From 1f7bf922028a786a4a16914d4d0416eadea6c676 Mon Sep 17 00:00:00 2001
From: magneticstain <837837+magneticstain@users.noreply.github.com>
Date: Sat, 18 Jul 2026 20:04:07 -0400
Subject: [PATCH 1/2] fix(actions): add missing permissions for content read
 access to release workflow

---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6c30e8d..95451b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Generate New Release - ${{ github.ref_name }}

From 3e4474c42304daa3ccae5147e491ba3b14553de4 Mon Sep 17 00:00:00 2001
From: magneticstain <837837+magneticstain@users.noreply.github.com>
Date: Sun, 30 Aug 2026 15:12:23 -0400
Subject: [PATCH 2/2] fix(Dockerfile): secure pipx installation with hash and
 update user/group IDs feat(trivy): add .trivyignore for misconfiguration
 AVD-DS-0026

---
 .trivyignore.yaml |  2 ++
 Dockerfile        | 20 ++++++++++++--------
 2 files changed, 14 insertions(+), 8 deletions(-)
 create mode 100644 .trivyignore.yaml

diff --git a/.trivyignore.yaml b/.trivyignore.yaml
new file mode 100644
index 0000000..f3d53aa
--- /dev/null
+++ b/.trivyignore.yaml
@@ -0,0 +1,2 @@
+misconfigurations:
+  - id: AVD-DS-0026
diff --git a/Dockerfile b/Dockerfile
index bddcedb..f55a0f3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,17 @@
 # syntax=docker/dockerfile:1
 
-ARG PYTHON_VERSION=3.13
-
-FROM python:${PYTHON_VERSION}-slim AS build
+FROM python:3.13-slim@sha256:6771159cd4fa5d9bba1258caf0b82e6b73458c694d178ad97c5e925c2d0e1a91 AS build
 
 WORKDIR /build
 
-RUN pip install pipx==1.7.1
-RUN pipx install hatch==1.13.0
+# we are unable to use the --require-hashes option as there is no local file defining the hashes
+# this is what pip uses for comparison by default.
+# However, it can compare the hash against PyPI's hash.
+# Since PyPI sends requests over TLS, this should be secure enough for our threat model.
+# https://pypi.org/project/pipx/
+RUN pip install pipx==1.7.1 --hash=sha256:a575ced25c507c1b1c978269f5684b5b291e81e3cd14eb3cee196a3c5b304732
+# https://pipx.pypa.io/latest/how-to/pin-packages.html
+RUN pipx install hatch==1.13.0 && pipx pin hatch
 
 COPY . .
 
@@ -18,13 +22,13 @@ RUN hatch build
 ########################
 
 # linux/amd64 arch
-FROM python:${PYTHON_VERSION}-alpine@sha256:81362dd1ee15848b118895328e56041149e1521310f238ed5b2cdefe674e6dbf
+FROM python:3.13-alpine@sha256:81362dd1ee15848b118895328e56041149e1521310f238ed5b2cdefe674e6dbf
 
 RUN apk update && \
     apk add --no-cache libmagic
 
-RUN addgroup --system --gid 888 plexer && \
-    adduser --system --uid 888 --ingroup plexer plexer
+RUN addgroup --system --gid 1001 plexer && \
+    adduser --system --uid 1001 --ingroup plexer plexer
 
 WORKDIR /app