . + # --pull, as in the release workflow (bau-pm BAU-191): both bases are + # floating tags, and a gate that runs against a months-old cached base + # is not testing what the release builds. + run: docker build --pull --build-arg VERSION="ci-${GITHUB_SHA::8}" -t bau-pm-pdf-tools:ci . - name: build the gate timeout-minutes: 15 diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 500c158..2b8cce1 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -42,8 +42,13 @@ jobs: - name: build the image timeout-minutes: 60 + # --pull (bau-pm BAU-191, review finding 41). Both base images are + # floating tags - node:20-alpine and nginx-unprivileged:alpine-slim - + # so the nginx and OS packages that ship are whatever the tag pointed + # at when the runner last pulled it. v0.1.0 went out with nginx 1.31.6 + # while the tag had moved to 1.31.8. This is the build people run. run: | - docker build --build-arg VERSION="v$VERSION" \ + docker build --pull --build-arg VERSION="v$VERSION" \ -t "$REGISTRY/$IMAGE:$VERSION" -t "$REGISTRY/$IMAGE:latest" . - name: gate - nothing leaves the origin diff --git a/CHANGELOG.md b/CHANGELOG.md index f5f3c19..ba79354 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project are documented in this file. The format is b ## [Unreleased] +### Security + +- The CI and release builds pull their base images fresh (`docker build --pull`). Both bases are floating tags, so what shipped was whatever the runner had cached: v0.1.0 went out with nginx 1.31.6 while the tag had already moved to 1.31.8, past five October CVEs. None of the five is reachable in a static file server configured like this one, which is why this is the fix rather than a pin. From bau-pm's v0.22.3 security review, finding 41 (bau-pm BAU-191). **A release is what applies it** - the running image does not change until one is cut. + ## [0.1.0] - 2026-10-10 The first release: BentoPDF v2.8.8 for bau-pm, about 120 PDF tools that run in the browser and talk to no third party, with the hand-off that brings a PDF from bau-pm into a tool and the result back.