cesnimda
6.8 KiB
SEC-M03 — bounded dependency remediation and actual runtime qualification
Application lock:49→55 packages; six existing versions change, two obsolete transitive dependencies disappear and eight required transitive dependencies enter through the reviewed major-library transitions. This is not an unrestricted upgrade. Exact changes and new graph identities are in dependency-checkpoint.json.
| Owner | Before | After | Reason |
|---|---|---|---|
| filelock | 3.32.4 | 4.2.1 | Published fixes; explicit cache security constraint, native/soft/Hub contention qualified |
| Torch CPU | 2.6.0+cpu | 2.13.0+cpu | Latest first-patched bound among reviewed fixable records; actual official CPU wheel, no CUDA download |
| Transformers | 4.48.3 | 5.10.0 | Reviewed fixed bounds; real BART/tokenizer/generation/API qualification |
| Hub | 0.36.2 | 1.33.0 | Required compatible1.x dependency, exact locked/tested choice |
| tokenizers | 0.21.4 | 0.22.2 | Required compatible ABI range, actual pinned BART tokenizer/Unicode roundtrip |
| sympy | 1.13.1 | 1.14.0 | Torch dependency requirement |
New required graph members: httpcore,httpx,markdown-it-py,mdurl,pygments,rich,shellingham,typer. Requests and charset-normalizer leave this resolved graph; existing reviewed TLS/build constraints remain. Forty-one old pins are unchanged. All55 downloaded Linux wheels were hash-checked and match the committed lock; the real Dockerfile also installs with --require-hashes.
The new requirements-dev-linux.lock preserves every one of the55 runtime pins and adds exactly six existing-test dependency requirements. Broader installed-environment scanning found one additional alias group, pytest CVE-2025-71176/GHSA-6w46-j5rx-g56g (four overlapping provider records), beyond the original109 application groups. Vendor9.0.3 and the fix identify the temporary-directory repair. The dev pin changes8.3.5→9.0.3, the test lock is regenerated and the complete59-case Linux suite passes without warnings. No test assertion is weakened. The other test-only packages are httpcore2,httpx2,iniconfig,pluggy,truststore; bootstrap pip/wheel are separately inventoried. Neither pytest nor these test extras are added to the application lock.
Real supported runtime
The actual source Dockerfile was rebuilt locally with Python3.12.10/Debian12, the exact55-package CPU lock and native Tesseract5.3.0. A derived, network-free qualification layer adds only the six hashed test extras. RUNTIME.json records the two actual local image IDs; these are not pullable registry manifest references and no image was uploaded or deployed.
The initial real build revealed stale .venv-lock-check/.venv.stale-* directories entering the context. Only that owned build client/plugin was cancelled; its log/outcome remain. Changing .dockerignore from .venv to .venv* reduces the clean context to602.86kB. Actual image inventory verifies no /app/.venv* exists. Existing local directories and Docker services are untouched.
qualification.json contains actual process outcomes, input hashes and results. All lanes run without an application-source mount: the code is the built source image, checked by SHA256 against the working source. Nonroot65534, read-only root/fixture/helper mounts, network none, private tmpfs, twoCPU,2GiB,128PIDs and a180-second parent deadline are enforced. Containers are verified absent afterward.
- Complete sidecar:59/59, zero failed/skipped, using pytest9.0.3 and the actual61-package application/test lock.
- Safetensors and restricted PyTorch-state profiles: real BART class/tokenizer/native CPU generation, exact Norwegian tokenizer roundtrip,1024-token truncation, finite logits, short/long generation, actual summary/auth/repeat-cache contract. Each profile stays below one second after imports in this bounded fixture; this is not a full-model latency claim.
- Cache: five real artifact-integrity failures rejected before loading; native/soft/Hub cross-process contention expires, then acquires after release; missing offline model returns503 with no partially loaded state. Separate same-version Windows native/soft contention passes. No shared-cache upgrade or Windows ACL/symlink attack is claimed.
- Parsers: actual resource-bounded TXT/DOCX/PDF children preserve Norwegian content; native OCR on synthetic PNG and image-only PDF preserves the expected phrase. Actual uvicorn readiness/authenticated summary/cache and upload extraction pass over container loopback; the owned server stops afterward. English traineddata SHA256 is retained.
- Inventory: Python/native package versions, all55 installed pins,61 test pins plus bootstrap pip/wheel (63 distributions total), pip check, CPU build details, code hashes and OCR artifact hash are recorded.
The first52PASS/7FAIL Linux suite is retained: an empty harness Ollama URL failed URL construction before seven existing mocks. Its corrected loopback-only successor passed59/59. Early httpx fallback deprecations are retained; the final exact test layer uses the existing supported httpx2 requirement and has no warning. Earlier model/profile runs and focused checks are not added to final suite totals.
Security accounting and limits
Exact installed queries cover63 distributions/126 requests, zero advisory records. OSV accepts the exact CPU local version; PyPI returns404 for torch==2.13.0+cpu. That known second-provider coverage gap is retained as INCOMPLETE rather than reported as a clean request. The official CPU wheel identity/hash and current vendor/security source assessment provide separate evidence. Application55 queries likewise have zero records and the same vendor-release limitation. No suppression or owner risk acceptance is asserted.
Original109 groups remain traceable as65 previous repairs plus44 individual follow-ups. The current source assessment supports ten explicitly scoped non-applicability dispositions (unshipped/unused conversion, alternate architectures, export archive loader and the disputed numeric chain); it does not claim those upstream flaws globally fixed. Full final dispositions and Phase9 gates are reconciled after broad regression.
Full trained DistilBART, semantic quality, GPU, production cache ownership/migration, real device/provider/manual acceptance and live filesystem/recovery state remain unqualified. The source Dockerfile still has mutable base/apt/bootstrap inputs: this measured immutable local image is retained, while a future rebuild must record its actual identities and requalify. Production digest/supply-chain pinning and release approval remain separate gates. The bounded worker deadline/parser cancellation controls do not establish application-level cancellation of in-flight full-model inference.