fix(worker): update scoped curl libraries and require real read-only smoke

Merged
BI
23d ago
+107-39

Summary

Update only the worker's curl dependency and its three HTTP/3 libraries from signed Trixie backports. Explicit package pins and installed-version guards target CVE-2026-12064 and CVE-2026-8458; ngtcp2 1.22.1 avoids introducing CVE-2026-40170. APT preferences deny every other backports package. Python, extraction code, non-root identity, locks, budgets and repository-pinned models stay unchanged.

Correct the read-only app probe: its previous docker run IMAGE node -e fetch(...) replaced the server CMD, so no server started and ECONNREFUSED was swallowed. The existing required smoke now starts the image normally with --read-only, network disabled, capabilities dropped and no-new-privileges. It retains readiness, PID 1 and graceful-shutdown checks. Remove the invalid duplicate advisory step; failures now fail the required smoke.

Areas touched: Delivery and assurance, Source intake and indexing

RAG impact: no retrieval/ranking or extraction producer code changes. The shared native curl library changes; keep real clinical OCR, both Python runtime environments and complete image validation. Local-file OCR controls do not establish arbitrary protocol equivalence or live backend readiness.

Verification

  • Fresh signed Debian metadata and dependency closure checked. Parent independently checked official CNA fixed-version ranges for curl and ngtcp2. Runner shell syntax, deny-other-backports contract, vulnerable/fixed version controls and static Python lock checks passed.
  • Actual narrowed Python3.11/Trixie native probe: exactly two upgrades and two new packages, no removals/unrelated changes. Actual curl8.21.0/OpenSSL3.5.7/ngtcp2 1.22.1; all five linked-library checks had zero missing dependencies. UID1000 synthetic local OCR returned PsychSift OCR 12345 identically before and after. This is not a full worker image build.
  • Actual smoke CLI exercised with a fake Docker executable: default-CMD/read-only argv accepted, startup failure and unhealthy response failed closed. This checks control flow, not real read-only image boot.
  • Node syntax, exact-lock Prettier and git diff checks passed. Full local JS gates are unavailable because no complete current-lock node_modules exists; the checkout has formatter/parser tooling only. No full installed-lock parity claim.
  • Fresh blind independent six-file review identified one shutdown-evidence defect in the owning smoke: failed inspection or exit1 could pass. Parent reproduced all three failed/malformed/abnormal cases before correcting the helper. It now requires complete successful inspection and explicitly supports only clean exit0 or SIGTERM143; eleven shutdown controls and six actual-CLI fake-Docker controls pass. No other actionable defect was reported.
  • Exact-head hosted CI passed at 8049b28c7c33d9a0e185243bd762cefa3c278472: run 39447379588. Both image builds, required real read-only app startup (clean SIGTERM exit 143), worker offline runtime, both image migration self-tests, static checks, app build, both unit partitions and required aggregate passed. Worker Python ran 112 tests: 111 passed, one expected source-parity skip, zero failures. Both venv pip checks passed. Complete scans report worker 72 HIGH / 1 CRITICAL, app 0 HIGH / 0 CRITICAL: unchanged from baseline, with no measured finding-count reduction.

The first Mesa-inclusive local probe hit its disk guard before testing curl and was cleaned. The revised curl/Tesseract-only probe passed in110.25s with156MB peak container writes; full GL/OpenCV/Docling proof remains CI work. No extra provider calls or downloaded Python/model stacks were used locally.

Risk and rollout

  • Risk: the curl backport adds HTTP/3 dependencies; its protocol list drops RTMP variants and SMB/SMBS, and adds MQTTS. Existing worker OCR/shadow inputs are local image/document files. Local controls passed; full general protocol equivalence is not claimed. Installed floors reject curl below8.21.0 and ngtcp2 below1.22.1. No unrelated OS backports, dependency deletion, scanner suppression, fixture/budget relaxation or model changes.
  • Security hold: latest complete rebuilt-image scan remains worker72 HIGH /1 CRITICAL; app0/0. No measured reduction was established. Compatible fixes for the known libxml2 critical finding and remaining Tesseract/util-linux/native findings were not found in checked signed vendor metadata. This PR does not clear those holds or claim every remaining finding is unfixable.
  • Rollback: revert this PR; restoring the old curl also restores its findings, and restoring the old probe removes meaningful read-only acceptance.
  • Provider or production effects: ordinary public Actions builds/scans only. No agent-triggered production merge/deploy, database change, paid inference, live canary or ingestion activation. Repository automation enabled auto-merge on the preceding batch; any subsequently armed auto-merge state is user-owned and will not be changed by this agent. A main merge can trigger automatic deployment. Ingestion restoration remains deferred.

Final evidence and remaining hold

The rebuilt image installed all four exact package pins: libcurl4t64 8.21.0-2bpo13+1, libnghttp3-9 1.15.0-1bpo13+1, and both ngtcp2 packages 1.22.1-1~bpo13+1. The scan logs expose totals but no per-CVE/fixed-version rows. Raw scan report delivery is unavailable under the environment artifact-host policy. Therefore the unchanged count cannot be attributed to retained target CVEs or replacement findings from available evidence; neither individual scan closure nor release clearance is claimed.

Bounded official-source investigation traced one libxml2 route through Tesseract traineddata -> libarchive XAR XML, constrained to installed model files in inspected callers. Complete trigger, distro build and direct-consumer proof is missing. Overall exploit reachability remains UNPROVEN and the critical finding stays open. No suppression was added.

A fresh exact-head Codex review reported no findings; Gitar approved. CodeRabbit and Greptile could not review due account limits. Claude's workflow was green but its comment reported a review execution error; it is not counted as a successful review. The earlier blind review's shutdown finding was independently reproduced and corrected as recorded above.

External repository automation (gitar-bot) merged this PR at 2026-10-20 15:47:13 UTC as 5c00b16615de9ff37f65621f84b5cc6431378402. The parent agent did not arm or trigger the merge. The entire merged Git tree equals the tested head tree. Deployment status was not observed; ingestion restoration remains deferred.