P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning
Establish local mirrors for apt, apk, and PyPI packages used in the project. Auto-discover all packages from Dockerfiles, lockfiles, and pyproject.toml. Detect drift, missing packages, and vulnerabilities.
Closeout
All 10 issues closed. Scanner script discovers all apt, apk, and PyPI packages from Dockerfiles, uv.lock, and pyproject.toml. Local mirrors deployed for apt (apt-cacher-ng), apk (custom mirror), and PyPI (devpi). CI pipeline refreshes mirrors from the inventory manifest. Isolation test verifies builds succeed with no external network access. Drift detection identifies surplus or missing packages in mirrors vs manifest. Auto-issue filing generates a Gitea issue when a package is missing from a mirror and a separate issue per CVE found in mirrored packages. CI-agnostic pipeline definition abstracts all package operations behind the backend interface.
Issues resolved
- #159 — Scanner script for apt/apk/pypi package discovery
- #160 — Local apt mirror/cache
- #161 — Local apk mirror
- #162 — Local PyPI mirror (devpi)
- #163 — CI pipeline to refresh mirrors
- #164 — Build isolation test (no external network)
- #165 — Drift detection: surplus/missing packages
- #166 — Auto-issue for missing packages
- #167 — Auto-issue per CVE in mirrored packages
- #168 — CI-agnostic pipeline for package operations
Residual
None. Ongoing mirror sync and vuln scanning handled by the pkg-supply-chain CI pipeline.
