fix: Trivy スキャンで検出された CVE-2025-68121 に対応 - #461
Merged
Merged
Conversation
- Doppler CLI を apt から GitHub リリースの直接ダウンロードに変更 - .trivyignore に CVE-2025-68121 を追加（Doppler が Go 1.24.12 でビルド） - container-security.yml に trivyignores オプションを追加 CVE-2025-68121 は Go crypto/tls のセッション再開に関する脆弱性で、 Go 1.24.13 以降で修正されています。Doppler 3.75.2 は現時点で Go 1.24.12 でビルドされているため、Doppler の更新を待つ必要があります。 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe pull request updates the Doppler CLI installation method in the dev container from an APT repository to a pinned GitHub Releases download with architecture detection. It adds .trivyignore configuration to container security workflow steps and introduces a CVE exception for a known vulnerability affecting stdlib. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
PR レビュー結果概要CVE-2025-68121（CRITICAL）への対応として、Doppler CLI のインストール方法を変更し、.trivyignore で一時的に脆弱性を無視する適切な対応です。 ✅ 良い点1. セキュリティ対応の透明性
2. 適切な一時対応
3. インストール方法の改善
|
| 項目 | 評価 | コメント |
|---|---|---|
| コード品質 | ✅ | クリーンで読みやすい |
| セキュリティ対応 | ✅ | 適切な一時対応、透明性が高い |
| ドキュメント | ✅ | .trivyignore のコメントが非常に詳細 |
| テストカバレッジ | 基本的な動作確認のみ（上記追加推奨） | |
| パフォーマンス | ✅ | 影響なし |
| CLAUDE.md 準拠 | ✅ | Conventional Commits、Quality Gates 対応済み |
推奨アクション:
- エラーハンドリングの追加（上記2番）を実施
- CI が緑になることを確認
- マージ後、Doppler の更新を追跡するタスクを作成
📚 参考
🤖 Generated by Claude Code
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.devcontainer/Dockerfile:
- Around line 30-36: The curl invocation that downloads Doppler (the line
setting DOPPLER_VERSION and calling curl to write /tmp/doppler.deb) should
include --fail (or -f) so the build fails on HTTP errors instead of saving an
HTML error page; update the curl command that references
"https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb"
to add --fail (optionally also --location and --show-error) so dpkg only runs on
a valid .deb.
🧹 Nitpick comments (1)
.devcontainer/Dockerfile (1)
32-36: Add checksum verification for the Doppler CLI download.Each Doppler CLI GitHub release includes a
checksums.txtfile. Add integrity verification:RUN DOPPLER_VERSION="3.75.2" \ && ARCH=$(dpkg --print-architecture) \ && curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \ && curl -sLo /tmp/checksums.txt "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/checksums.txt" \ && sha256sum --ignore-missing -c /tmp/checksums.txt \ && dpkg -i /tmp/doppler.deb \ && rm /tmp/doppler.deb /tmp/checksums.txtThis hardens supply chain security given the binary runs with access to secrets.
Comment on lines
+30
to
+36
| # Install Doppler CLI from GitHub releases for latest security patches | ||
| # https://docs.doppler.com/docs/install-cli | ||
| RUN curl -sLf --retry 3 --tlsv1.2 --proto "=https" 'https://packages.doppler.com/public/cli/gpg.DE2A7741A397C129.key' | gpg --dearmor -o /usr/share/keyrings/doppler-archive-keyring.gpg \ | ||
| && echo "deb [signed-by=/usr/share/keyrings/doppler-archive-keyring.gpg] https://packages.doppler.com/public/cli/deb/debian any-version main" | tee /etc/apt/sources.list.d/doppler-cli.list \ | ||
| && apt-get update && apt-get install -y doppler \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
| RUN DOPPLER_VERSION="3.75.2" \ | ||
| && ARCH=$(dpkg --print-architecture) \ | ||
| && curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \ | ||
| && dpkg -i /tmp/doppler.deb \ | ||
| && rm /tmp/doppler.deb |
There was a problem hiding this comment.
Add -f (or --fail) to curl to fail fast on HTTP errors.
Without --fail, a 404 (e.g., typo in version or removed release) silently saves the error page as /tmp/doppler.deb, producing a confusing dpkg error. The existing Node.js install on Line 41 uses wget -q which fails on HTTP errors by default.
Proposed fix
-RUN DOPPLER_VERSION="3.75.2" \
- && ARCH=$(dpkg --print-architecture) \
- && curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
+RUN DOPPLER_VERSION="3.75.2" \
+ && ARCH=$(dpkg --print-architecture) \
+ && curl -sfLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \
&& dpkg -i /tmp/doppler.deb \
&& rm /tmp/doppler.deb📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # Install Doppler CLI from GitHub releases for latest security patches | |
| # https://docs.doppler.com/docs/install-cli | |
| RUN curl -sLf --retry 3 --tlsv1.2 --proto "=https" 'https://packages.doppler.com/public/cli/gpg.DE2A7741A397C129.key' | gpg --dearmor -o /usr/share/keyrings/doppler-archive-keyring.gpg \ | |
| && echo "deb [signed-by=/usr/share/keyrings/doppler-archive-keyring.gpg] https://packages.doppler.com/public/cli/deb/debian any-version main" | tee /etc/apt/sources.list.d/doppler-cli.list \ | |
| && apt-get update && apt-get install -y doppler \ | |
| && apt-get clean \ | |
| && rm -rf /var/lib/apt/lists/* | |
| RUN DOPPLER_VERSION="3.75.2" \ | |
| && ARCH=$(dpkg --print-architecture) \ | |
| && curl -sLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \ | |
| && dpkg -i /tmp/doppler.deb \ | |
| && rm /tmp/doppler.deb | |
| # Install Doppler CLI from GitHub releases for latest security patches | |
| # https://docs.doppler.com/docs/install-cli | |
| RUN DOPPLER_VERSION="3.75.2" \ | |
| && ARCH=$(dpkg --print-architecture) \ | |
| && curl -sfLo /tmp/doppler.deb "https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb" \ | |
| && dpkg -i /tmp/doppler.deb \ | |
| && rm /tmp/doppler.deb |
🤖 Prompt for AI Agents
In @.devcontainer/Dockerfile around lines 30 - 36, The curl invocation that
downloads Doppler (the line setting DOPPLER_VERSION and calling curl to write
/tmp/doppler.deb) should include --fail (or -f) so the build fails on HTTP
errors instead of saving an HTML error page; update the curl command that
references
"https://github.com/DopplerHQ/cli/releases/download/${DOPPLER_VERSION}/doppler_${DOPPLER_VERSION}_linux_${ARCH}.deb"
to add --fail (optionally also --location and --show-error) so dpkg only runs on
a valid .deb.
Contributor
|
🎉 This PR is included in version 1.71.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
3 tasks
6 tasks
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
trivyignoresオプションを追加Root Cause
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit