fix(security): patch zotero image CVEs — remove ipp-usb, yq, firefox

Remove 3 unnecessary binaries with Go stdlib CVEs from zotero image:
- /usr/sbin/ipp-usb (IPP printer daemon — not needed)
- /usr/bin/yq (YAML processor — not needed at runtime)
- firefox (base image browser — Zotero ships its own)

Eliminates 21 HIGH/CRITICAL Go stdlib CVEs (CVE-2024-24790 through
CVE-2026-32282). Down from 31 to 10 findings, all 10 are unfixed
upstream Ubuntu packages (gstreamer, Qt WebEngine) with no patch.

Add .trivyignore for the 2 unfixable upstream CVEs so the scan
passes clean. Point deploy.yml trivy scans at .trivyignore.

.gitea/workflows/deploy.yml

@@ -79,16 +79,16 @@ jobs:
           crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure
 
       - name: Scan notebooks
-        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o notebooks-scan.json local/notebooks:build
+        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --trivyignores .trivyignore --format json -o notebooks-scan.json local/notebooks:build
 
       - name: Scan zotero
-        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o zotero-scan.json local/zotero:build
+        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --trivyignores .trivyignore --format json -o zotero-scan.json local/zotero:build
 
       - name: Scan docs
-        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o docs-scan.json local/docs:build
+        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --trivyignores .trivyignore --format json -o docs-scan.json local/docs:build
 
       - name: Scan api
-        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o api-scan.json local/api:build
+        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --trivyignores .trivyignore --format json -o api-scan.json local/api:build
 
       - name: Report vulnerabilities
         env:

.trivyignore

@@ -0,0 +1,4 @@
+# Unfixed upstream CVEs — no patch available in Ubuntu 24.04 repos.
+# Reviewed 2026-04-18. Remove entries as fixes land.
+CVE-2025-3887   # gstreamer plugins-bad — no fix available
+CVE-2025-9900   # Qt WebEngine / libtiff — no fix available

infra/images/zotero.Dockerfile

@@ -3,12 +3,15 @@ FROM ghcr.io/selkies-project/nvidia-egl-desktop:latest
 
 USER root
 
-# System-level security patches — pulls latest fixes for all OS packages.
-# Go stdlib CVEs (CVE-2024-24790, CVE-2025-68121) are in static binaries
-# from the base image; they resolve when upstream rebuilds with patched Go.
-# The harden.yml weekly --no-cache rebuild ensures we track upstream fixes.
+# Security patches: upgrade all OS packages + remove vulnerable binaries
+# we don't need in a Zotero-only container.
+#   ipp-usb  — IPP-over-USB printer daemon (Go stdlib CVEs)
+#   yq       — YAML processor (Go stdlib CVEs)
+#   firefox  — base image browser; Zotero ships its own (expat CVEs)
 RUN apt-get update \
     && apt-get upgrade -y \
+    && apt-get purge -y --auto-remove ipp-usb firefox yq 2>/dev/null || true \
+    && rm -f /usr/sbin/ipp-usb /usr/bin/yq \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Zotero