fix: require complete image malware scans #127

Merged

gitchegumi merged 1 commit from kiyi/clamav-complete-image-gate into main

2026-10-18 14:27:44 -05:00

kiyi commented

2026-10-18 14:10:53 -05:00

Member

Base-images PR #56 exposed a false green: the Zarf-agent image exceeded ClamAV MaxScanSize, but its incomplete scan remained a nonblocking warning and the image gate passed. This makes incomplete full-image scans fail, matching the existing application-layer requirement. Missing signatures, export/engine errors, timeouts and exceeded limits cannot produce clean or reusable evidence; partial malware detections still block. Reports distinguish blocking image diagnostics from the unchanged source warnings.

Increase the bounded expanded-content budget from 2000M to 4096M for clamscan and clamd. MaxFileSize remains 2000M; the existing image file/total/export caps, two workers and bounded batches remain intact. MaxScanSize counts recursively expanded content separately from input size. No approved vulnerability selector or workflow/job/status name changes.

Validation: 41 focused scanner/report tests pass in WSL; the real Trivy converter test is deferred to Library checks because pinned Trivy is not installed locally. The existing scaffold check passes all 16 mocked cases. Ruff fatal/undefined-name checks, diff checks and the active Gitleaks commit hook pass. A broader local suite could not pass in this Windows/WSL environment: missing defusedxml, Windows-linked Git metadata, and NTFS permission-mode assertions. Hosted Library checks remain required.

After review, publish/promote the library and rerun base-images PR #56 at its reviewed head. Acceptance still requires a clean Zarf-agent ClamAV record, zero malware warnings, a completed SBOM and zero blocking findings/scanner errors. The raised budget has not yet been validated against the real candidate.

Addresses Homelab/base-images#56 (comment)

Base-images PR [#56](https://git.gitchegumi.com/Homelab/base-images/pulls/56) exposed a false green: the Zarf-agent image exceeded ClamAV MaxScanSize, but its incomplete scan remained a nonblocking warning and the image gate passed. This makes incomplete full-image scans fail, matching the existing application-layer requirement. Missing signatures, export/engine errors, timeouts and exceeded limits cannot produce clean or reusable evidence; partial malware detections still block. Reports distinguish blocking image diagnostics from the unchanged source warnings. Increase the bounded expanded-content budget from 2000M to 4096M for clamscan and clamd. MaxFileSize remains 2000M; the existing image file/total/export caps, two workers and bounded batches remain intact. MaxScanSize counts recursively expanded content separately from input size. No approved vulnerability selector or workflow/job/status name changes. Validation: 41 focused scanner/report tests pass in WSL; the real Trivy converter test is deferred to Library checks because pinned Trivy is not installed locally. The existing scaffold check passes all 16 mocked cases. Ruff fatal/undefined-name checks, diff checks and the active Gitleaks commit hook pass. A broader local suite could not pass in this Windows/WSL environment: missing defusedxml, Windows-linked Git metadata, and NTFS permission-mode assertions. Hosted Library checks remain required. After review, publish/promote the library and rerun base-images PR [#56](https://git.gitchegumi.com/Homelab/base-images/pulls/56) at its reviewed head. Acceptance still requires a clean Zarf-agent ClamAV record, zero malware warnings, a completed SBOM and zero blocking findings/scanner errors. The raised budget has not yet been validated against the real candidate. Addresses https://git.gitchegumi.com/Homelab/base-images/pulls/56#issuecomment-7358

kiyi added 1 commit

2026-10-18 14:10:54 -05:00

fix: require complete image malware scans

Workflow acceptance / acceptance (pull_request) Successful in 1m21s

Details

Repository security / security-1 (pull_request) Successful in 1m50s

Details

Library checks / tests (pull_request) Successful in 8m49s

Details

1aa47f9cb3

portegumi approved these changes

2026-10-18 14:12:18 -05:00

portegumi left a comment

Reviewed the authenticated current head 1aa47f9cb3. Image ClamAV setup retains bounded input/export/batch limits and applies the 4096M expanded-content limit in both standalone and daemon modes. Image database, scan/limit, export and timeout failures now produce an incomplete record plus a blocking scanner error rather than reusable clean evidence; partial detections remain blocking findings. The final decision fails on scanner errors, while source-only operational warnings remain advisory. Focused tests cover those paths and SBOM conversion remains a required follow-up. No UDS resource or routing changes are present. Source approval only: Workflow acceptance, Repository security and Library checks are still pending, and the raised limit has not been validated against the actual base-images Zarf-agent candidate. Do not merge or promote on this approval alone; require successful exact-head checks and a separate candidate-image scan before claiming the original case resolved.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the authenticated current head 1aa47f9cb3561d9e0a94c8a57b75a021d39dda91. Image ClamAV setup retains bounded input/export/batch limits and applies the 4096M expanded-content limit in both standalone and daemon modes. Image database, scan/limit, export and timeout failures now produce an incomplete record plus a blocking scanner error rather than reusable clean evidence; partial detections remain blocking findings. The final decision fails on scanner errors, while source-only operational warnings remain advisory. Focused tests cover those paths and SBOM conversion remains a required follow-up. No UDS resource or routing changes are present. Source approval only: Workflow acceptance, Repository security and Library checks are still pending, and the raised limit has not been validated against the actual base-images Zarf-agent candidate. Do not merge or promote on this approval alone; require successful exact-head checks and a separate candidate-image scan before claiming the original case resolved. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.