Handle Trivy Dockerfile findings without a source StartLine #56

New issue

Closed

opened 2026-09-24 15:11:41 -05:00 by kiyi · 2 comments

kiyi commented

2026-09-24 15:11:41 -05:00

Member

base-images build run #7 reached the source scan but ended with Trivy IaC finding requires a positive source StartLine. The Dockerfile lacked USER, and Trivy reported DS-0002 (HIGH), an absence check with no source line. pipeline/security.py supports line-less Dockerfile findings for built-image scans but rejects them for source scans. The gate reported 0 blocking findings and a scanner error, so the finding was not represented as an actionable security result.

Accept valid whole-Dockerfile source findings as blocking results with a stable, sufficiently specific identity (rule, target, and reviewed source context), while preserving the rule that ambiguous findings cannot be broadly mitigated. Add a DS-0002 fixture and tests showing the source gate blocks and reports it, plus tests for invalid metadata. Release the fix so base-images can update its pinned workflow library.

The same run also had a separate Trivy dependency database/artifact download error; investigate that independently if it recurs. Related: base-images #5 and PR #10.

[base-images build run #7](https://git.gitchegumi.com/Homelab/base-images/actions/runs/7/jobs/0/attempt/1) reached the source scan but ended with `Trivy IaC finding requires a positive source StartLine`. The Dockerfile lacked `USER`, and Trivy reported DS-0002 (HIGH), an absence check with no source line. `pipeline/security.py` supports line-less Dockerfile findings for built-image scans but rejects them for source scans. The gate reported 0 blocking findings and a scanner error, so the finding was not represented as an actionable security result. Accept valid whole-Dockerfile source findings as blocking results with a stable, sufficiently specific identity (rule, target, and reviewed source context), while preserving the rule that ambiguous findings cannot be broadly mitigated. Add a DS-0002 fixture and tests showing the source gate blocks and reports it, plus tests for invalid metadata. Release the fix so base-images can update its pinned workflow library. The same run also had a separate Trivy dependency database/artifact download error; investigate that independently if it recurs. Related: [base-images #5](https://git.gitchegumi.com/Homelab/base-images/issues/5) and [PR #10](https://git.gitchegumi.com/Homelab/base-images/pulls/10).

kiyi added this to the Homelab Roadmap project

2026-09-24 15:12:11 -05:00

kiyi referenced this issue

2026-09-24 15:40:39 -05:00

fix(security): classify Dockerfile findings and require final-image ClamAV #57

kiyi commented

2026-09-24 15:52:02 -05:00

Author

Member

Base-images manual run 14 reached Trivy configuration scanning after the dependency scan completed. Local Trivy 0.74.0 identified the line-less finding as Dockerfile rule DS-0026 (missing HEALTHCHECK). Base-images PR #11 mitigates that finding in the PyTorch/CUDA Dockerfile with a functional CPU-only runtime probe; the local Dockerfile scan now reports zero findings. The owner clarified that this work should remain in the image repository and that ClamAV only needed verification. The pinned workflow already invokes ClamAV for the exported final image. Workflows PR #57 is out of scope and should not be released for this task. Leave this general scanner issue open for a separate scope decision.

[Base-images manual run 14](https://git.gitchegumi.com/Homelab/base-images/actions/runs/14/jobs/0/attempt/1) reached Trivy configuration scanning after the dependency scan completed. Local Trivy 0.74.0 identified the line-less finding as Dockerfile rule `DS-0026` (missing `HEALTHCHECK`). [Base-images PR #11](https://git.gitchegumi.com/Homelab/base-images/pulls/11) mitigates that finding in the PyTorch/CUDA Dockerfile with a functional CPU-only runtime probe; the local Dockerfile scan now reports zero findings. The owner clarified that this work should remain in the image repository and that ClamAV only needed verification. The pinned workflow already invokes ClamAV for the exported final image. [Workflows PR #57](https://git.gitchegumi.com/Homelab/workflows/pulls/57) is out of scope and should not be released for this task. Leave this general scanner issue open for a separate scope decision.