From 46c1e3162e097905b3639db0e1e079d23551fefb Mon Sep 17 00:00:00 2001 From: Ryan McLaughlin Date: Fri, 9 Oct 2026 20:02:23 -0400 Subject: [PATCH 1/2] Document deferred third-party dependency security remediation --- docs/release-readiness.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/release-readiness.md b/docs/release-readiness.md index 9b543b9..33e9987 100644 --- a/docs/release-readiness.md +++ b/docs/release-readiness.md @@ -28,6 +28,32 @@ are excluded from public packages. - Installed-wheel assets, version, bundled test preparation, MAGSplitter CLI and Camelot import passed outside the source checkout. - Final Conda integration and Docker/Apptainer validation remain release-build checks. +## Deferred dependency security remediation (2026-10-09) + +The [4.0.0 validation run](https://github.com/hallamlab/MetaPathways/actions/runs/38000115287) +passed Conda installation and workflow integration, Docker workflow integration, +and MP Apptainer artifact checks. Publication remains blocked by the repository's +container security gate. This is a HallamLab release policy, not an Anaconda +upload requirement. + +Trivy 0.74.0 reported 649 fixable high/critical occurrences across 89 distinct +vulnerability IDs, primarily in Apptainer and its CNI networking dependencies, +plus Java libraries bundled with Nextflow. Repeated occurrences across binaries +are not independent vulnerabilities. Individual applicability to MP has not +been established. The retained `container-security-report` artifact contains the +full and filtered JSON reports. The licensed Pathway Tools SIF was not scanned. + +The tested packages were Apptainer 1.5.4, CNI 1.0.1, CNI plugins 1.3.0 and +Nextflow 26.04.7. An upstream Nextflow 26.09.2-edge candidate had no fixable +high/critical Java findings in a separate scan, but remains an untested prerelease +for MP. Official Apptainer 1.5.4 Debian binaries still had findings. No candidate +replaced the validated dependencies. + +Custom dependency rebuilds are deferred. Track patched upstream packages, +remaining findings, and required compatibility/security validation in +[issue #15](https://github.com/hallamlab/MetaPathways/issues/15). Deferral does not +disable the security gate, suppress findings, or authorize publication. + ## Release checks 1. Pass unit, release-control, documentation, source and wheel checks. From 6385e95f35458313af3f4965d49327afbd40d638 Mon Sep 17 00:00:00 2001 From: Ryan McLaughlin Date: Fri, 9 Oct 2026 20:10:43 -0400 Subject: [PATCH 2/2] Retain dependency scans as advisory while upstream fixes are deferred --- .github/workflows/release.yml | 13 +++++++++++-- docs/release-readiness.md | 12 +++++++----- docs/releasing.md | 10 ++++++++++ 3 files changed, 28 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ce788c1..d18248d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -234,7 +234,7 @@ jobs: else python scripts/release.py container-build fi - - name: Scan container for fixable high and critical vulnerabilities + - name: Scan container and report deferred dependency vulnerabilities run: | mkdir -p dist/security scanner_dir="$RUNNER_TEMP/metapathways-trivy" @@ -250,8 +250,17 @@ jobs: "$scanner_dir/trivy" image --scanners vuln \ --format json --output dist/security/trivy.json "$image" "$scanner_dir/trivy" image --scanners vuln \ - --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1 \ + --ignore-unfixed --severity HIGH,CRITICAL --exit-code 0 \ --format json --output dist/security/fixable-high-critical.json "$image" + python - <<'PYTHON' + import json + from pathlib import Path + report = json.loads(Path('dist/security/fixable-high-critical.json').read_text()) + findings = [v for r in report.get('Results', []) for v in r.get('Vulnerabilities', [])] + if findings: + ids = {v['VulnerabilityID'] for v in findings} + print(f'::warning::Deferred dependency findings: {len(findings)} occurrences, {len(ids)} unique IDs. See issue #15 and container-security-report.') + PYTHON - name: Retain vulnerability scan report if: always() uses: actions/upload-artifact@v7.0.1 diff --git a/docs/release-readiness.md b/docs/release-readiness.md index 33e9987..592b943 100644 --- a/docs/release-readiness.md +++ b/docs/release-readiness.md @@ -32,8 +32,8 @@ are excluded from public packages. The [4.0.0 validation run](https://github.com/hallamlab/MetaPathways/actions/runs/38000115287) passed Conda installation and workflow integration, Docker workflow integration, -and MP Apptainer artifact checks. Publication remains blocked by the repository's -container security gate. This is a HallamLab release policy, not an Anaconda +and MP Apptainer artifact checks. Third-party dependency findings are temporarily advisory under +[issue #15](https://github.com/hallamlab/MetaPathways/issues/15). This is a HallamLab release policy, not an Anaconda upload requirement. Trivy 0.74.0 reported 649 fixable high/critical occurrences across 89 distinct @@ -49,10 +49,12 @@ high/critical Java findings in a separate scan, but remains an untested prerelea for MP. Official Apptainer 1.5.4 Debian binaries still had findings. No candidate replaced the validated dependencies. -Custom dependency rebuilds are deferred. Track patched upstream packages, +Custom dependency rebuilds are deferred. The release scanner still runs and +retains its full and filtered reports; findings produce a visible warning. +Scanner execution errors and all build/integration failures remain blocking. Track patched upstream packages, remaining findings, and required compatibility/security validation in -[issue #15](https://github.com/hallamlab/MetaPathways/issues/15). Deferral does not -disable the security gate, suppress findings, or authorize publication. +[issue #15](https://github.com/hallamlab/MetaPathways/issues/15). This temporary policy does not suppress findings or imply that the dependencies +are vulnerability-free. Review it before each release until issue #15 is resolved. ## Release checks diff --git a/docs/releasing.md b/docs/releasing.md index 09cda26..c10979a 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -326,3 +326,13 @@ Secret values must never be committed or printed. Repository files alone cannot ```{include} includes/cami-references.md ``` + +## Temporary dependency-security policy + +Dependency findings are temporarily advisory while +[issue #15](https://github.com/hallamlab/MetaPathways/issues/15) tracks upstream +Apptainer/CNI and Nextflow remediation. Trivy still scans every release image, +retains full and filtered JSON reports, and emits a warning for fixable high or +critical findings. Scanner execution errors, package and container builds, and +workflow validation failures still block release. Review the findings before +each publication; restore the blocking findings policy after remediation.