fix(ql3): patch Alpine OpenSSL runtime

scripts/ql3-cluster-deployment-audit.cjs

@@ -521,6 +521,10 @@ function assertDockerfile(readFile, root, findings) {
     'node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d';
   const pinnedRuntimeNodeBase =
     'node:24.18.0-alpine3.23@sha256:595398b0081eacda8e1c4c5b97b76cd1020e4d58a8ebcb4843b9bca1e79e7436';
+  const pinnedRuntimeOsPatch =
+    'RUN apk add --no-cache --upgrade \\\n' +
+    '    libcrypto3=3.5.8-r0 \\\n' +
+    '    libssl3=3.5.8-r0';
   const dockerfile = readFile(
     path.join(root, 'deploy/containers/ql3-cluster-control/Dockerfile'),
     'utf8',
@@ -532,6 +536,7 @@ function assertDockerfile(readFile, root, findings) {
     'ql3-cluster-control/runtime-dependencies/package.json',
     'ql3-cluster-control/runtime-dependencies/package-lock.json',
     'FROM runtime-dependency-manifest AS external-dependencies',
+    pinnedRuntimeOsPatch,
     '/opt/qinglong/node_modules/.bin/tsc',
     '-p packages/ql3-runtime-core/tsconfig.json',
     '-p packages/ql3-cluster-postgres/tsconfig.json',
@@ -575,6 +580,14 @@ function assertDockerfile(readFile, root, findings) {
       ),
     );
   }
+  if ((dockerfile.match(/\bapk\b/gu) || []).length !== 1) {
+    findings.push(
+      finding(
+        'QL3_CLUSTER_DOCKERFILE_OS_PATCH_DRIFT',
+        'Cluster control runtime must contain one exact pinned OS patch command',
+      ),
+    );
+  }
   const defaultTsconfig = readJson(
     readFile,
     path.join(
@@ -638,6 +651,7 @@ function assertDockerfile(readFile, root, findings) {
     'node:24.18.0-bookworm-slim',
     'npm ci --ignore-scripts --no-audit --no-fund',
     'npm ci --omit=dev --ignore-scripts --no-audit --no-fund',
+    pinnedRuntimeOsPatch,
     'ql3-cluster-admin/runtime-dependencies/package.json',
     'ql3-cluster-admin/runtime-dependencies/package-lock.json',
     '-p packages/ql3-runtime-core/tsconfig.json',
@@ -672,6 +686,14 @@ function assertDockerfile(readFile, root, findings) {
       ),
     );
   }
+  if ((adminDockerfile.match(/\bapk\b/gu) || []).length !== 1) {
+    findings.push(
+      finding(
+        'QL3_CLUSTER_ADMIN_DOCKERFILE_OS_PATCH_DRIFT',
+        'Cluster admin runtime must contain one exact pinned OS patch command',
+      ),
+    );
+  }
   for (const forbidden of [
     'ARG NODE_IMAGE',
     'FROM ${NODE_IMAGE}',

scripts/ql3-local-image-audit.cjs

@@ -10,6 +10,10 @@ const BUILD_NODE_IMAGE =
   'node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d';
 const RUNTIME_NODE_IMAGE =
   'node:24.18.0-alpine3.23@sha256:595398b0081eacda8e1c4c5b97b76cd1020e4d58a8ebcb4843b9bca1e79e7436';
+const RUNTIME_OS_PATCH =
+  'RUN apk add --no-cache --upgrade \\\n' +
+  '    libcrypto3=3.5.8-r0 \\\n' +
+  '    libssl3=3.5.8-r0';
 const BUILD_DEPENDENCIES = Object.freeze({
   croner: '7.0.8',
   'drizzle-orm': '1.0.0-rc.4',
@@ -204,6 +208,12 @@ function auditDockerfile(contents, findings) {
   ) {
     addFinding(findings, 'NPM_CI_CONTRACT_DRIFT');
   }
+  if (
+    !contents.includes(RUNTIME_OS_PATCH) ||
+    (contents.match(/\bapk\b/gu) || []).length !== 1
+  ) {
+    addFinding(findings, 'RUNTIME_OS_PATCH_DRIFT');
+  }
   if (/\b(?:apt-get|apt|curl|wget)\b|ADD\s+https?:/i.test(contents)) {
     addFinding(findings, 'UNREVIEWED_BUILD_NETWORK_OR_OS_PACKAGE');
   }

scripts/ql3-local-operator-image-audit.cjs

@@ -11,6 +11,10 @@ const BUILD_NODE_IMAGE =
   'node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d';
 const RUNTIME_NODE_IMAGE =
   'node:24.18.0-alpine3.23@sha256:595398b0081eacda8e1c4c5b97b76cd1020e4d58a8ebcb4843b9bca1e79e7436';
+const RUNTIME_OS_PATCH =
+  'RUN apk add --no-cache --upgrade \\\n' +
+  '    libcrypto3=3.5.8-r0 \\\n' +
+  '    libssl3=3.5.8-r0';
 const BUILD_DEPENDENCIES = Object.freeze({
   'drizzle-orm': '1.0.0-rc.4',
   semver: '7.7.4',
@@ -153,6 +157,7 @@ function auditDockerfile(contents, release, findings) {
   const required = [
     `FROM ${BUILD_NODE_IMAGE} AS dependency-manifest`,
     `FROM ${RUNTIME_NODE_IMAGE} AS runtime`,
+    RUNTIME_OS_PATCH,
     'RUN npm ci --ignore-scripts --no-audit --no-fund',
     'RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund',
     `org.opencontainers.image.version="${release.version}"`,
@@ -172,7 +177,8 @@ function auditDockerfile(contents, release, findings) {
   if (
     /(?:^|\n)\s*ARG\s+NODE_IMAGE\b/u.test(contents) ||
     /\b(?:apt-get|apt|curl|wget)\b|ADD\s+https?:/iu.test(contents) ||
-    /^(?:EXPOSE|HEALTHCHECK)\b/gmu.test(contents)
+    /^(?:EXPOSE|HEALTHCHECK)\b/gmu.test(contents) ||
+    (contents.match(/\bapk\b/gu) || []).length !== 1
   ) {
     finding(findings, 'UNREVIEWED_RUNTIME_OR_BUILD_SURFACE');
   }

scripts/ql3-worker-deployment-audit.cjs

@@ -76,6 +76,10 @@ const dockerfile = fs.readFileSync(
   path.join(root, 'deploy/containers/ql3-worker/Dockerfile'),
   'utf8',
 );
+const runtimeOsPatch =
+  'RUN apk add --no-cache --upgrade \\\n' +
+  '    libcrypto3=3.5.8-r0 \\\n' +
+  '    libssl3=3.5.8-r0';
 for (const required of [
   'node:24.18.0-bookworm-slim@sha256:',
   'node:24.18.0-alpine3.23@sha256:595398b0081eacda8e1c4c5b97b76cd1020e4d58a8ebcb4843b9bca1e79e7436',
@@ -90,6 +94,8 @@ for (const required of [
 ]) {
   assert.match(dockerfile, new RegExp(required.replaceAll('/', '\\/')));
 }
+assert.ok(dockerfile.includes(runtimeOsPatch));
+assert.equal((dockerfile.match(/\bapk\b/g) || []).length, 1);
 assert.doesNotMatch(
   dockerfile,
   /packages\/ql3-(?:cluster|local-application|local-sqlite|ai)/,