mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
284b0873dd
Addresses three CodeRabbit findings on PR #1265. 1. LAM hardening invisible to the probe (thread 4413764929): the runtime check probes PHP with `php -r`, the CLI SAPI. web-app-lam mounted the hardening ini only into /etc/php/8.4/apache2/conf.d, which the Debian CLI does not scan, so the probe read unhardened CLI settings and the check failed for LAM. The php_hardening entry now also mounts the ini into /etc/php/8.4/cli/conf.d. No other role mounts it into a Debian per-SAPI directory; the rest use the shared scan dir of the official image or of Alpine. The TODO entry now names the remaining gap: the probe reads only the CLI copy. 2. Explanatory comment above HEALTH_RUNTIME_FLOORS (thread 4413764949): removed. The README already states the end-of-life rule and now also defines a floor as the lowest patched release of each line. 3. `apk --no-cache add` missed (thread 4415018662): PACKAGE_INSTALL_PATTERN required `add` right after `apk`, so `RUN apk --no-cache add php7` passed as an image without PHP. The apk branch now accepts options before `add`, like the apt branch. New tests cover the option form and guard that `apk` in a path or a comment is no package install. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
7 lines
552 B
Markdown
7 lines
552 B
Markdown
# To-dos
|
|
|
|
- Extend `HEALTH_RUNTIME_FLOORS`, the container probe and `make security-runtimes` to `node`, `python`, `ruby` and `java`.
|
|
- Verify the web SAPI where an image splits it from the CLI. `web-app-lam` mounts the hardening ini into both `/etc/php/8.4/apache2/conf.d` and `/etc/php/8.4/cli/conf.d`, and the probe reads only the CLI copy, so a wrong Apache target would still pass.
|
|
- Run `make security-runtimes` in a scheduled CI workflow.
|
|
- Scan the pinned images for CVEs (Trivy or Grype) in the scheduled CI and report new criticals as issues.
|