claude-bot
30b6187c73
Add a deterministic (no-LLM) security sub-gate on the deploy-staging -> deploy edge, run FIRST (before merge-gate ORCH-043 and image-freshness ORCH-058) so it fails cheaply before any expensive rebase/rebuild, and scans origin/main..HEAD before rebase so a task is never blamed for a CVE introduced by an updated main. Why: the autonomous pipeline merged branches into main with no check for a leaked secret or a vulnerable dependency. For the self-hosting orchestrator (one shared prod instance serving every project from a shared DB) a single leak/CVE landed in the prod of all projects (CLAUDE.md self-hosting, section 8). - New leaf src/security_gate.py (never-raise): gitleaks (offline, fail-closed on tool error => secrets guarantee is unconditional) + pip-audit (best-effort; unreachable CVE feed degrades fail-open + loud warning by default, strict via security_dep_audit_fail_closed). Verdict lives ONLY in 17-security-report.md YAML frontmatter (write -> read-back single source of truth); FAIL is authoritative; missing/broken frontmatter => fail-closed. - check_security_gate thin wrapper registered in QG_CHECKS (lazy import, no cycle). - _handle_security_gate wired FIRST in advance_stage deploy-staging block: FAIL -> rollback to development + developer-retry (cap MAX_DEVELOPER_RETRIES); task_desc carries verbatim findings (ORCH-046 pattern). No merge-lease release (runs before lease acquire). Self-hosting safe: only reads/scans/writes, never deploys. - Conditional rollout (security_gate_enabled + security_gate_repos; empty scope -> self-hosting only). 6 new ORCH_SECURITY_* settings. - Infra: pinned gitleaks Go binary in Dockerfile (+curl/ca-certificates), pip-audit in requirements.txt, versioned .gitleaks.toml at repo root. - STAGE_TRANSITIONS and DB schema unchanged. Docs: docs/architecture/README.md (marked realized), CLAUDE.md (artifact 17), CHANGELOG.md. Tests: test_security_gate.py, test_qg_security.py, test_stage_engine_security_gate.py + updated registry/edge snapshots. Refs: ORCH-022 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
52 lines
3.0 KiB
Docker
52 lines
3.0 KiB
Docker
FROM python:3.12-slim
|
|
# ORCH-058 (Strategy B): stamp the image with the git commit it was built from so
|
|
# the deploy hook can fail-close if a stale staging image would be promoted to prod
|
|
# (INV-FRESH). Passed at build time via `--build-arg GIT_SHA=<sha>` (the staging
|
|
# rebuild in check_staging_image_fresh / the --build-staging hook mode supplies it).
|
|
# Without the build-arg the label is empty -> the hook treats it as a mismatch
|
|
# (fail-closed). The OCI-standard key is read by `docker image inspect`.
|
|
ARG GIT_SHA=""
|
|
LABEL org.opencontainers.image.revision=$GIT_SHA
|
|
WORKDIR /app
|
|
RUN apt-get update -qq && apt-get install -y -qq openssh-client git curl ca-certificates && rm -rf /var/lib/apt/lists/*
|
|
# git operations run as root over bind-mounted /repos (may be owned by host uid) -> trust it.
|
|
RUN git config --system --add safe.directory '*'
|
|
# ORCH-022: pinned gitleaks static Go binary for the offline secret-scan sub-gate
|
|
# (07-infra I-1). Baked into the image (NOT a pip package): the gate runs INSIDE the
|
|
# orchestrator container over a per-task worktree. Pinned release => deterministic
|
|
# rules; gitleaks needs no network so the "a secret always blocks" guarantee (BR-2)
|
|
# is independent of internet access. Multi-arch aware (amd64/arm64).
|
|
ARG GITLEAKS_VERSION=8.18.4
|
|
RUN set -eux; \
|
|
arch="$(dpkg --print-architecture)"; \
|
|
case "$arch" in \
|
|
amd64) gl_arch="x64" ;; \
|
|
arm64) gl_arch="arm64" ;; \
|
|
*) echo "unsupported arch: $arch" >&2; exit 1 ;; \
|
|
esac; \
|
|
curl -fsSL -o /tmp/gitleaks.tar.gz \
|
|
"https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${gl_arch}.tar.gz"; \
|
|
tar -xzf /tmp/gitleaks.tar.gz -C /usr/local/bin gitleaks; \
|
|
chmod +x /usr/local/bin/gitleaks; \
|
|
rm -f /tmp/gitleaks.tar.gz; \
|
|
gitleaks version
|
|
# ORCH-58: compose runs the container as uid:gid 1000:1000 (ORCH-40), but the base
|
|
# image has no passwd entry for uid 1000 -> ssh/whoami fail with
|
|
# "No user exists for uid 1000" (rc=255), breaking the detached self-deploy ssh
|
|
# launch (ORCH-36 Phase B). Create a real user 1000 with a home dir so getpwuid()
|
|
# resolves and ssh can start.
|
|
RUN groupadd -g 1000 app && useradd -u 1000 -g 1000 -m -d /home/slin -s /bin/bash slin
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
COPY src/ ./src/
|
|
# ORCH-021: do NOT `COPY data/ ./data/`. `data/` is gitignored (SQLite DB dir) and
|
|
# is provided at runtime as a bind-mount volume (`./data:/app/data`, see
|
|
# docker-compose.yml) which shadows anything baked into the image — so the COPY was
|
|
# dead weight. Worse, the ORCH-058 staging rebuild (`check_staging_image_fresh`)
|
|
# builds with the task *worktree* as the docker build context; a fresh worktree never
|
|
# contains the untracked `data/`, so `COPY data/` failed `docker build` with exit 1
|
|
# and bounced the task off `deploy-staging`. We just ensure the mountpoint exists.
|
|
RUN mkdir -p /app/data
|
|
ENV PYTHONPATH=/app
|
|
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8500"]
|