fix: unsafe curl|sh during container build

[dmzoneill]

Containerfile.dev.j2 runs curl https://astral.sh/uv/install.sh | sh during build. No proxy env set at build time, bypasses egress control. Pin uv version or install from package.

[github-actions]

The repository appears to be in a minimal state. Based on the GitHub issue, here's the recommended fix for Containerfile.dev.j2:

Fix Summary

Replace the unsafe curl|sh pattern with a pinned version installation. Here are two secure alternatives:

Option 1: Install from official releases (recommended)

# Pin specific uv version
ARG UV_VERSION=0.4.18
RUN curl -LsSf https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-installer.sh | sh

Option 2: Use package manager (most secure)

# Install from package if available in your base image
RUN apt-get update && \
    apt-get install -y --no-install-recommends uv && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

Option 3: Multi-stage build with verification

FROM alpine:latest AS uv-installer
ARG UV_VERSION=0.4.18
ARG UV_CHECKSUM=<insert-sha256-here>
RUN apk add --no-cache curl && \
    curl -LsSf -o /tmp/install.sh https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-installer.sh && \
    echo "${UV_CHECKSUM}  /tmp/install.sh" | sha256sum -c - && \
    sh /tmp/install.sh

FROM base-image
COPY --from=uv-installer /root/.cargo/bin/uv /usr/local/bin/uv

Additional proxy support

Add these ARG/ENV declarations at the top of your Containerfile:

ARG HTTP_PROXY
ARG HTTPS_PROXY
ARG NO_PROXY
ENV HTTP_PROXY=${HTTP_PROXY}
ENV HTTPS_PROXY=${HTTPS_PROXY}
ENV NO_PROXY=${NO_PROXY}

Benefits:

• ✅ Version pinning prevents supply chain attacks
• ✅ Proxy support for egress control
• ✅ Reproducible builds
• ✅ Optional checksum verification

Would you like me to implement one of these solutions once the actual Containerfile is present in the repository?