chore(base): Debian bookworm → trixie (system Python 3.11 → 3.13) - #133
Merged
Conversation
Debian 12 bookworm's regular security support ended 2026-07-12 and it is now on community LTS only. Trixie (Debian 13) is current stable. Follows #131 (Go 1.26 + Node 24); together these refresh every pinned toolchain. Two apt packages were RENAMED in trixie and would have failed the build: - libpango1.0-0 -> libpango-1.0-0 (base image apt list) - libgdk-pixbuf2.0-dev -> libgdk-pixbuf-2.0-dev (all six agent generators) Note libpango1.0-dev and libcairo2-dev keep their old-style names in trixie and are deliberately unchanged. All 26 apt-installed packages across the base image and the six agent generators were verified present in trixie via Debian's madison API, not spot-checked. --pull is added to the BASE image build so debian:trixie-slim re-resolves to the current digest on rebuild -- the same HF-incident Issue 3 rationale the proxy build already uses. Deliberately NOT added to the agent, skills, or per-project builds: those build FROM a LOCAL sandy-base image, and --pull would attempt a registry fetch and fail. Python 3.11 -> 3.13 has one user-visible consequence: PYTHONUSERBASE stores packages under lib/python3.<minor>, so persistent 'pip install --user' trees from the 3.11 image are invisible to 3.13. user-setup.sh now detects a mismatched tree and prints a warn-only notice with the path and the cleanup command -- matching the existing environment-drift warnings (broken .venv symlink, foreign native modules), which likewise warn rather than auto-fix, since silently deleting a user's installed packages is the wrong default. SANDY_SANDBOX_MIN_COMPAT is deliberately NOT moved: the sandbox still works, so this is not a compat-floor event (the 1.x forward-compat promise caps it at 1.0.0 anyway, guarded by run-tests.sh §60). Existing sandboxes need no recreation. The .venv overlay is unaffected -- it uses uv-managed interpreters, independent of the container's system python3. PEP 668 is already neutralized via PIP_BREAK_SYSTEM_PACKAGES=1. Docs synced: README, CLAUDE.md (incl. a new Automatic Environment Detection bullet), SPECIFICATION.md (Appendix A verbatim copy + Appendix B table), and a stale 'Debian bookworm' reference in docs/security/nono-roadmap.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rappdw
added a commit
that referenced
this pull request
Aug 12, 2026
…136) Base-image modernization plus two additive features and a LAN-allowlist fix. Every pinned toolchain was on an unsupported or maintenance-only release: - Debian 12 bookworm left regular security support 2026-07-12 -> trixie (13), which brings system Python 3.11 -> 3.13. (#133) - Go 1.24 left its two-release support window entirely, and the pin was a Mar-2025 patch untouched for 16 months -> 1.26, with the newest patch now resolved at build time instead of frozen. The egress proxy's documented monthly --pull refresh had been silently no-op since ~Feb 2026 (no further 1.24.x pushes existed), so it was refreshing Debian but not the Go stdlib implementing its TLS/HTTP/CONNECT I/O; pinning a supported minor restores it. Node 22 (Maintenance LTS) -> 24 (Active LTS). (#131) - SANDY_EFFORT pins Claude Code reasoning effort and records it in the session marker, so a run's effort is provable rather than inferred. (#115) - SANDY_SESSION_NONCE lets an operator pin the attestation nonce so a harness can prove a run is the one it launched; env-only, so a committed workspace config cannot set it. (#118) - SANDY_ALLOW_LAN_HOSTS no longer reports success when iptables rejected the rule — a silently missing hole is the worst direction to be wrong in. (#119) Additive minor per the CLAUDE.md semver rule: new keys, no retiering or renames, introspection schema_version stays 1. SANDY_SANDBOX_MIN_COMPAT stays 0.7.10 — the Python bump moves where pip --user packages live, but the sandbox still works, so this is not a compat-floor event and no sandbox needs recreating. Four user-visible upgrade consequences are documented at the top of RELEASE_NOTES.md: the first launch rebuilds every image; persistent pip --user packages become invisible to 3.13 (sandy now detects and reports the stale tree); native Node addons may need npm rebuild; and binaries built inside sandy now link glibc 2.41. Also lands the test-suite work: three macOS-only failures CI structurally cannot see (#134) — including §68 executing the real sandy binary via a backtick inside a double-quoted python3 -c string — and per-section timing, section selection, a fast-model pin, and an image warm-up preflight for the integration suite (#135). Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Debian 12 (bookworm) regular security support ended 2026-07-12 and is now on community LTS only; trixie (Debian 13) is current stable. This is PR-2 of the toolchain refresh, following #131 (Go 1.26 + Node 24).
The part that would have silently broken the build
Two packages were renamed in trixie:
libpango1.0-0libpango-1.0-0(base image apt list)libgdk-pixbuf2.0-devlibgdk-pixbuf-2.0-dev(all six agent generators)libpango1.0-devandlibcairo2-devkeep their old-style names in trixie and are deliberately untouched — the rename is not uniform, which is exactly why this was verified rather than assumed.All 26 apt-installed packages across the base image and the six agent generators were checked against Debian's madison API for trixie — not spot-checked. Every one resolves (
python3→ 3.13.5,tmux→ 3.5a,libpango-1.0-0→ 1.56.3).--pullplacementAdded to the base build so
debian:trixie-slimre-resolves to the current digest on rebuild — the same HF-incident Issue 3 rationale the proxy build already uses.Deliberately not added to the agent, skills, or per-project builds: those build
FROM sandy-base, a local image, and--pullwould attempt a registry fetch and fail. Verified per-invocation —--pullappears on exactly the two builds whoseFROMis a registry image.Python 3.11 → 3.13: one user-visible consequence
PYTHONUSERBASEstores packages underlib/python3.<minor>/, so persistentpip install --usertrees from the 3.11 image become invisible to 3.13 — packages appear to vanish.user-setup.shnow detects a mismatched tree and prints a warn-only notice with the old path and the cleanup command.Warn-only is deliberate and consistent with the existing environment-drift warnings (broken
.venvsymlink, foreign native modules, venv-overlay drift) — all of which warn rather than auto-fix, because silently deleting a user's installed packages is the wrong default.Not affected: the
.venvoverlay (uses uv-managed interpreters, independent of systempython3), and PEP 668 (already neutralized viaPIP_BREAK_SYSTEM_PACKAGES=1).Compat
SANDY_SANDBOX_MIN_COMPATis not moved. The sandbox still works, so this is not a compat-floor event — and the 1.x forward-compat promise caps it at1.0.0regardless (guarded byrun-tests.sh§60). Existing sandboxes need no recreation.Verification (static — no Docker in the authoring environment)
bash -n sandy;regen-template.sh --check;regen-config-docs.sh --check— all passshellcheck0.10.0 run againsttemplates/user-setup.sh.tmpl— clean, exit 0 (CI fails on any new warning, so this was fetched specifically to close that gap)set -e(active in user-setup.sh): every statement is an assignment, anifcondition, or||-guarded, so it cannot abort session setup;PYTHONUSERBASEis exported well before it, so the path can never degrade to/lib; the no-match glob case is guardedSANDY_ALLOW_LAN_HOSTS), docs(security): nono comparison + exploration roadmap (links to #12 / #121) #120, or chore(base): Go 1.24.1 → 1.26 (build-time patch resolve), Node 22 → 24 #131 — the full removal list is only this PR's intentWhat CI will NOT prove (maintainer checklist)
sandy-claude-codeonly, so Playwright'sinstall-depson trixie is unproven. Worth oneSANDY_SKILL_PACKS=gstackbuild.npm-global/mount may neednpm rebuild(carried over from chore(base): Go 1.24.1 → 1.26 (build-time patch resolve), Node 22 → 24 #131).🤖 Generated with Claude Code