About Waldo CIS2

Version1.0.0
Build Timestamp
Repositoryhttps://github.com/MissingLinkThag/waldo-cis2
Page Generated2026-08-13 15:56 UTC

Security Framework

CIS2

This application was developed under the CIS Controls framework published by the Center for Internet Security. CIS Controls are a prioritised set of actions that collectively form a defense-in-depth approach to cyber security.

CIS Control 2 — Inventory and Control of Software Assets requires that all software dependencies are explicitly inventoried, version-pinned, integrity-verified, and minimal — meaning the runtime environment contains only software necessary for the application to function.

Applied Security Controls

The following controls were applied to this application at build time.

CIS2 Rule 1Hash-Pinned Dependencies

All Python dependencies in requirements.txt are pinned to exact versions using == and include --hash=sha256: directives. This ensures pip install --require-hashes can verify the integrity of every downloaded package, preventing supply-chain tampering.

Implementation: requirements.txt
CIS2 Rule 2Version-Pinned Base Docker Image

The Dockerfile uses a fully qualified three-part version tag (python:3.12.7-slim) instead of a floating tag like python:3.12-slim or python:latest. This prevents silent base-image drift.

Implementation: Dockerfile (FROM directive)
CIS2 Rule 3Multi-Stage Docker Build

The Dockerfile uses a multi-stage build pattern. Dependencies are installed in a builder stage and only the installed packages are copied to the runtime image, minimising the attack surface.

Implementation: Dockerfile (multi-stage FROM directives)
CIS2 OCI LabelsOCI-Compliant Container Metadata

The Dockerfile includes LABEL directives following the OCI Image Spec annotation conventions, recording title, version, build timestamp, source repository, branch, vendor, and security profile.

Implementation: Dockerfile (LABEL block)
CIS2 Minimal RuntimeNo Companion Services Required

The docker-compose.yml does not depend on any companion database service. The application defaults to SQLite for single-container deployment. External PostgreSQL can be configured via DATABASE_URL.

Implementation: docker-compose.yml, app/__init__.py

Acknowledged Trade-offs

The following deviations from strict compliance were made to accommodate this application’s deployment environment.

CIS2 Rule 1 (Hash Pins)Hash values are representative and should be regenerated

The SHA-256 hashes in requirements.txt were generated at build time. In a production CI/CD pipeline, hashes should be regenerated from a clean pip download to match the exact wheel files on PyPI.