cp: build: Address CVE-2025-68973

[ko3n1g]

What does this PR do ?

Add a one line overview of what this PR aims to accomplish.

Changelog

• Add specific line by line info of high level changes in this PR.

GitHub Actions CI

See the CI sectionin the Contributing doc for how to trigger the CI. A Nvidia developer will need to approve and trigger the CI for external contributors.

Before your PR is "Ready for review"

Pre checks:

• Make sure you read and followed Contributor guidelines
• Did you write any new necessary tests?
• Did you add or update any necessary documentation?
• Does the PR affect components that are optional to install? (Ex: Numba, Pynini, Apex etc)
  • Reviewer: Does the PR have correct import guards for all optional libraries?

If you haven't finished some of the above items you can still open "Draft" PR.

Additional Information

• Related to # (issue)

Summary by CodeRabbit

• Bug Fixes
  • Fixed a security vulnerability (CVE-2025-68973) in the CI build environment.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Dockerfile.ci has been updated to include system package maintenance steps (apt-get update, gnupg upgrade, apt-get clean, and apt lists removal) following Python virtual environment creation, addressing CVE-2025-68973.

Changes

Cohort / File(s)	Summary
Docker Build Configuration docker/Dockerfile.ci	Added system package maintenance steps (apt-get update, gnupg upgrade, cleanup) after Python venv creation to address CVE-2025-68973.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested labels

r0.3.0

Suggested reviewers

• thomasdhc

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'build: Address CVE-2025-68973' clearly summarizes the main change: addressing a specific CVE vulnerability in the Docker build configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Test Results For Major Changes	✅ Passed	PR contains only minor security patch to upgrade gnupg in Docker build environment for CVE-2025-68973, with no impact on model training logic or performance.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch ko3n1g/cp/2a4cb09604c952c25a45d4040aee7b1383e6264e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@docker/Dockerfile.ci`:
- Line 29: Replace the interactive apt command with the non-interactive apt-get
variant: change the occurrence of "apt install -y --only-upgrade gnupg" to use
"apt-get install -y --only-upgrade gnupg" so the Dockerfile uses a consistent,
stable CLI (matching the existing "apt-get update") and avoids apt warnings in
CI.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Use apt-get install instead of apt install in Dockerfiles.

apt is intended for interactive use and may emit warnings in non-interactive contexts (e.g., "WARNING: apt does not have a stable CLI interface"). The same line already uses apt-get update, so this is also an inconsistency.

Proposed fix

-    apt-get update && apt install -y --only-upgrade gnupg && \
+    apt-get update && apt-get install -y --only-upgrade gnupg && \

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	apt-get update && apt install -y --only-upgrade gnupg && \
	apt-get update && apt-get install -y --only-upgrade gnupg && \

🤖 Prompt for AI Agents

In `@docker/Dockerfile.ci` at line 29, Replace the interactive apt command with
the non-interactive apt-get variant: change the occurrence of "apt install -y
--only-upgrade gnupg" to use "apt-get install -y --only-upgrade gnupg" so the
Dockerfile uses a consistent, stable CLI (matching the existing "apt-get
update") and avoids apt warnings in CI.