Remediate RC6 container scan findings

scripts/run_readiness_check.sh

@@ -118,6 +118,7 @@ bash -n scripts/deploy_tower.sh
 bash -n scripts/verify_release_fresh_install.sh
 bash -n scripts/verify_release_upgrade_smoke.sh
 bash -n deploy/unraid/all-in-one-start.sh
+bash -n deploy/unraid/gosu-setpriv
 bash -n deploy/unraid/run-dockerman-container.sh
 bash -n deploy/unraid/deploy-release.sh
 bash -n deploy/unraid/rollback-dockerman-container.sh

scripts/scan_container_image.sh

@@ -6,6 +6,9 @@ TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
 TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
+PYTHON_CMD="${PYTHON_BIN:-python3}"
+IGNORE_FILE="$(mktemp)"
+trap 'rm -f "$IGNORE_FILE"' EXIT
 
 case "$OUTPUT" in
   /*|*..*)
@@ -16,6 +19,9 @@ esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
+"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
+"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
+  --print-container-ids > "$IGNORE_FILE"
 
 # Keep the complete report, including vulnerabilities without an available fix.
 docker run --rm \
@@ -42,6 +48,7 @@ docker run --rm \
   --timeout 20m \
   --skip-version-check \
   --ignore-unfixed \
+  --ignorefile "$IGNORE_FILE" \
   --severity HIGH,CRITICAL \
   --exit-code 1 \
   "$TARGET_IMAGE"

scripts/verify_security_exceptions.py

@@ -40,12 +40,23 @@ def load_and_validate() -> tuple[dict[str, object], list[str]]:
             if not isinstance(item, dict) or len(str(item.get("reason", ""))) < 30:
                 errors.append("every advisory requires a specific reason")
                 break
+        aliases = [
+            str(alias)
+            for item in advisories
+            if isinstance(item, dict)
+            for alias in item.get("aliases", [])
+        ]
+        if len(aliases) != len(set(aliases)) or any(
+            not alias.startswith("CVE-") for alias in aliases
+        ):
+            errors.append("container aliases must be unique CVE identifiers")
     return payload, errors
 
 
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("--print-ids", action="store_true")
+    parser.add_argument("--print-container-ids", action="store_true")
     args = parser.parse_args()
     payload, errors = load_and_validate()
     if errors:
@@ -55,6 +66,10 @@ def main() -> int:
     if args.print_ids:
         for item in payload["advisories"]:
             print(item["id"])
+    elif args.print_container_ids:
+        for item in payload["advisories"]:
+            for alias in item.get("aliases", []):
+                print(alias)
     else:
         print(
             "Dependency exceptions valid through "