[Security] ssl-cert snakeoil private key baked into standard images (Trivy HIGH) #513

Summary

Trivy flags a HIGH-severity secret in ghcr.io/cloudnative-pg/postgresql:16.14-standard-bookworm:

• File: /etc/ssl/private/ssl-cert-snakeoil.key
• Finding: AsymmetricPrivateKey (private-key) — HIGH
• Added by: RUN |2 PG_VERSION=16.14 PG_MAJOR=16 /bin (during apt install ssl-cert package)

Root Cause

The Debian ssl-cert package generates a self-signed snakeoil certificate during installation. When installed at Docker build time, the private key is baked into the image layer and ships in every container derived from this image.

Impact

• All containers running this image share the same private key — extractable by anyone with pull access
• Trivy, Grype, and Snyk all flag this as HIGH, blocking security-gated CI/CD pipelines

Reproduction

trivy image --ignore-unfixed ghcr.io/cloudnative-pg/postgresql:16.14-standard-bookworm

Output:

/etc/ssl/private/ssl-cert-snakeoil.key (secrets)
Total: 1 (HIGH: 1)
HIGH: AsymmetricPrivateKey (private-key)

Suggested Fix

Remove the snakeoil key after package installation in the Dockerfile:

RUN apt-get install ... &&     rm -f /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/certs/ssl-cert-snakeoil.pem

Or skip the ssl-cert package entirely if it is not required by PostgreSQL.

Affected Images

All PostgreSQL major versions (13–18) on both standard and minimal variants using bookworm and trixie bases.