Skip to content

ROB-1256 Backport perl/glibc/git CVE fixes from Debian forky #2166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RoiGlinik merged 2 commits into from
Sep 3, 2026
Merged

ROB-1256 Backport perl/glibc/git CVE fixes from Debian forky #2166

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
707afad
ROB-1256 Backport perl/glibc/git CVE fixes from Debian forky
RoiGlinik Sep 2, 2026
17fa641
ROB-1256 Harden forky apt pin with :any architecture qualifiers
RoiGlinik Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build stage
FROM python:3.11-slim as builder

Check warning on line 2 in Dockerfile

View workflow job for this annotation

GitHub Actions / build

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/
ENV PATH="/root/.local/bin/:$PATH"

RUN apt-get update \
Expand Down Expand Up @@ -63,7 +63,7 @@
ENV PYTHONUNBUFFERED=1
ENV VIRTUAL_ENV=/app/venv
ENV PATH="/venv/bin:$PATH"
ENV PYTHONPATH=$PYTHONPATH:.:/app/src

Check warning on line 66 in Dockerfile

View workflow job for this annotation

GitHub Actions / build

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$PYTHONPATH'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

WORKDIR /app

Expand All @@ -84,10 +84,25 @@
&& apt-get install -y --no-install-recommends libexpat1 libc6 libc-bin libcap2 \
&& rm -rf /var/lib/apt/lists/*

# Debian trixie ships no fix for libssh2/attr/acl or perl ("vulnerable, no DSA" in the
# Debian security tracker), so the patched packages are pulled from forky with a
# per-package pin. Nothing else is resolved against testing - the preferences file below
# blocks every forky package except the ones named, and the sources are removed again in
# the same layer. Package names are ":any"-qualified (and so is the "Package: *" block)
# because arm64 is registered as a foreign architecture below - an unqualified name only
# pins the native arch, which would leave arm64 resolution unpinned/unblocked.
# - libssh2/libattr1/libacl1: CVE-2026-58050/58051/66032/66033/66034/66035, CVE-2026-54371,
# CVE-2026-54369/54370.
# - perl-base/perl: CVE-2026-57433, CVE-2026-13221, CVE-2026-57432, CVE-2026-15534,
# CVE-2026-19487. forky's perl pre-depends on glibc >= 2.43, so libc6/libc-bin/
Comment thread
coderabbitai[bot] marked this conversation as resolved.
# libc-gconv-modules-extra/libcrypt1 come along too. git hard-depends on perl (Debian
# builds them from the same source with locked versions), so git/git-man/liberror-perl/
# perl-modules-5.42/libperl5.42 are pulled up to forky's git 2.53.0 as well - trying to
# pin perl-base alone makes apt remove git instead of upgrading it.
RUN echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list \
&& printf 'Package: libssh2-1t64 libattr1 libacl1\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \
&& printf 'Package: libssh2-1t64:any libattr1:any libacl1:any perl-base:any perl:any perl-modules-5.42:any libperl5.42:any liberror-perl:any git:any git-man:any libc6:any libcrypt1:any libc-bin:any libc-gconv-modules-extra:any\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *:any\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \
&& apt-get update \
&& apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 \
&& apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 perl-base perl perl-modules-5.42 libperl5.42 liberror-perl git git-man libc6 libcrypt1 libc-bin libc-gconv-modules-extra \
&& rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky \
&& rm -rf /var/lib/apt/lists/*

Expand Down
Loading