fix(sentinel): hash-pin the image's Python dependencies - #174
Merged
Conversation
The base image is already pinned by digest; the Python layer on top was not. requirements.txt is all floating >= constraints, so two builds of the same Dockerfile could install different code, and this is an image people build and run from the README's docker-compose rather than something CI produces once. requirements.txt stays as the statement of intent. requirements.lock.txt is the resolved, hash-pinned form and is what gets installed, so a rebuild fetches the same bytes. The compile command is in the Dockerfile next to the COPY. Verified with pip install --dry-run --require-hashes against the lock: resolves clean, 44 packages, and picks up cryptography 50.0.1, above the floor the org-wide advisory work set. This is the only unpinned install in the repo that is neither a local path nor a deliberate published-artifact fetch. The other Scorecard pipCommand findings here are one or the other, and are being dismissed with reasons rather than "fixed" into something they should not be. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of working through this repo's 35 Scorecard
pipCommand not pinned by hashfindings. This is the only one of them that is a real defect.The base image is already pinned by digest. The Python layer on top was not:
requirements.txtis all floating>=constraints, so two builds of the same Dockerfile can install different code. This is an image people build and run from the README's docker-compose, not something CI produces once and throws away.requirements.txtstays as the statement of intent.requirements.lock.txtis the resolved, hash-pinned form and is what gets installed. The compile command sits in the Dockerfile next to theCOPYso the next person does not have to guess it.Verified with
pip install --dry-run --require-hashesagainst the lock: resolves clean, 44 packages, and picks up cryptography 50.0.1, above the floor the org-wide advisory work set.The other 34 findings
Worth saying here so this PR is not mistaken for a partial fix. I enumerated every pip invocation in the repo's workflows and Dockerfiles and classified it:
pip install --no-deps ./packages/agentrust-capture-core,pip install -e "integrations/aeoess-aps[test]",pip install --no-deps .). There is no registry fetch and no published artifact, so there is nothing to hash. Hash-pinning is not defined for a local tree.agentrust-tracegot caught in the first place. All of these jobs arepermissions: contents: read.Those 34 are being dismissed with per-file reasons rather than changed, since "fixing" them would either be impossible or would remove the coverage they provide.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t