- Add curl retry mechanism (3 attempts) for GeoIP database download
- Add 30-second timeout to prevent hanging on network issues
- Create placeholder file if download fails or checksum mismatches
- Allows Docker build to complete even when external database unavailable
- GeoIP feature remains optional - users can provide own database at runtime
Fixes security-weekly-rebuild workflow failures
- Add curl retry mechanism (3 attempts) for GeoIP database download
- Add 30-second timeout to prevent hanging on network issues
- Create placeholder file if download fails or checksum mismatches
- Allows Docker build to complete even when external database unavailable
- GeoIP feature remains optional - users can provide own database at runtime
Fixes security-weekly-rebuild workflow failures
Upstream database updated by MaxMind. Updates checksum to match
current version from P3TERX/GeoLite.mmdb mirror.
Fixes: Integration test workflow build failures
- Updated Docker Compose files to use digest-pinned images for CI contexts.
- Enhanced Dockerfile to pin Go tool installations and verify external downloads with SHA256 checksums.
- Added Renovate configuration for tracking Go tool versions and digest updates.
- Introduced a new design document outlining the architecture and data flow for dependency tracking.
- Created tasks and requirements documentation to ensure compliance with the new digest pinning policy.
- Updated security documentation to reflect the new digest pinning policy and exceptions.
- tonistiigi/xx:1.9.0 → pinned with digest
- golang:1.25-trixie → pinned with digest (gosu, backend, caddy builders)
- golang:1.25.6-trixie → pinned with digest (crowdsec builder)
- node:24.13.0-slim → pinned with digest (frontend builder)
- debian:trixie-slim → pinned with digest (crowdsec fallback)
All images now have renovate tracking comments for automatic security updates.
This ensures reproducible builds and enables Renovate to notify on new digests.
Go 1.25 defaults to gold linker for ARM64, but clang cross-compiler doesn't
recognize -fuse-ld=gold. Use -extldflags=-fuse-ld=bfd to explicitly select
the BFD linker which is available by default in the build container.
Fixes CI build failure for linux/arm64 platform.
After migrating base image from Alpine to Debian Trixie (PR #550),
integration test scripts were using wget-style options with curl
that don't work correctly on Debian.
Changed curl -q -O- (wget syntax) to curl -sf (proper curl):
waf_integration.sh
cerberus_integration.sh
rate_limit_integration.sh
crowdsec_startup_test.sh
install-go-1.25.5.sh
Also added future phase to plan for Playwright security test helpers
to prevent ACL deadlock issues during E2E testing.
Refs: #550
Migrated all Docker stages from Alpine 3.23 to Debian Trixie (13) to
address critical CVE in Alpine's gosu package and improve security
update frequency.
Key changes:
Updated CADDY_IMAGE to debian:trixie-slim
Added gosu-builder stage to compile gosu 1.17 from source with Go 1.25.6
Migrated all builder stages to golang:1.25-trixie
Updated package manager from apk to apt-get
Updated user/group creation to use groupadd/useradd
Changed nologin path from /sbin/nologin to /usr/sbin/nologin
Security impact:
Resolved gosu Critical CVE (built from source eliminates vulnerable Go stdlib)
Reduced overall CVE count from 6 (bookworm) to 2 (trixie)
Remaining 2 CVEs are glibc-related with no upstream fix available
All Go binaries verified vulnerability-free by Trivy and govulncheck
Verification:
E2E tests: 243 passed (5 pre-existing failures unrelated to migration)
Backend coverage: 87.2%
Frontend coverage: 85.89%
Pre-commit hooks: 13/13 passed
TypeScript: 0 errors
Refs: CVE-2026-0861 (glibc, no upstream fix - accepted risk)
Implement Phase 3 of Custom DNS Provider Plugin Support with comprehensive
security controls for external plugin loading.
Add CHARON_PLUGIN_SIGNATURES env var for SHA-256 signature allowlisting
Support permissive (unset), strict ({}), and allowlist modes
Add directory permission verification (reject world-writable)
Configure container with non-root user and read-only plugin mount option
Add 22+ security tests for permissions, signatures, and allowlist logic
Create plugin-security.md operator documentation
Security controls:
Signature verification with sha256: prefix requirement
World-writable directory rejection
Non-root container execution (charon user UID 1000)
Read-only mount support for production deployments
Documented TOCTOU mitigation with atomic deployment workflow
Add x/crypto v0.46.0 upgrade to CrowdSec builder stage to remediate:
- GHSA-j5w8-q4qc-rx2x (SSH public key parsing DoS)
- GHSA-f6x5-jh6r-wrfv (SSH certificate parsing DoS)
The CrowdSec builder was missing the x/crypto patch that exists in
our backend go.mod, causing scanners to detect v0.42.0 vulnerabilities
in the final image.
- Changed report title to reflect security audit focus
- Updated date and status to indicate approval for commit
- Enhanced executive summary with detailed validation results
- Included comprehensive test coverage results for backend and frontend
- Documented pre-commit hooks validation and known issues
- Added detailed security scan results, confirming absence of CVE-2025-68156
- Verified binary inspection for expr-lang dependency
- Provided risk assessment and recommendations for post-merge actions
- Updated compliance matrix and final assessment sections
- Improved overall report structure and clarity
Go 1.25 hardcodes -fuse-ld=gold for ARM64 external linking, but Alpine's
clang toolchain only includes LLD. Add a clang wrapper that:
- Intercepts -fuse-ld=gold and replaces with -fuse-ld=lld
- Spoofs GNU gold version output for Go's linker validation
Fixes continuous CI failures on linux/arm64 platform builds.
