build: refresh October security pins and trust stores

.github/workflows/codeql-verification.yml

@@ -38,10 +38,10 @@ jobs:
           set -euo pipefail
           test -z "$(git status --porcelain)"
           git merge-base --is-ancestor 73e3a7c5f438dbda42c4078885a66e6f156aa731 HEAD
-          grep -Fq 'VERSION_OVERRIDE: v0.13.31' .github/workflows/validate.yml
+          grep -Fq 'VERSION_OVERRIDE: v0.13.32' .github/workflows/validate.yml
           grep -Fq 'SHA256SUMS' scripts/package
           grep -Fq 'bash scripts/verify-package "$linux_asset"' .github/workflows/validate.yml
-          grep -Fq 'bash scripts/verify-package dist/artifacts/node-agent-0.13.31.tar.gz' .github/workflows/security-release-gate.yml
+          grep -Fq 'bash scripts/verify-package dist/artifacts/node-agent-0.13.32.tar.gz' .github/workflows/security-release-gate.yml
 
       - name: Install the release Go toolchain
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -68,7 +68,7 @@ jobs:
           export GOFLAGS=-mod=vendor
           mkdir -p "$GITHUB_WORKSPACE/bin"
           CGO_ENABLED=0 go build -trimpath -tags 'netgo osusergo' \
-            -ldflags='-w -s -X main.VERSION=v0.13.31' \
+            -ldflags='-w -s -X main.VERSION=v0.13.32' \
             -o "$GITHUB_WORKSPACE/bin/node-agent" ./
 
       - name: Analyze without publishing temporary alerts

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Publish verified immutable runtime
+on:
+  workflow_dispatch:
+    inputs:
+      producer_run:
+        description: Successful exact-source security gate run
+        required: true
+        type: string
+permissions:
+  contents: write
+  actions: read
+  packages: write
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      GH_TOKEN: ${{ github.token }}
+      PRODUCER_RUN: ${{ inputs.producer_run }}
+      RELEASE_TAG: v0.13.32
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: v0.13.32
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Verify immutable tag and successful producer
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$PRODUCER_RUN" =~ ^[0-9]+$ ]]
+          test "$(git cat-file -t "refs/tags/$RELEASE_TAG")" = tag
+          test "$(git rev-parse HEAD)" = "$(git rev-parse "refs/tags/$RELEASE_TAG^{}")"
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$PRODUCER_RUN" > "$RUNNER_TEMP/producer.json"
+          jq -e '.status == "completed" and .conclusion == "success" and .path == ".github/workflows/security-release-gate.yml"' "$RUNNER_TEMP/producer.json"
+          source=$(jq -r .head_sha "$RUNNER_TEMP/producer.json")
+          [[ "$source" =~ ^[0-9a-f]{40}$ ]]
+          tree=$(gh api "repos/$GITHUB_REPOSITORY/commits/$source" --jq .commit.tree.sha)
+          test "$tree" = "$(git rev-parse 'HEAD^{tree}')"
+          gh run download "$PRODUCER_RUN" --repo "$GITHUB_REPOSITORY" --name "security-runtime-$source" --dir dist/security-runtime
+          test "$(cat dist/security-runtime/source-revision.txt)" = "$source"
+          (cd dist/security-runtime && sha256sum --check SHA256SUMS)
+      - name: Publish exact scanned image and release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          gzip -dc dist/security-runtime/images.tar.gz | docker load
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+          trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT
+          source_image='pasturestack/node-agent:v0.13.32'
+          remote_image="ghcr.io/pasturestack/node-agent:$RELEASE_TAG"
+          if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then
+            echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1
+          else
+            grep -Eq 'manifest unknown|no such manifest' "$RUNNER_TEMP/manifest-error"
+          fi
+          docker tag "$source_image" "$remote_image"
+          docker push "$remote_image" | tee "$RUNNER_TEMP/push-log"
+          pushed=$(awk '/digest: sha256:/{for(i=1;i<=NF;i++) if($i=="digest:") print $(i+1)}' "$RUNNER_TEMP/push-log")
+          readback=$(docker buildx imagetools inspect "$remote_image" | awk '$1=="Digest:"{print $2; exit}')
+          test "$pushed" = "$readback"
+          [[ "$readback" =~ ^sha256:[0-9a-f]{64}$ ]]
+          source=$(cat dist/security-runtime/source-revision.txt)
+          jq -n --arg image "$remote_image" --arg digest "$readback" --arg source "$source" '{image:$image,digest:$digest,source:$source}' > dist/security-runtime/registry-images.json
+          gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$GITHUB_REPOSITORY $RELEASE_TAG" --notes "Exact tested and scanned producer $source, run $PRODUCER_RUN. The immutable release tag has the same source tree. No deployment." dist/security-runtime/*

.github/workflows/security-release-gate.yml

@@ -19,9 +19,9 @@ jobs:
     timeout-minutes: 120
     env:
       DAPPER_IMAGE: pasturestack/node-agent-dapper:${{ github.sha }}
-      RUNTIME_IMAGE: pasturestack/node-agent:v0.13.31
+      RUNTIME_IMAGE: pasturestack/node-agent:v0.13.32
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: v0.13.31
+      VERSION_OVERRIDE: v0.13.32
     steps:
       - name: Check out candidate
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -50,25 +50,25 @@ jobs:
           set -euo pipefail
           CROSS=1 VERSION_OVERRIDE="$VERSION_OVERRIDE" make DAPPER_IMAGE="$DAPPER_IMAGE" ci
           make DAPPER_IMAGE="$DAPPER_IMAGE" IMAGE_NAME=pasturestack/node-agent \
-            TAG=v0.13.31 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image
-          test -s dist/artifacts/node-agent-0.13.31.tar.gz
-          test -s dist/artifacts/node-agent-0.13.31-windows-amd64.zip
+            TAG=v0.13.32 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image
+          test -s dist/artifacts/node-agent-0.13.32.tar.gz
+          test -s dist/artifacts/node-agent-0.13.32-windows-amd64.zip
           test "$(cat dist/image)" = "$RUNTIME_IMAGE"
-          gzip -t dist/artifacts/node-agent-0.13.31.tar.gz
-          bash scripts/verify-package dist/artifacts/node-agent-0.13.31.tar.gz
-          unzip -t dist/artifacts/node-agent-0.13.31-windows-amd64.zip
+          gzip -t dist/artifacts/node-agent-0.13.32.tar.gz
+          bash scripts/verify-package dist/artifacts/node-agent-0.13.32.tar.gz
+          unzip -t dist/artifacts/node-agent-0.13.32-windows-amd64.zip
           (
             cd dist/artifacts
-            sha256sum node-agent-0.13.31.tar.gz node-agent-0.13.31-windows-amd64.zip > SHA256SUMS
+            sha256sum node-agent-0.13.32.tar.gz node-agent-0.13.32-windows-amd64.zip > SHA256SUMS
             sha256sum -c SHA256SUMS
           )
-          sha256sum dist/artifacts/node-agent-0.13.31.tar.gz \
-            dist/artifacts/node-agent-0.13.31-windows-amd64.zip \
+          sha256sum dist/artifacts/node-agent-0.13.32.tar.gz \
+            dist/artifacts/node-agent-0.13.32-windows-amd64.zip \
             bin/node-agent bin/windows/amd64/node-agent.exe > evidence/product-artifacts.sha256
           docker image inspect "$RUNTIME_IMAGE" > evidence/runtime-image-inspect.json
           docker run --rm --entrypoint /usr/bin/node-agent "$RUNTIME_IMAGE" --version \
             > evidence/runtime-version.txt
-          grep -Fxq 'node-agent version v0.13.31' evidence/runtime-version.txt
+          grep -Fxq 'node-agent version v0.13.32' evidence/runtime-version.txt
 
       - name: Verify reproducible Linux binary
         shell: bash
@@ -118,8 +118,16 @@ jobs:
             --output /work/evidence/runtime-security.json "$RUNTIME_IMAGE"
           docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
             -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
-            --skip-db-update --offline-scan --scanners vuln,secret --format json \
-            --output /work/evidence/dapper-security.json "$DAPPER_IMAGE"
+            --skip-db-update --offline-scan --scanners vuln,secret --list-all-pkgs --format json \
+            --output /work/evidence/dapper-security-raw.json "$DAPPER_IMAGE"
+          docker run --rm --entrypoint python3 "$DAPPER_IMAGE" \
+            /opt/python-security/scripts/check-pip-vendor-slice.py \
+            > evidence/pip-vendor-proof.json
+          python3 scripts/pip-security/test-pip-vex.py
+          python3 scripts/pip-security/filter-pip-vendor-findings.py \
+            --raw evidence/dapper-security-raw.json --proof evidence/pip-vendor-proof.json \
+            --output evidence/dapper-security.json --vex evidence/pip-vendor.openvex.json \
+            --subject "$(docker image inspect --format '{{.Id}}' "$DAPPER_IMAGE")"
           docker run --rm --entrypoint sh "$DAPPER_IMAGE" -lc \
             "printf 'package\\tversion\\n'; dpkg-query -W -f='\${binary:Package}\\t\${Version}\\n' | LC_ALL=C sort" \
             > evidence/dapper-dpkg.tsv
@@ -243,13 +251,32 @@ jobs:
               print('{}_components={}'.format(scope, len(bom['components'])))
           PY
 
+      - name: Retain exact runtime for immutable release
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p dist/security-runtime
+          docker image inspect "$RUNTIME_IMAGE" > dist/security-runtime/images.json
+          docker save "$RUNTIME_IMAGE" | gzip -n > dist/security-runtime/images.tar.gz
+          cp evidence/runtime-security.json evidence/runtime.cdx.json dist/security-runtime/
+          cp dist/artifacts/node-agent-0.13.32.tar.gz dist/artifacts/node-agent-0.13.32-windows-amd64.zip dist/security-runtime/
+          printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt
+          (cd dist/security-runtime && sha256sum -- * > SHA256SUMS)
+      - name: Upload exact runtime release bytes
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: security-runtime-${{ github.sha }}
+          path: dist/security-runtime/
+          if-no-files-found: error
+          retention-days: 14
+
       - name: Retain exact scanned release packages
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: node-agent-scanned-0.13.31
+          name: node-agent-scanned-0.13.32
           path: |
-            dist/artifacts/node-agent-0.13.31.tar.gz
-            dist/artifacts/node-agent-0.13.31-windows-amd64.zip
+            dist/artifacts/node-agent-0.13.32.tar.gz
+            dist/artifacts/node-agent-0.13.32-windows-amd64.zip
             dist/artifacts/SHA256SUMS
           if-no-files-found: error
           retention-days: 30

.github/workflows/validate.yml

@@ -52,7 +52,7 @@ jobs:
         id: package
         env:
           CROSS: "1"
-          VERSION_OVERRIDE: v0.13.31
+          VERSION_OVERRIDE: v0.13.32
           VALIDATION_SCOPE: ${{ inputs.validation_scope || 'full' }}
         run: |
           set -euo pipefail
@@ -75,8 +75,8 @@ jobs:
               exit 1
               ;;
           esac
-          linux_asset="dist/artifacts/node-agent-0.13.31.tar.gz"
-          windows_asset="dist/artifacts/node-agent-0.13.31-windows-amd64.zip"
+          linux_asset="dist/artifacts/node-agent-0.13.32.tar.gz"
+          windows_asset="dist/artifacts/node-agent-0.13.32-windows-amd64.zip"
           test -s "$linux_asset"
           test -s "$windows_asset"
           gzip -t "$linux_asset"
@@ -92,8 +92,8 @@ jobs:
           (
             cd dist/artifacts
             sha256sum \
-              node-agent-0.13.31.tar.gz \
-              node-agent-0.13.31-windows-amd64.zip >SHA256SUMS
+              node-agent-0.13.32.tar.gz \
+              node-agent-0.13.32-windows-amd64.zip >SHA256SUMS
             sha256sum -c SHA256SUMS
           )
           printf 'NODE_AGENT_VALIDATION_OK source=%s version=%s scope=%s artifacts=linux,windows\n' \
@@ -102,10 +102,10 @@ jobs:
       - name: Retain reviewed release candidate
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: node-agent-0.13.31
+          name: node-agent-0.13.32
           path: |
-            dist/artifacts/node-agent-0.13.31.tar.gz
-            dist/artifacts/node-agent-0.13.31-windows-amd64.zip
+            dist/artifacts/node-agent-0.13.32.tar.gz
+            dist/artifacts/node-agent-0.13.32-windows-amd64.zip
             dist/artifacts/SHA256SUMS
           if-no-files-found: error
           retention-days: 30

COMPATIBILITY.md

@@ -2,10 +2,10 @@
 
 The node agent preserves established event names, reply payloads, generated client schemas, Docker labels, state fields, registration-script inputs, and storage-driver identifiers consumed by existing deployments.
 
-## Linux Host API producer in 0.13.31
+## Linux Host API producer in 0.13.32
 
-The source package version is `0.13.31`. Its Linux supervisor requires exactly
-Host API `0.38.7`, installed first through the existing authenticated configcontent
+The source package version is `0.13.32`. Its Linux supervisor requires exactly
+Host API `0.38.8`, installed first through the existing authenticated configcontent
 package sequence. Version mismatch still closes Host API admission without a
 legacy fallback. Fixed producer paths, agent identity forwarding, executable
 ownership checks, parent-bound lifetime, package layout, and both SHA-1 and

Dockerfile.dapper

@@ -17,9 +17,20 @@ ADD --checksum=sha256:6965aafe69e0a49ef34d2e26f8e83d09d1c6037b7e9ee37f19b292a3c6
 ADD --checksum=sha256:51cf418571059831096abd40e0bd5debaa1ae48a6f8d87d9e4e5f7f12aa4db52 https://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl-provider-legacy_3.5.5-1ubuntu3.7_amd64.deb /tmp/openssl-provider-legacy.deb
 ADD --checksum=sha256:0498bc9510149ef06abd6c09b8932e43c5bc71b68634b4b8f84488b2e0a20e82 https://security.ubuntu.com/ubuntu/pool/main/l/linux/linux-libc-dev_7.0.0-38.38_amd64.deb /tmp/linux-libc-dev.deb
 
-ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
-    https://snapshot.ubuntu.com/ubuntu/20260825T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd \
+    https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb \
     /tmp/ca-certificates.deb
+ADD --checksum=sha256:76c12c7936d7a2e898f972b8b40ec74f3b58f1a534e67e256e1aa9d28c6c43d8 https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/libpython3.14_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/libpython3.14.deb
+ADD --checksum=sha256:6f2e99c80311934d0a031bb12fe2faca684b05e5b6bb225fe9a07a5c05fdb3da https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/libpython3.14-dev_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/libpython3.14-dev.deb
+ADD --checksum=sha256:fac6f0728cf9490a7a698e6b343e4140283e92355b060193c04f5770a666df8a https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/libpython3.14-minimal_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/libpython3.14-minimal.deb
+ADD --checksum=sha256:3c267ef0f902f763c3615cbf28dd6fe91d2e4f603075d7f03db99f8d4eb66f46 https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/libpython3.14-stdlib_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/libpython3.14-stdlib.deb
+ADD --checksum=sha256:780c308c47d8afcbb7d339f0023350e7cf60c1a37e9572a1f88774cc18f60526 https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/python3.14_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/python3.14.deb
+ADD --checksum=sha256:5e76e07f9ebb181eda92986297eca3488aaf81f53f0efcfdd32866a409f94071 https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/python3.14-dev_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/python3.14-dev.deb
+ADD --checksum=sha256:9d806b46f6dc429f156c5c53e6e2ec5bfc89302f9a441483b3249211e18e0067 https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/python3.14-gdbm_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/python3.14-gdbm.deb
+ADD --checksum=sha256:0a7ea8a52834f9b3de0f11758924f80f7a6ebcbb4b02a55ba4f457503569f55f https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/python3.14-minimal_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/python3.14-minimal.deb
+ADD --checksum=sha256:cad2456bf3cb57cb18d2c82b48b549e5b4ac6eee9b3e14e65334209387e3d0ae https://security.ubuntu.com/ubuntu/pool/universe/p/python3.14/python3.14-venv_3.14.4-1ubuntu0.2_amd64.deb /opt/python-abi-security/python3.14-venv.deb
+COPY scripts/install-python-abi-security /usr/local/bin/install-python-abi-security
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /opt/pasturestack-ca-certificates.deb
 RUN set -eux; \
     mkdir -p /tmp/ca-bootstrap /etc/ssl/certs; \
     dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap; \
@@ -73,6 +84,12 @@ RUN set -eux; \
         test "$(dpkg-query -W -f='${Version}' "$package")" = "$expected" || exit 1; \
         rm -f "/tmp/${package}.deb"; \
     done && \
+    bash /usr/local/bin/install-python-abi-security && \
+    dpkg -i /opt/pasturestack-ca-certificates.deb && \
+    update-ca-certificates --fresh && \
+    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \
+    test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \
+    rm -f /opt/pasturestack-ca-certificates.deb && \
     rm -rf /var/lib/apt/lists/* && \
     rm -f /usr/bin/pebble && \
     rm -f /bin/sh && ln -s /bin/bash /bin/sh
@@ -82,10 +99,15 @@ RUN git config --system --add safe.directory '*'
 ARG GO_VERSION=1.27.3
 ARG GO_SHA256_amd64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
 ARG GO_SHA256_arm=d6f4e11dd7157030d7ac11c51c8f73201a2db932d593c3106b1da11cc32bfdf8
-ARG PIP_VERSION=26.1.2
 ARG SETUPTOOLS_VERSION=83.0.0
 ARG WHEEL_VERSION=0.47.0
 ARG TOX_VERSION=4.57.2
+COPY scripts/pip-security /opt/python-security/scripts
+RUN python3 /opt/python-security/scripts/build-pip-overlay.py --work /tmp/pip-overlay-build --output /opt/python-security && \
+    rm -rf /tmp/pip-overlay-build
+ADD --checksum=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl /opt/python-security/certifi-2026.10.19-py3-none-any.whl
+COPY scripts/install-python-security-tools /usr/local/bin/install-python-security-tools
+ENV VIRTUALENV_PIP=26.2.2+pasturestack.1 VIRTUALENV_EXTRA_SEARCH_DIR=/usr/share/python-wheels VIRTUALENV_NO_PERIODIC_UPDATE=1
 ENV GOLANG_ARCH_amd64=amd64 GOLANG_ARCH_arm=armv6l GOLANG_ARCH=GOLANG_ARCH_${ARCH} \
     GO_SHA256=GO_SHA256_${ARCH} \
     GOPATH=/go PATH=/opt/tox/bin:/go/bin:/usr/local/go/bin:${PATH} SHELL=/bin/bash \
@@ -95,9 +117,9 @@ RUN curl -fsSL -o /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-${!GOLANG
     echo "${!GO_SHA256}  /tmp/go.tgz" | sha256sum -c - && \
     tar -C /usr/local -xzf /tmp/go.tgz && \
     rm -f /tmp/go.tgz && \
+    bash /usr/local/bin/install-python-security-tools && \
     python3 -m venv /opt/tox && \
     /opt/tox/bin/pip install --no-cache-dir --upgrade \
-        "pip==${PIP_VERSION}" \
         "setuptools==${SETUPTOOLS_VERSION}" \
         "wheel==${WHEEL_VERSION}" \
         "tox==${TOX_VERSION}" && \
@@ -110,6 +132,8 @@ RUN curl -fsSL -o /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-${!GOLANG
     python3 --version && \
     tox --version
 
+RUN PYTHON_SECURITY_VIRTUALENV_PYTHON=/opt/tox/bin/python bash /usr/local/bin/install-python-security-tools
+
 # Resolve the fully pinned test dependency set once while building the disposable
 # build image. Clean source checkouts then run without reaching PyPI.
 COPY tests/requirements.lock /tmp/node-agent-test-requirements.lock