Skip to content

v1.12.0 — UBI9 production base-image cutover

Choose a tag to compare

View all tags
@clem-field clem-field released this 17 Jul 21:58
v1.12.0
66da481
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Known issue — non-ASCII header/banner text causes HTTP 500 (fixed in v1.12.1)

On this UBI9 image, if SPARC_HEADER_TEXT (the rules-of-behavior header, rendered on every page) — or any operator-set environment variable rendered into a page, including the consent banner — contains non-ASCII characters (e.g. —, ·, ©, accented letters), the app returns HTTP 500 on all full-layout pages (including /login).

Cause: UBI9 minimal ships no UTF-8 locale, so Ruby reads environment values as BINARY (ASCII-8BIT); rendering them into the UTF-8 page raises Encoding::CompatibilityError. The prior Debian base set LANG=C.UTF-8 implicitly, which masked this.

You can still run v1.12.0 — apply either mitigation:

  1. Set a UTF-8 locale in your container / ECS task definition: LANG=C.UTF-8 and LC_ALL=C.UTF-8. (Recommended — no content changes; restart to apply.)
  2. Use ASCII-only text for SPARC_HEADER_TEXT and the consent-banner file.

Fixed in v1.12.1, which bakes LANG=C.UTF-8 into the image (no action needed) plus a build-time guard so it can't regress. Tracking: #750.

Base-image cutover — Debian → Red Hat UBI9 (#742)

The production image moves from Debian ruby:3.4.4-slim to Red Hat UBI9 minimal (Iron Bank / DISA-aligned), retiring the recurring Debian perl/glibc CVE-disposition treadmill.

Grype (same vuln DB) Debian base UBI9 (v1.12.0)
Critical 15 0
perl / glibc criticals yes 0 / 0
  • ./Dockerfile is now UBI9 — Ruby 3.4.4 + jemalloc compiled from source, full app build (assets:precompile + OSCAL schema bundle + hdf-cli + entrypoint), non-root UID 1000. Multi-arch amd64 + arm64 via build-sign-publish.
  • Dockerfile_debian preserves the prior image for rollback; sparc-findings.debian.yml preserves the Debian disposition set.
  • Residual UBI9 Highs (gnutls/curl/libpq/glib2/libacl + erb/net-imap default-gem shadows) are Red Hat-backported and non-gating (--fail-on critical) — no perpetual dispositions.
  • Gemfile: tzinfo-data is now unconditional (UBI9 ships no usable system zoneinfo).
  • Dev docker-compose.yaml builds Dockerfile_debian (fast apt-based dev loop); new docker-compose.ubi9.yaml builds the UBI9 prod image for local smoke/API over TLS.

Validation

  • tests/api: 338 / 338. ui-smoke: 197 passed (Chrome, zero CSP violations).
  • A/B against a locally-built Debian prod image: byte-identical results — zero regression. Full evidence in docs/dev/ubi9_migration_findings.md.

Supply-chain evidence layout (#741)

  • S3 evidence emitters migrated to the canonical <boundary>/<date|latest>/<repo>/<source>/ layout for consistent, discoverable audit artifacts.

Process

  • New release rule in docs/dev/issue_rules.md: refresh docs/security/SCANNER_FINDINGS_AUDIT.md on every release (re-run bundle-audit/Trivy/Grype, refresh the review date, reconcile the suppression inventory). The audit is refreshed for v1.12.0/UBI9 (91 findings; 26 inert Debian entries pruned).

Full changelog: v1.11.1...v1.12.0

Assets 2
Loading