fix(security): clear the util-linux and git-lfs scan alerts (#402)

Strip setuid bits and add an OpenVEX exception for the three util-linux CVEs Debian will not fix in trixie, pin golang.org/x/crypto 0.56.0 and x/net 0.58.0 in the git-lfs build, and build git-lfs with Go 1.27.1.

.vex/README.md

@@ -0,0 +1,38 @@
+# Vulnerability exceptions for the Docker image
+
+This folder holds [OpenVEX](https://openvex.dev) statements for CVEs that
+Docker Scout reports against the image but that the image cannot reach. Each
+statement names the CVE, says why it does not apply, and points at the
+upstream and Debian status so the reason can be checked later.
+
+The statements are used in two places:
+
+- The Docker Scout steps in `.github/workflows/docker-build.yml` pass
+  `vex-location: .vex` together with `vex-author` and `only-vex-affected`, so
+  the scan that feeds the Security tab leaves these CVEs out. Scout ignores
+  statements from authors that are not listed; the default author filter only
+  accepts `*@docker.com`.
+- The `Dockerfile` copies `*.vex.json` into `/var/lib/db/` in the runner
+  stage, so `docker scout cves ghcr.io/raylabshq/gitea-mirror:latest` shows
+  the same result for anyone who scans the published image.
+
+To check locally:
+
+```bash
+docker scout cves --vex-location .vex --vex-author developer@arunavoray.dev \
+  --only-vex-affected ghcr.io/raylabshq/gitea-mirror:latest
+```
+
+## When to remove a statement
+
+Delete the statement once the Debian package it covers is fixed in the base
+image (the CVE disappears from the scan on its own), or once the reasoning no
+longer holds, for example if the image starts running a setuid helper or a
+different user model. Debian's status for a CVE is at
+`https://security-tracker.debian.org/tracker/<CVE>`.
+
+## Current statements
+
+| File | CVEs | Package | Why |
+| --- | --- | --- | --- |
+| `util-linux-mount-nsenter.vex.json` | CVE-2026-78408, CVE-2026-78409, CVE-2026-78410 | util-linux 2.41.5-0+deb13u1 (trixie, no fix planned) | nsenter and setuid mount(8) are never used; the runner stage strips setuid bits and the app runs unprivileged. |

.vex/util-linux-mount-nsenter.vex.json

@@ -0,0 +1,58 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/RayLabsHQ/gitea-mirror/blob/main/.vex/util-linux-mount-nsenter.vex.json",
+  "author": "developer@arunavoray.dev",
+  "role": "Gitea Mirror maintainer",
+  "timestamp": "2026-09-04T01:30:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-78408",
+        "description": "util-linux nsenter --join-cgroup keeps a root-opened cgroup.procs descriptor across namespace and credential changes."
+      },
+      "timestamp": "2026-09-04T01:30:00Z",
+      "products": [
+        { "@id": "pkg:docker/raylabshq/gitea-mirror" },
+        { "@id": "pkg:docker/ghcr.io/raylabshq/gitea-mirror" },
+        { "@id": "pkg:docker/gitea-mirror" },
+        { "@id": "pkg:docker/library/gitea-mirror" }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "nsenter is never run inside this image. The application runs as the unprivileged gitea-mirror user and only executes bun, git and git-lfs. The --join-cgroup path needs a privileged operator to run nsenter against a target, which happens on the host with the host's own nsenter, not with the copy in this container. Debian rates the issue minor and ships no fix for trixie (util-linux 2.41.5-0+deb13u1); the fix is only in unstable (2.42.3-1)."
+    },
+    {
+      "vulnerability": {
+        "name": "CVE-2026-78409",
+        "description": "util-linux mount(8) X-mount.subdir follows intermediate symlinks on Linux 6.15 and later, letting an fstab-authorized user attach a host path."
+      },
+      "timestamp": "2026-09-04T01:30:00Z",
+      "products": [
+        { "@id": "pkg:docker/raylabshq/gitea-mirror" },
+        { "@id": "pkg:docker/ghcr.io/raylabshq/gitea-mirror" },
+        { "@id": "pkg:docker/gitea-mirror" },
+        { "@id": "pkg:docker/library/gitea-mirror" }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "The flaw needs a setuid mount(8) and an fstab entry with X-mount.subdir that authorizes an unprivileged user. The image ships no user-mountable fstab entries, the runner stage strips the setuid and setgid bit from every binary, and the application runs as an unprivileged user that never calls mount. Debian rates the issue minor and ships no fix for trixie."
+    },
+    {
+      "vulnerability": {
+        "name": "CVE-2026-78410",
+        "description": "util-linux mount(8) does not pin the source of a restricted bind mount before the privileged mount, so a user who can replace the source can redirect it."
+      },
+      "timestamp": "2026-09-04T01:30:00Z",
+      "products": [
+        { "@id": "pkg:docker/raylabshq/gitea-mirror" },
+        { "@id": "pkg:docker/ghcr.io/raylabshq/gitea-mirror" },
+        { "@id": "pkg:docker/gitea-mirror" },
+        { "@id": "pkg:docker/library/gitea-mirror" }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "The flaw needs a setuid mount(8) and an fstab bind entry an unprivileged user is allowed to mount. The image ships no such entries, the runner stage strips the setuid and setgid bit from every binary, and the application runs as an unprivileged user that never calls mount. Debian rates the issue minor and ships no fix for trixie."
+    }
+  ]
+}