fix(sandbox): patch libexpat and jq CVEs

[cjagwani]

Summary

Patch the sandbox-base image for CVE-2026-45186 in libexpat and CVE-2026-49839 in jq. The image now installs fixed official Debian packages from an immutable snapshot with per-architecture hashes and runtime assertions, while asserting that the separately owned Perl packages remain unchanged.

Changes

• Install libexpat1=2.8.2-1, libjq1=1.8.2-1, and jq=1.8.2-1 from the Debian 20260724T000000Z snapshot on AMD64 and ARM64.
• Verify exact SHA-256 values before installation and fail the image build for unsupported architectures or unexpected installed/runtime versions.
• Assert the Perl package version is unchanged so this PR does not overlap the separately owned Critical Perl remediation.
• Update the executable Dockerfile test harness for the new package-install commands.
• Add the dependency review, compatibility analysis, architecture hashes, build evidence, and promotion gates under docs/security/.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this is an internal base-image dependency remediation with no user-facing contract change; the new security review records implementation and promotion evidence.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: completed a CVE-specific dependency and compatibility review, immutable artifact verification, executable Dockerfile contract tests, and full dual-architecture image builds and runtime probes; evidence is in docs/security/sandbox-base-libexpat-jq-2026-07-24-dependency-review.md.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/security/sandbox-base-libexpat-jq-2026-07-24-dependency-review.md; the current-head follow-up review confirmed the stricter test fixtures require no additional documentation.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: not applicable
• Station profile/scenario: not applicable
• Result: not applicable
• Supporting evidence: not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/pr-risk-plan.test.ts test/sandbox-provisioning.test.ts test/node-tar-dockerfile-contract.test.ts test/source-shape-scanner.test.ts passed 161 tests in 4 files.
• Review follow-up verification: npx vitest run --project integration test/sandbox-provisioning.test.ts passed 62 tests, including the checksum-failure regression; Biome, git diff --check, and the test-size budget passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable; this change is isolated to the base-image package layer and its executable contract fixture.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Additional verification:

• npm run docs completed with 0 errors and 2 pre-existing warnings.
• Hadolint passed.
• Full Dockerfile.base builds and runtime probes passed for linux/amd64 and linux/arm64.
• Both architectures reported libexpat1=2.8.2-1, libjq1=1.8.2-1, jq=1.8.2-1, and unchanged perl=5.40.1-6.
• Final publication and authoritative nSpect digest rescans remain promotion gates.

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates the sandbox base image to install verified Debian snapshot builds of libexpat1, libjq1, and jq, adds a dependency review record, and extends provisioning test fixtures with shared APT command stubs.

Changes

Sandbox base package remediation

Layer / File(s)	Summary
Package targets and dependency review docs/security/sandbox-base-libexpat-jq-2026-07-24-dependency-review.md	Records target versions, architecture-specific hashes, compatibility checks, verification evidence, and remaining promotion gates.
Snapshot package installation and probes Dockerfile.base	Downloads fixed packages from an immutable Debian snapshot, verifies checksums, installs them with dpkg, asserts versions, runs runtime probes, and cleans up temporary files.
APT fixture command stubs test/helpers/base-apt-security-functions.ts, test/sandbox-provisioning.test.ts	Adds strict shared APT command stubs, injects them into provisioning fixtures, and tests checksum-change rejection.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: area: security, area: sandbox, bug-fix

Suggested reviewers: apurvvkumaria, prekshivyas, chengjiew

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: patching libexpat and jq CVEs in the sandbox image.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-sandbox-base-libexpat-jq-v2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit fbdfb32 in the codex/fix-sandbox-ba... branch remains at 96%, unchanged from commit 2e743da in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit fbdfb32 in the codex/fix-sandbox-ba... branch remains at 80%, unchanged from commit 2e743da in the main branch.

Show a code coverage summary of the most impacted files.

File	main 2e743da	codex/fix-sandbox-ba... fbdfb32	+/-
src/lib/onboard...ndbox-create.ts	83%	33%	-50%
src/lib/onboard...-create-plan.ts	88%	75%	-13%
src/lib/onboard...ndbox-create.ts	91%	83%	-8%
src/lib/state/m...-acquisition.ts	89%	87%	-2%
src/lib/actions...nference-set.ts	94%	94%	0%
src/lib/actions...box/download.ts	100%	100%	0%
src/lib/shields/index.ts	71%	72%	+1%
src/lib/state/g...way-registry.ts	94%	95%	+1%
src/lib/sandbox...uild-context.ts	38%	39%	+1%
src/lib/actions...nload-verify.ts	86%	100%	+14%

---

_{Updated July 24, 2026 21:53 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7503.docs.buildwithfern.com/nemoclaw

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/sandbox-provisioning.test.ts`:
- Around line 30-53: Replace the unconditional command stubs in
BASE_APT_SECURITY_FUNCTIONS with narrow behavior-specific fakes that validate
expected arguments, inputs, and outputs while preserving the scenarios each test
requires. In particular, update dpkg, curl, sha256sum, jq, and python3 so
invalid checksum, package, parsing, and runtime-probe behavior can fail instead
of always succeeding; add explicit negative-path coverage where a stub cannot
safely emulate the real behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5deee6f9-8907-4e28-a604-19e3747188f6

📥 Commits

Reviewing files that changed from the base of the PR and between fac91e6 and ee5a920.

📒 Files selected for processing (3)

• Dockerfile.base
• docs/security/sandbox-base-libexpat-jq-2026-07-24-dependency-review.md
• test/sandbox-provisioning.test.ts

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions
Status: Canonical ledger: 0 blocker(s), 1 warning(s), 0 suggestion(s).

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 2 warnings · 0 suggestions

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard

1 optional E2E recommendation

• rebuild-openclaw

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Test the amd64 security-package artifact branch

• Location: test/helpers/base-apt-security-functions.ts:6
• Category: security
• Problem: The fixture always returns arm64 and accepts only arm64 artifact URLs and checksums. Dockerfile.base has a separate amd64 branch with three independent hashes, so a typo or integrity regression in that branch has no checked-in negative-path coverage.
• Impact: An amd64 base-image build can fail package verification or accept an unintended hash change without a focused regression test detecting the branch-specific defect before image publication.
• Recommendation: Parameterize the fixture architecture and add amd64 success and checksum-rejection coverage for the three artifact paths and hashes.
• Verification: Read the fixture architecture response at line 8 and its arm64-only URL and checksum cases at lines 31-33 and 49-51, then compare them with the amd64 Dockerfile branch.
• Test coverage: A provisioning test that executes the apt-layer snippet with an amd64 fixture, plus a test that changes one amd64 expected checksum and verifies the script fails before dpkg installation.
• Evidence: test/helpers/base-apt-security-functions.ts line 8 returns "arm64" unconditionally. test/helpers/base-apt-security-functions.ts lines 31-33 and 49-51 enumerate only arm64 paths and checksums. Dockerfile.base selects separate amd64 hashes before downloading architecture-specific package artifacts.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[senthilr-nv]

The remediation review is approved, but this PR still needs a refresh before merge. Current head fbdfb3267 is 2 commits behind main (3a94d96a0), so please update the branch and preserve the npm remediation already merged in #7502. The required checks context is currently red because CLI shard 7 timed out in the unrelated src/lib/onboard/gateway-recovery.test.ts:167 test; rerun it after the refresh. E2E / PR Gate is also still pending. If #7504 merges first, refresh again so the final Dockerfile.base contains the npm, Perl, jq, and Expat remediations together before the combined image build and rescan.