v2.69.0: the apps you host are scanned too, image digests included
v2.69.0: the apps you host are scanned too, image digests included
Vulnerability scanning used to stop at the platform's own dependencies and at
apps whose source tree we could read. Two gaps closed.
Container images are scanned. An app deployed from an image is now scanned by a
pinned Trivy (0.74.0, in a container — no host binary) against the RESOLVED
DIGEST recorded for that deployment, not the tag. A tag describes whatever the
publisher has behind it today, which reads exactly like a correct scan of the
wrong bytes. If a live deployment carries no digest the run is recorded as
skipped rather than falling back to the tag.
Four more lockfiles are read: composer.lock (PHP), yarn.lock in both the classic
v1 and Berry formats, and pnpm-lock.yaml 9.x. That takes the scanner to nine
lockfiles across seven ecosystems. pnpm 5.x and 6.x are refused by name and told
why — they key packages differently and a silent partial read is worse than a
refusal. No new dependency was added for any of it.
The scan reports and never blocks. Nothing in the scanner can throw into a
deploy, and a deploy never pulls the scanner image — fetching platform tooling
inside someone else's deploy is the same surprise as blocking on the result.
Deploy logs now carry the reason alongside the status, because a bare "skipped"
is the line an operator cannot act on.
Two things measurement corrected along the way. An end-of-life base image
returns zero findings because the distro stopped publishing advisories, not
because it is clean, so an EOSL image with no findings is recorded skipped, not
ok. And Debian's fixed-version strings needed ~ as a separator before version
comparison would order them correctly — without it the scanner named a fix that
does not fix the advisory.
Also fixed: a test-suite race that had nothing to do with scanning. 24 test
files called listen(0) with no host, which binds [::]. A concurrent test file
publishing a Docker port on 127.0.0.1 could hold that same number, so a test
server appeared to bind while its own fetch reached the container instead —
33 SCIM tests failing against a server that was answering someone else's
traffic. Binding loopback explicitly closes it: the kernel then sees the
conflict instead of handing out a port that is already spoken for.
Catalogue: correct ports and health paths for apache-ofbiz, documenso,
threat-dragon and twenty, and spree moved to a published image.