marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-task image: clear the base image GPG_KEY fingerprint

Browse Source 
The official Python base sets GPG_KEY (public CPython signing fingerprint); the
executor rightly refused it as a credential-like name on kube-ax.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 17:42:03 +02:00
co-authored by Claude Opus 5.5
parent 75f2134eb4
commit cf10f38589
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plane/Dockerfile.search-task
+3
View File
@@ -28,5 +28,8 @@ RUN python3 -m venv /venv \
RUN groupadd --gid 10001 search \
&& useradd --create-home --uid 10001 --gid 10001 search
# gVisor is the outer boundary; retain inner bwrap when its capability probe succeeds.
# The Python base image sets GPG_KEY to the public CPython release-signing fingerprint (not a secret).
# Clear it so the executor's guard against inherited credentials stays strict and still passes.
ENV GPG_KEY=
USER root
# Do not replace the AX runner's ENTRYPOINT or CMD.