[rmcdaniel]

Part of durable-workflow/.github#295 (CVE-2026-109518: APT follows a redirect on retry, then installs a swapped package as root).

An org-wide inventory of networked APT calls found these sample-app paths with neither fixed apt nor retries off:

Path	Context	Why it wasn't covered
polyglot/laravel/Dockerfile	image build (polyglot validation)	php:8.4-cli, unpinned
polyglot/php_worker/Dockerfile	image build	php:8.4-cli, unpinned
polyglot/rust_worker/Dockerfile (runtime stage)	image build	debian:bookworm-slim, unpinned
ci.yml test, microservice-test; composer-lock-audit.yml; playground-journeys.yml	hosted runner	shivammathur/setup-php can run apt-get (repair/extension paths)
sdk-children.yml	hosted runner	playwright install --with-deps runs sudo apt-get

Change: each of these writes Acquire::Retries "0"; to /etc/apt/apt.conf.d/99-no-retries before its first APT-capable step. That's a RUN line in the images and a step in the jobs. Same pattern as cli#121, waterline#300 and cloud#758.

Already protected and unchanged: the root Dockerfile, .devcontainer/docker/Dockerfile and polyglot/python_worker/Dockerfile. They run the central require-fixed-bookworm-apt.sh guard on parents pinned by digest (php:8.4.27-cli-bookworm@b3e907a1…, which has apt 2.6.2).

Test: new tests/Unit/AptNoRetriesContractTest.php checks two things:

• every workflow job has the no-retries line before its first setup-php or networked-APT step;
• every image stage has that line or the fixed-APT guard before its first apt-get, --with-deps or Brotli install-vendor.sh.

Controls show the checks catch a late or missing line. I ran it locally in composer:2.11.0: 4 tests pass, and it reports all 8 paths above when the fix is reverted. The central qualification_policy.py validate also passes on the changed workflows.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS at 85f66ec (.github#295). Guards precede every setup-php and playwright --with-deps job. The polyglot laravel and php_worker images, and the rust_worker runtime stage, write Acquire::Retries "0"; before their first apt call. The root, devcontainer and python_worker images keep the existing central require-fixed-bookworm-apt.sh on digest-pinned parents. That's the agreed "pin to a fixed parent" alternative, and the new test accepts it. The test fails when the fix is reverted. Note: its Dockerfile list is hard-coded, so add any new Dockerfile to it.