Skip to content

Security: backport libssh2/attr/acl CVE fixes from Debian forky #2158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
naomi-robusta merged 5 commits into from
Aug 24, 2026
Merged

Security: backport libssh2/attr/acl CVE fixes from Debian forky #2158

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dfbff6e
Security: backport libssh2/attr/acl fixes from Debian forky
claude Aug 24, 2026
62ea3e2
Merge branch 'master' into claude/robusta-runner-cves-gqvg45
naomi-robusta Aug 24, 2026
acecef9
Harden the forky pin so only the three intended packages can come fro…
claude Aug 24, 2026
4f7609e
Re-lock with Poetry 1.8.5 to restore lock-version 2.0 and fix Pre-com…
claude Aug 24, 2026
f3a5b8f
Drop the CVE rationale comments from Dockerfile and pyproject.toml
claude Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build stage
FROM python:3.11-slim as builder

Check warning on line 2 in Dockerfile

View workflow job for this annotation

GitHub Actions / build

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/
ENV PATH="/root/.local/bin/:$PATH"

RUN apt-get update \
Expand Down Expand Up @@ -63,7 +63,7 @@
ENV PYTHONUNBUFFERED=1
ENV VIRTUAL_ENV=/app/venv
ENV PATH="/venv/bin:$PATH"
ENV PYTHONPATH=$PYTHONPATH:.:/app/src

Check warning on line 66 in Dockerfile

View workflow job for this annotation

GitHub Actions / build

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$PYTHONPATH'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

WORKDIR /app

Expand All @@ -84,6 +84,12 @@
&& apt-get install -y --no-install-recommends libexpat1 libc6 libc-bin libcap2 \
&& rm -rf /var/lib/apt/lists/*

RUN echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list \
&& printf 'Package: libssh2-1t64 libattr1 libacl1\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \
&& apt-get update \
&& apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 \
&& rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky \
&& rm -rf /var/lib/apt/lists/*

# Patching CVE-2024-32002
RUN git config --global core.symlinks false
Expand Down
Loading
Loading