fix(security): update sandbox Perl runtime

[apurvvkumaria]

Summary

The published OpenClaw sandbox base currently inherits Debian trixie's vulnerable Perl 5.40 runtime. This change installs checksum-pinned Perl 5.44.0, which contains the upstream fixes for CVE-2026-12087, CVE-2026-13221, and CVE-2026-57433, while preserving Debian package ownership and runtime dependencies.

Related Issue

Related to #7338. This PR remediates the current Critical findings; it does not close the broader early-detection and rescan work tracked there.

Changes

• Build Perl 5.44.0 from the official CPAN source archive after verifying its reviewed SHA-256 checksum and running the complete upstream test suite.
• Pin the trixie libc syscall prototype input so Buildx emulation cannot synthesize an incompatible declaration after a false-negative feature probe.
• Package the replacement as native perl-base and perl Debian packages so dpkg, dependency resolution, and vulnerability inventory describe the installed runtime.
• Remove the vulnerable libperl5.40 and perl-modules-5.40 packages during installation.
• Fail the image build unless Perl 5.44.0, Socket 2.041, and Storable 3.41 are active and the two applicable behavioral regression probes succeed.
• Add security contract coverage and make existing sandbox provisioning checks inspect the completed stage of multi-stage Dockerfiles.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change affects only internal sandbox-base package composition; commands, configuration, policies, workflows, and supported behavior are unchanged.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Security review verified the upstream fixed release and checksum, fail-closed build assertions, Debian package consistency, full image build, and runtime versions.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed the exact refreshed PR range. The 11-file PR diff is unchanged after the latest clean main refresh. No user workflow, configuration, or supported contract changes require docs; wording is public-safe and contains no confidential scan context.
• Agent: Codex Desktop documentation-writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — perl-critical-cve-remediation (4/4), runner contracts (55/55), sandbox workflow boundary (12/12), sandbox provisioning (61/61), adjacent Dockerfile contracts (24/24), and base-image publication contracts (60/60) passed. The corrected regex probe fails against vulnerable Perl 5.40 with regexp memory corruption and passes against fixed Perl 5.44. The full arm64 image build passed 2,763 upstream scripts / 1,391,429 tests, package audit, CVE behavior probes, exact runtime version checks, and Git compatibility. After the latest main refresh, 78 focused security/integration tests and the test-size, project-membership, source-shape, secret-scan, and commit-message guardrails passed.
• Applicable broad gate passed — npm run checks passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Security

  • Strengthened Perl CVE remediation by switching to a pinned upstream source tarball with SHA-256 verification, adding build-time packaging/metadata validation, and enforcing runtime guardrails for Perl and key modules.

• Tests

  • Added static checks covering pinning, checksum verification order, packaging steps, Debian package metadata, and runtime version assertions.
  • Updated Dockerfile content validation to focus on the final runtime stage; adjusted EC2 metadata disabling checks and sandbox image reuse expectations accordingly.

• Chores / CI

  • Increased sandbox image build job timeouts to 45 minutes to reduce CI failures.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The base image now builds pinned Perl from source into Debian packages, installs and validates those packages, and adds static Dockerfile contract tests. Sandbox image build timeouts and corresponding workflow validation expectations increase from 15 to 45 minutes.

Changes

Perl CVE remediation

Layer / File(s)	Summary
Build and package pinned Perl Dockerfile.base, test/perl-critical-cve-remediation.test.ts	Adds checksum-pinned Perl source builds, fixed configuration and testing, staged installation, Debian packaging, and static build-order checks.
Install and validate Perl in the image Dockerfile.base, test/perl-critical-cve-remediation.test.ts	Installs the generated packages, validates Debian relationships and runtime/module versions, runs Perl probes, and checks dpkg --audit.
Validate completed Docker stages test/sandbox-provisioning.test.ts, test/runner.test.ts, ci/source-shape-test-budget.json	Scopes existing Dockerfile assertions to the final stage, updates EC2 metadata stage selection, and registers the security contract test.

Sandbox build timeout updates

Layer / File(s)	Summary
Align sandbox build timeout configuration and validation .github/workflows/*.yaml, tools/e2e/sandbox-images-workflow-boundary.mts, test/e2e/support/sandbox-images-workflow-boundary.test.ts	Increases sandbox image build timeouts from 15 to 45 minutes and updates workflow boundary validation and its expected error message.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant perl_builder
  participant MainImage
  participant RuntimeChecks
  perl_builder->>perl_builder: Download and verify pinned Perl source
  perl_builder->>perl_builder: Configure, compile, and run make test
  perl_builder->>MainImage: Copy generated perl-base.deb and perl.deb
  MainImage->>MainImage: Install packages and remove temporary files
  MainImage->>RuntimeChecks: Verify Perl, Socket, Storable, and dpkg state
  RuntimeChecks-->>MainImage: Return validation results

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7508: Updates the same sandbox image timeout validation and test expectations.

Suggested labels: area: sandbox

Suggested reviewers: cjagwani

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main security-focused change: updating the sandbox Perl runtime.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-sandbox-base-critical-perl-v2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit dad76f5 in the codex/fix-sandbox-ba... branch remains at 96%, unchanged from commit 9aaca48 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit dad76f5 in the codex/fix-sandbox-ba... branch remains at 80%, unchanged from commit 9aaca48 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 9aaca48	codex/fix-sandbox-ba... dad76f5	+/-
src/lib/platform.ts	89%	84%	-5%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/securit...ntial-filter.ts	93%	93%	0%
src/lib/trace.ts	94%	94%	0%

---

_{Updated July 24, 2026 23:31 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

1 optional E2E recommendation

• rebuild-openclaw

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (3)

test/sandbox-provisioning.test.ts (1)

31-35: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicate stage-extraction helper across two new test files.

This is functionally the same "slice from the last FROM" logic added in test/perl-critical-cve-remediation.test.ts's completedStage(). See the consolidated comment for a shared-helper suggestion.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/sandbox-provisioning.test.ts` around lines 31 - 35, Remove the duplicate
completedDockerStage helper and reuse the existing shared stage-extraction
helper introduced as completedStage in perl-critical-cve-remediation.test.ts.
Update callers in sandbox-provisioning.test.ts to use that shared symbol while
preserving the behavior of slicing from the last “FROM” stage.

test/perl-critical-cve-remediation.test.ts (1)

61-76: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Prove the superseded Perl packages are actually removed, not just declared conflicting.

This test only checks the .deb control-file directives and dpkg --audit; it never asserts that libperl5.40/perl-modules-5.40 are actually gone from the completed image (e.g. dpkg -s libperl5.40 failing). As per path instructions, "Migration tests must prove the superseded path is unreachable or removed, not merely prove that the new path also works."

♻️ Example negative-path assertion

     expect(runtime).toContain('test -z "$(dpkg --audit)"');
+    expect(runtime).toContain(
+      '! dpkg -s libperl5.40 perl-modules-5.40 >/dev/null 2>&1',
+    );

(requires a matching check added to the Dockerfile's install RUN block)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/perl-critical-cve-remediation.test.ts` around lines 61 - 76, Add a
negative-path assertion to the completed Perl runtime migration: update the
Dockerfile install RUN block used by the runtime stage to verify `dpkg -s
libperl5.40` and `dpkg -s perl-modules-5.40` fail after installation, then
assert those checks in the `replaces the vulnerable distro packages without
breaking dpkg ownership` test. Keep the existing control-file and `dpkg --audit`
assertions.

Source: Path instructions

Dockerfile.base (1)

98-129: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

perl-base package declares no runtime Depends.

The control file only carries migration fields (Provides/Conflicts/Breaks/Replaces); there's no Depends on the shared libraries this binary actually links against (libc, and likely zlib/bz2/db/gdbm for bundled XS modules). This contradicts the stated goal in the comment above ("so dpkg dependencies... describe the runtime that is actually used") — today's build-time runtime checks would catch a missing .so at build time, but dpkg itself has no record that perl needs these libs, so a future apt-get autoremove or base-image change could silently drop them.

Consider generating an accurate Depends line with dpkg-shlibdeps (standard Debian tooling) against the staged binaries before writing the control file, rather than leaving it empty.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.base` around lines 98 - 129, Update the perl-base packaging flow
in the RUN block so its control metadata includes runtime shared-library
dependencies. Stage or otherwise expose the packaged Perl binaries and use
dpkg-shlibdeps to derive the dependency set before writing
/tmp/perl-root/DEBIAN/control, then emit the generated values in a Depends field
while preserving the existing migration fields and perl metapackage dependency.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile.base`:
- Around line 171-172: Update the Perl regex probe in the Dockerfile build check
to generate more than 65,535 distinct fixed-string branches, ensuring the
expression exercises the CVE-2026-13221 threshold and fails on vulnerable Perl
while passing on fixed versions. Keep the existing probe structure and
build-gating behavior unchanged.

In `@test/perl-critical-cve-remediation.test.ts`:
- Around line 78-87: Update the test around completedStage() to assert the
Dockerfile exercises the 65,535-branch regex overflow boundary required by
CVE-2026-13221, rather than merely checking for the copied "fnord" regex
literal. Preserve the existing assertions for the Perl and module versions,
pack_ip_mreq_source, and short-source rejection.

---

Nitpick comments:
In `@Dockerfile.base`:
- Around line 98-129: Update the perl-base packaging flow in the RUN block so
its control metadata includes runtime shared-library dependencies. Stage or
otherwise expose the packaged Perl binaries and use dpkg-shlibdeps to derive the
dependency set before writing /tmp/perl-root/DEBIAN/control, then emit the
generated values in a Depends field while preserving the existing migration
fields and perl metapackage dependency.

In `@test/perl-critical-cve-remediation.test.ts`:
- Around line 61-76: Add a negative-path assertion to the completed Perl runtime
migration: update the Dockerfile install RUN block used by the runtime stage to
verify `dpkg -s libperl5.40` and `dpkg -s perl-modules-5.40` fail after
installation, then assert those checks in the `replaces the vulnerable distro
packages without breaking dpkg ownership` test. Keep the existing control-file
and `dpkg --audit` assertions.

In `@test/sandbox-provisioning.test.ts`:
- Around line 31-35: Remove the duplicate completedDockerStage helper and reuse
the existing shared stage-extraction helper introduced as completedStage in
perl-critical-cve-remediation.test.ts. Update callers in
sandbox-provisioning.test.ts to use that shared symbol while preserving the
behavior of slicing from the last “FROM” stage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bc6acd88-804f-496f-b036-748966c8cc18

📥 Commits

Reviewing files that changed from the base of the PR and between 8a54612 and ea9bec0.

📒 Files selected for processing (4)

• Dockerfile.base
• ci/source-shape-test-budget.json
• test/perl-critical-cve-remediation.test.ts
• test/sandbox-provisioning.test.ts

[senthilr-nv]

Blocking: the new leading perl-builder stage makes the existing test/runner.test.ts runtime-stage ordering check inspect the builder stage. CI shard 6 fails at test/runner.test.ts:1043 with expected 6311 to be less than 3358, and the focused test reproduces locally. Update this test to scope Dockerfile.base to the completed runtime stage, as this PR already does for the affected sandbox-provisioning checks, then rerun the focused test. The security and implementation review is otherwise clean: the official CPAN archive matches the pinned SHA-256, Perl 5.44.0 release notes cover all three CVEs, package replacement is fail-closed, and the nine changed-contract tests pass.

[apurvvkumaria]

@senthilr-nv The runtime-stage ordering blocker is fixed in verified signed commit eafa6e6 (test(security): scope base runtime assertion). I reran the focused validation at the current head: npx vitest run --project integration test/runner.test.ts test/perl-critical-cve-remediation.test.ts test/sandbox-provisioning.test.ts — 3 files, 120 tests passed. Please re-review when ready.

[apurvvkumaria]

Exact-head refresh for 68e8f2c0f: the new sandbox-image timeout boundary passes 12/12 targeted tests, and the security/runtime set passes 120/120 (test/runner.test.ts, test/perl-critical-cve-remediation.test.ts, test/sandbox-provisioning.test.ts). The first local run was sandboxed and denied permission-mode changes; rerunning the same permission-sensitive tests outside that filesystem sandbox passed cleanly. All three PR commits are GitHub Verified.

[senthilr-nv]

Approved current head 68e8f2c. The prior runtime-stage ordering blocker is fixed. Security review found no blocking issue: the official Perl source is version- and checksum-pinned, upstream tests and fail-closed runtime/package checks cover the remediation, no secrets or unsafe input/privilege changes are introduced, the changed-contract tests pass, and the tree composes cleanly with #7502. Pending GitHub checks remain required and are not waived. Non-blocking follow-ups: consider deriving shared-library Depends metadata and documenting the QEMU override removal condition.

[apurvvkumaria]

Addressed the remaining advisor warning in signed commit 44e6cd4c8: the Dockerfile now names Perl Configure’s d_syscallproto probe, the Buildx/QEMU boundary, why the trixie result is pinned, and the exact removal condition. The existing QEMU multi-arch base-image workflow is now asserted by the remediation security contract. Targeted test: test/perl-critical-cve-remediation.test.ts (4/4); all file-scoped prek hooks passed, including the source-shape budget.