bcgov / bcgov/foi-flow

[ACS Report] Skip Recommendations during packaging

Open
#4,976 1 comment 0 reactions 0 assignees View on GitHub
high priority security
Dominant language
Python
Stars
8
Forks
2
Avg merge
14h 34m
Merged PRs (30d)
46

Description

w.r.t security scanning findings; it is not advised to install the default recommendations during packaging

Please change the below line which automatically installs recommendations
image.png

to
**"RUN
apt-get update && apt-get install -y --no-install-recommends "**

image.png

Reference:
https://acs.developer.gov.bc.ca/main/vulnerabilities/workload-cves/images/sha256:0f74dd85764ce26f2a603e6927c99c1b810eb661f35c3cd392a724ceec9f5c74?detailsTab=Vulnerabilities&sortOption[field]=Severity&sortOption[direction]=desc
CVE-2022-1586

Contributor guide

Open the contributing guide

Research direction

Find the Docker packaging file containing the apt-get install command shown in the issue and review the surrounding package-install step. Update that step to use --no-install-recommends, then rebuild or run the relevant packaging check and confirm the resulting image no longer installs default recommendations linked to the cited ACS finding.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, dockerfile
Domain
devops, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.