fix(security): extend Perl remediation to sibling images

[senthilr-nv]

Summary

Hermes and LangChain Deep Agents Code base images currently retain Debian Perl 5.40.1 even though the OpenClaw base already installs the reviewed Perl 5.44.0 security packages.
This change gives all three managed images the same checksum-pinned, fully tested Perl build and publishes the sibling multi-platform images from native runners.

Product Scope

This remediation stays within NemoClaw's existing managed OpenClaw, Hermes, and Deep Agents Code base-image surface. It does not add a new image, integration, or supported workflow.
NemoClaw maintainers own the temporary Perl packaging lifecycle. Remove it when Debian trixie provides an acceptable fixed package. Compatibility and publication evidence cover native linux/amd64 and linux/arm64 builds, checksum-bound source, the complete selected upstream test set, package and runtime probes, immutable inventory checks, and atomic multi-platform publication.

Changes

• Move the reviewed Perl source build, complete upstream test selection, and Debian packaging into one shared security builder.
• Install and runtime-verify Perl 5.44.0 and its corrected module versions in the OpenClaw, Hermes, and Deep Agents Code base images.
• Build all three managed base images natively on amd64 and arm64, then publish tags only after both immutable platform digests pass.
• Let clean unversioned development checkouts consume an exact source-SHA candidate before attempting the committed-divergence local-build path; dirty inputs still require a local build.
• Add regression coverage for package identity, runtime behavior, workflow trust boundaries, completed-image inventory, candidate resolution, and atomic manifest publication.
• Add the point-in-time Perl dependency and migration review and update the base-image selection reference.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop completed the repository security review. Source integrity, shell input handling, package ownership, secret boundaries, pinned actions, exact-candidate resolution, and atomic multi-platform publication pass; maintainer approval remains required.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: The refreshed base adds only the upstream v0.0.98 changelog entry; PR-owned resolver and Perl dependency documentation remains byte-identical and accurate. Focused source-identity and resolution tests passed 59/59; refresh commitlint and dist-freshness hooks passed.
• Agent: Codex Desktop (/root/documentation_writer_review)

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set — 29 resolver tests, 60 related CLI tests, and 24 security integration tests passed.
• Applicable broad gate passed — npm run check:diff passed after rebasing onto current upstream/main.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without errors (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only) — the security review includes SPDX; Fern frontmatter is not applicable because it is not a published page.

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Security
  • Added verified Perl 5.44 runtime and pinned perl-base/perl packages across managed base images and agent images.
  • Strengthened audit gates with stricter dpkg/interpreter/module checks and updated security inventory generation.
• Reliability
  • Improved multi-platform base image publishing with immutable per-architecture digests and safer atomic manifest creation.
  • Hardened sandbox/base image resolution to prefer exact source-SHA tags when inputs change.
• Documentation
  • Added a Perl 5.44 dependency review guide and refined base-image selection guidance.
• Tests
  • Expanded CI coverage for Perl verification, digest/manifest immutability, and related workflow gates.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change adds checksum-pinned Perl 5.44.0 Debian packaging and verification across managed images, switches sibling-image publication to native architecture builds with validated digest manifests, relocates Hermes cron state, updates security and workflow tests, and prioritizes source-SHA base-image resolution.

Changes

Managed image remediation and publication

Layer / File(s)	Summary
Pinned Perl packaging and image integration scripts/security/*, Dockerfile*, agents/*/Dockerfile*, test/*	Builds Perl packages from pinned source inputs, installs and verifies them across managed images, updates security inventories, and expands related contract mocks and tests.
Native platform builds and manifest validation .github/workflows/base-image.yaml, test/dcode-base-image-workflow.test.ts	Builds sibling images natively per architecture, uploads immutable digest artifacts, validates platform identity, and creates multi-platform manifests.
Hermes runtime relocation and image pinning agents/hermes/Dockerfile	Applies the cron execution database relocation patch and updates ledger path, permissions, and cleanup probes.
Base-image resolution and contract updates src/lib/..., docs/reference/commands.mdx	Attempts source-SHA image tags before rebuild and updates related tests, digest contracts, and resolution guidance.
Dependency review record docs/security/managed-base-perl-5.44-dependency-review.md	Documents Perl remediation scope, build flow, runtime proofs, native publication, boundaries, and verification gates.

Estimated code review effort: 5 (Critical) | ~90 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant NativeBuild
  participant DigestArtifact
  participant ManifestJob
  participant Registry
  Workflow->>NativeBuild: start amd64 and arm64 image builds
  NativeBuild->>DigestArtifact: upload architecture-qualified digest
  ManifestJob->>DigestArtifact: download and validate digest set
  ManifestJob->>Registry: inspect digest platform
  ManifestJob->>Registry: create multi-platform manifest

Loading

Possibly related issues

• [Epic] Support native Podman with buildless managed onboarding #7744: The native multi-architecture build and immutable digest publication changes align with the issue’s managed-image publication pipeline.

Possibly related PRs

• NVIDIA/NemoClaw#7844: Overlaps on Perl 5.44.0 remediation and native per-architecture manifest publication.
• NVIDIA/NemoClaw#7849: Overlaps on Hermes cron execution ledger relocation and runtime state migration.

Suggested reviewers: cv, ericksoa, brandonpelfrey

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: extending the Perl security remediation to the sibling images.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/security-perl-sibling-images

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit a53ec89 in the codex/security-perl-... branch remains at 96%, unchanged from commit 376beb5 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit a53ec89 in the codex/security-perl-... branch remains at 81%, unchanged from commit 376beb5 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 376beb5	codex/security-perl-... a53ec89	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/platform.ts	89%	84%	-5%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...ty-inventory.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/state/config-io.ts	93%	93%	0%

---

_{Updated July 30, 2026 04:59 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7864.docs.buildwithfern.com/nemoclaw

[coderabbitai]

🧹 Nitpick comments (5)

test/dcode-base-image-workflow.test.ts (1)

177-255: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider extracting validatePublishers' guard checks into named predicates.

The function keeps accreting independent checks (mutable tags, full-SHA enforcement, native platform, digest output, labels, cache rules) into one large array literal. Splitting each guard into a small named function (e.g. checkNoMutableTags, checkFullShaActions, checkImmutableDigestOutput) would make future additions easier to review and reduce the function's branching complexity.

As per coding guidelines, **/*.{js,ts,tsx}: "keep function complexity low."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/dcode-base-image-workflow.test.ts` around lines 177 - 255, The
validatePublishers function currently contains too many independent inline guard
checks, increasing complexity. Extract the publication validation groups—such as
mutable-tag checks, full-SHA enforcement, immutable platform output, and cache
rules—into small named predicates or helper functions, then compose their
results in validatePublishers while preserving all existing validation messages
and behavior.

Source: Coding guidelines

test/perl-critical-cve-remediation.test.ts (1)

230-238: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

Assertion doesn't tie platforms/runners to the specific managed image.

This test only checks that the runner/platform substrings exist somewhere in the whole workflow file and, separately, that each image's dockerfile path exists somewhere — it never confirms that a given image's own job builds both linux/amd64 and linux/arm64. A workflow where only one image had both platforms and the others had just one would still pass. test/dcode-base-image-workflow.test.ts already asserts the strict per-job platform/runner/arch mapping, which mitigates this gap, but this test's own title claim ("builds both architectures and every managed image") isn't actually proven here.

As per path instructions for **/*.test.{ts,js,mts,mjs,cts,cjs}: "Flag copied production algorithms, broad mocks that bypass the behavior under test, and conditionals that make a test pass without exercising its claim."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/perl-critical-cve-remediation.test.ts` around lines 230 - 238,
Strengthen the test in the “builds both architectures and every managed image”
case so each managed image’s workflow job is individually verified to include
both its matching runner/platform pairs and architecture configuration. Scope
the assertions to the job associated with each image, reusing the existing
managedImages metadata and following the strict per-job mapping established by
the related workflow test instead of checking whole-file substrings.

Source: Path instructions

.github/workflows/base-image.yaml (3)

452-519: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Extract the triplicated manifest creation and verification script. All three publication jobs now inline the same ~55-line routine (digest-artifact regex, duplicate-arch rejection, per-digest imagetools inspect platform proof, tag assembly, post-create platform assertion). This is the trust boundary for tag publication, so three copies means a future correction has to land three times and none of the copies is covered by ShellCheck or shfmt.

• .github/workflows/base-image.yaml#L452-L519: replace the inline script with a call to a new scripts/ci/create-platform-manifest.sh, passing IMAGE and TAGS as env and the digest directory as an argument.
• .github/workflows/base-image.yaml#L557-L624: replace the identical Deep Agents Code copy with the same script call.
• .github/workflows/base-image.yaml#L677-L706: replace the OpenClaw copy with the same script call so all three publication gates share one implementation.

As per path instructions, "Derive job inventories and aggregate dependencies from one source of truth or validate them deterministically."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/base-image.yaml around lines 452 - 519, Extract the
duplicated manifest creation and verification logic into
scripts/ci/create-platform-manifest.sh, preserving digest validation, platform
checks, tag assembly, manifest creation, and post-create verification. At
.github/workflows/base-image.yaml:452-519, :557-624, and :677-706, replace each
inline routine with a call to the shared script, passing IMAGE and TAGS through
the environment and the digest directory as its argument; ensure the script is
executable and suitable for ShellCheck and shfmt.

Source: Path instructions

---

214-215: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Optional: set persist-credentials: false on the new checkouts.

These jobs only need the tree for docker build, and they upload artifacts afterwards. Setting persist-credentials: false removes the token from .git/config for the rest of the job. The pre-existing OpenClaw job (line 95) has the same shape, so this is a consistency call rather than a defect.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/base-image.yaml around lines 214 - 215, Update the new
Checkout steps in the workflow to set persist-credentials to false, including
the checkout corresponding to the shown action reference and any matching newly
added checkout jobs. Keep the existing OpenClaw checkout unchanged unless
applying the same consistency setting is required by the surrounding change.

Source: Linters/SAST tools

---

235-263: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Drop the OpenClaw-only build-arg validation from the sibling jobs.

In build-hermes-platforms and build-dcode-platforms, AGENT is never openclaw, so openclaw_build_arg is always empty, the CR/LF and version-format checks are unreachable, and build-args: at lines 276 and 389 always resolves to an empty string. Only the bare scripts/check-production-build-args.sh call is load-bearing here. Trimming these two blocks removes ~50 duplicated lines and keeps the openclaw_version input contract in one place.

♻️ Proposed simplification (repeat for both jobs)

       - name: Validate production Docker build args
-        id: production-build-args
-        env:
-          AGENT: ${{ matrix.agent }}
-          OPENCLAW_VERSION_INPUT: ${{ inputs.openclaw_version }}
         run: |
           set -euo pipefail
-          build_args=()
-          openclaw_build_arg=""
-          if [ "$AGENT" = "openclaw" ] && [ -n "${OPENCLAW_VERSION_INPUT}" ]; then
-            openclaw_build_arg="OPENCLAW_VERSION=${OPENCLAW_VERSION_INPUT}"
-            build_args+=(--build-arg "$openclaw_build_arg")
-          fi
-          if [ "${`#build_args`[@]}" -gt 0 ]; then
-            scripts/check-production-build-args.sh "${build_args[@]}"
-          else
-            scripts/check-production-build-args.sh
-          fi
-          ...
-          printf 'openclaw_build_arg=%s\n' "$openclaw_build_arg" >> "$GITHUB_OUTPUT"
+          scripts/check-production-build-args.sh

Then remove build-args: ${{ steps.production-build-args.outputs.openclaw_build_arg }} from the corresponding build step.

As per path instructions, "Derive job inventories and aggregate dependencies from one source of truth or validate them deterministically."

Also applies to: 348-376

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/base-image.yaml around lines 235 - 263, Remove the
OpenClaw-specific validation steps from the build-hermes-platforms and
build-dcode-platforms jobs, including their AGENT/version environment setup and
output handling. Keep only the load-bearing bare
scripts/check-production-build-args.sh invocation, and remove build-args
references to production-build-args.outputs.openclaw_build_arg from both
corresponding build steps. Leave OpenClaw version validation centralized in the
OpenClaw-specific job.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/base-image.yaml:
- Around line 452-519: Extract the duplicated manifest creation and verification
logic into scripts/ci/create-platform-manifest.sh, preserving digest validation,
platform checks, tag assembly, manifest creation, and post-create verification.
At .github/workflows/base-image.yaml:452-519, :557-624, and :677-706, replace
each inline routine with a call to the shared script, passing IMAGE and TAGS
through the environment and the digest directory as its argument; ensure the
script is executable and suitable for ShellCheck and shfmt.
- Around line 214-215: Update the new Checkout steps in the workflow to set
persist-credentials to false, including the checkout corresponding to the shown
action reference and any matching newly added checkout jobs. Keep the existing
OpenClaw checkout unchanged unless applying the same consistency setting is
required by the surrounding change.
- Around line 235-263: Remove the OpenClaw-specific validation steps from the
build-hermes-platforms and build-dcode-platforms jobs, including their
AGENT/version environment setup and output handling. Keep only the load-bearing
bare scripts/check-production-build-args.sh invocation, and remove build-args
references to production-build-args.outputs.openclaw_build_arg from both
corresponding build steps. Leave OpenClaw version validation centralized in the
OpenClaw-specific job.

In `@test/dcode-base-image-workflow.test.ts`:
- Around line 177-255: The validatePublishers function currently contains too
many independent inline guard checks, increasing complexity. Extract the
publication validation groups—such as mutable-tag checks, full-SHA enforcement,
immutable platform output, and cache rules—into small named predicates or helper
functions, then compose their results in validatePublishers while preserving all
existing validation messages and behavior.

In `@test/perl-critical-cve-remediation.test.ts`:
- Around line 230-238: Strengthen the test in the “builds both architectures and
every managed image” case so each managed image’s workflow job is individually
verified to include both its matching runner/platform pairs and architecture
configuration. Scope the assertions to the job associated with each image,
reusing the existing managedImages metadata and following the strict per-job
mapping established by the related workflow test instead of checking whole-file
substrings.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: daf4392b-4d6e-4555-a469-a4f6d0ee0142

📥 Commits

Reviewing files that changed from the base of the PR and between 376beb5 and 2f8fd44.

📒 Files selected for processing (21)

• .github/workflows/base-image.yaml
• Dockerfile
• Dockerfile.base
• agents/hermes/Dockerfile
• agents/hermes/Dockerfile.base
• agents/langchain-deepagents-code/Dockerfile
• agents/langchain-deepagents-code/Dockerfile.base
• ci/source-shape-test-budget.json
• docs/reference/commands.mdx
• docs/security/managed-base-perl-5.44-dependency-review.md
• scripts/check-dcode-profile-import-gate.sh
• scripts/security/build-perl-security-packages.sh
• src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts
• src/lib/sandbox-base-image-resolution.test.ts
• src/lib/sandbox-base-image.ts
• test/dcode-base-image-workflow.test.ts
• test/helpers/base-apt-security-functions.ts
• test/hermes-share-mount-deps.test.ts
• test/langchain-deepagents-code-profile-build-gate.test.ts
• test/perl-critical-cve-remediation.test.ts
• test/sandbox-base-security-packages.test.ts

💤 Files with no reviewable changes (1)

• ci/source-shape-test-budget.json

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: Same-session synthesis validation failed; the advisor result is incomplete.

Model lanes

• GPT-5.6 Terra (primary): Completed · low confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 3 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 3 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, security-posture, onboard-repair, onboard-resume, ubuntu-repo-cloud-langchain-deepagents-code

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/sandbox-base-image-release-resolution.test.ts`:
- Around line 276-279: Update the assertion in the sandbox release-resolution
test to inspect recorded first arguments rather than using toHaveBeenCalledWith
with a second-argument matcher. Ensure any call whose first argument is
NEAREST_RELEASE_REF is rejected, including single-argument imageInspect calls.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cfdd8b8e-7c7c-4496-998a-17a93bb14d80

📥 Commits

Reviewing files that changed from the base of the PR and between 9b4121d and 14c5ad4.

📒 Files selected for processing (1)

• src/lib/sandbox-base-image-release-resolution.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/sandbox-base-security-packages.test.ts`:
- Line 8: Remove the test’s dependency on
SANDBOX_BASE_SECURITY_PACKAGE_INVENTORY and define an explicit expected security
inventory fixture within the test, including all Perl package versions. Update
the inventory assertion around the test setup at lines 99–100 to use this
fixture, keeping the expected values independent from production data.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4cd45482-c83e-4cfa-8d15-5c1323ff979b

📥 Commits

Reviewing files that changed from the base of the PR and between 1ba633d and ee94a49.

📒 Files selected for processing (4)

• src/lib/onboard/base-image.test.ts
• src/lib/sandbox-base-image/security-inventory.ts
• test/helpers/onboard-script-mocks.cjs
• test/sandbox-base-security-packages.test.ts

[senthilr-nv]

Addressed PRA-1 in 515b5d5: scripts/security/build-perl-security-packages.sh is now part of BASE_IMAGE_INPUT_PATHS, so dirty-state, committed-divergence, and resolution-key checks track the Perl builder. Added a committed builder-only regression test. Verification: npx vitest run --project cli src/lib/sandbox-base-image/source-identity.test.ts src/lib/sandbox-base-image-resolution.test.ts (59/59 passed); commit and pre-push hooks passed.