build(container): minimize build-stage images and reorganize CVE catalog

[josecelano]

Description

Minimize the three foundational Containerfile build stages (chef, tester, gcc) by switching to slimmer base images and removing unnecessary dependencies. Reduces build-image size, installed package inventory, vulnerability exposure, and maintenance burden without weakening build or test coverage.

Changes

• chef stage: rust:trixie → rust:slim-trixie with three demonstrated native deps (curl, libssl-dev, pkg-config). Reduces from 1,662.7 MB / 455 packages / 2,148 findings to 1,067.4 MB / 145 packages / 1,072 findings.
• tester stage: Consolidated APT layer, removed setup-only curl after cargo-nextest installation. Retains only sqlite3, time, and cargo-nextest. Finalizes at 975.9 MB / 123 packages / 1,014 findings.
• gcc stage: gcc:trixie → debian:trixie-slim with only gcc and libc6-dev. Reduces from 1,556.4 MB / 464 packages / 2,165 findings to 274.3 MB / 114 packages / 1,008 findings.
• CVE catalog: Reorganized from flat non-affecting/ folder into impact-context subdirectories (production/, build/) with per-CVE files and updated cross-references.
• Security scans: New consolidated build-images.md scan history for ephemeral build stages. Production release scan refreshed confirming no regression (5 MEDIUM, 0 HIGH, 0 CRITICAL).

Each stage was implemented, validated, and committed independently. Containerized tests passed for every stage.

Related to #1463, #1457

[Copilot]

Pull request overview

This PR reduces the dependency footprint and CVE exposure of the Containerfile build stages (chef, tester, gcc) by switching to slimmer base images and tightening installed APT packages, and it reorganizes the security CVE catalog to separate production-runtime vs build-stage analyses.

Changes:

• Switched chef to rust:slim-trixie with only the minimal native dependencies needed for tool installation/builds.
• Minimized tester by consolidating the APT/tooling install into one layer and removing setup-only curl.
• Replaced gcc:trixie with debian:trixie-slim + minimal compiler headers, and reorganized/expanded security scan & CVE analysis documentation.

Reviewed changes

Copilot reviewed 12 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Containerfile	Minimizes foundational build stages via slimmer base images and reduced APT installs.
project-words.txt	Adds dpkg to the cspell project dictionary.
docs/security/README.md	Updates security documentation pointers for the reorganized CVE catalog.
docs/security/docker/README.md	Documents how to run build-stage security scans and where to record results.
docs/security/docker/scans/README.md	Splits scan reporting between production exposure and build-stage exposure.
docs/security/docker/scans/torrust-tracker.md	Refreshes production image scan history with the post-change verification.
docs/security/docker/scans/build-images.md	Adds consolidated scan history for the chef/tester/gcc build stages.
docs/security/analysis/README.md	Reorganizes the analysis index/process to use production/ and build/ subcatalogs.
docs/security/analysis/build/2026-06-10_containerfile-trixie-cves.md	Updates build-stage triage evidence and references for the new minimized stages.
docs/security/analysis/production/CVE-2026-5435.md	Adds per-CVE production-runtime non-affecting analysis entry.
docs/security/analysis/production/CVE-2026-5450.md	Adds per-CVE production-runtime non-affecting analysis entry.
docs/security/analysis/production/CVE-2026-5928.md	Adds per-CVE production-runtime non-affecting analysis entry.
docs/security/analysis/production/CVE-2026-6238.md	Adds per-CVE production-runtime non-affecting analysis entry.
docs/security/analysis/production/CVE-2026-27171.md	Adds per-CVE production-runtime non-affecting analysis entry.
docs/issues/open/1463-1457-use-rust-slim-builder-image.md	Adds an issue spec capturing the rationale, measurements, and verification steps.
.github/skills/dev/maintenance/catalog-security-vulnerabilities/SKILL.md	Updates the skill to reflect the new CVE catalog structure.
.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md	Updates the scan skill to reflect the new CVE catalog structure.

Comments suppressed due to low confidence (1)

docs/security/analysis/build/2026-06-10_containerfile-trixie-cves.md:3

• The frontmatter date-analyzed is set to 2026-07-20, but this bulk-triage file is explicitly dated 2026-06-10 in its filename and referenced that way elsewhere. Keeping date-analyzed aligned with the filename avoids confusion when grepping/sorting by date; the 2026-07-20 refresh is already captured in the document’s change log.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 18 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

docs/security/analysis/build/2026-06-10_containerfile-trixie-cves.md:4

• The frontmatter date-analyzed is now 2026-07-20, but the filename and changelog indicate the analysis was originally created on 2026-06-10 and later refreshed. To avoid confusion when scanning the catalog by filename/date, consider recording the original analysis date explicitly in frontmatter (or alternatively renaming the file and updating references).

[Copilot]

Pull request overview

Copilot reviewed 13 out of 18 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

docs/security/analysis/build/2026-06-10_containerfile-trixie-cves.md:3

• The file name and changelog indicate this analysis was created on 2026-06-10, but frontmatter date-analyzed was changed to 2026-07-20. That makes it unclear whether date-analyzed means ‘initial analysis’ or ‘last refresh’. Keep date-analyzed aligned with the original analysis date and rely on the changelog for later updates.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 18 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 18 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

docs/security/analysis/build/2026-06-10_containerfile-trixie-cves.md:7

• The file name suggests this is the 2026-06-10 bulk scan/event record, but the frontmatter and body now describe a 2026-07-20 scan (e.g., date-analyzed: 2026-07-20). In docs/security/analysis/README.md the convention for bulk scan/event files is {date}_{source}.md, so this mismatch makes the catalog harder to navigate chronologically. Consider moving this updated analysis into a new file named with the new scan date (and leaving the original 2026-06-10 record intact), then update inbound links accordingly.

[josecelano]

ACK a20ef3b