GeezerVison

…3179)

## Summary

Work for #13178. **Draft for infrastructure/security review; do not
merge pending risk acceptance and image-scan validation.**

NOFOs deployments and API/analytics scans are failing on CVE-2026-116566
in the Python 3.14.10 binary. This proposes a temporary exception to
restore deployment capability while a supported patch is awaited. It
does not fix the Python vulnerability. The Python 3.14 backport remains
open as of November 5, 2026:
python/cpython#160926.

## Changes proposed

- Add one Grype ignore rule limited to **CVE-2026-116566 + package
`python` + version `3.14.10` + type `binary`**.
- Preserve the Medium cutoff, every existing ignore rule, the Low
finding CVE-2026-103995, other scanner policies and weekly bypass-ignore
reporting.
- Keep vulnerability-specific scope, review questions, the proposed
November 12 review date, and removal tracking in this PR, #13178, and
the Grype configuration. Following reviewer feedback, no durable
documentation pages are changed.

## Context for reviewers

**Requested review:** Please confirm shared-service scope, risk
acceptance, tracking ownership, and image-scan validation before this
draft is ready.

This root configuration is consumed by NOFOs and the shared
API/analytics/frontend scan workflow. The proposal applies to any
matching package across those consumers; it is not NOFO-only. Confirmed
failures and workflow scope are recorded in #13178. The inspected
frontend scan passed, but any matching package there would also be
suppressed.

**Risks and unresolved items:** Python remains vulnerable. Application
exploitability and compensating controls have not been established for
the three Python services. No owner or risk approver has been assigned;
both must be recorded before merge. The November 12 date is proposed and
not machine-enforced; the owner needs active follow-up and must refresh
stale dates. Low prediction scores and functional tests are not proof of
safety.

**Removal:** prefer supported patched runtime images as soon as
available. Rebuild the shared API/analytics Python base and update
consumers; update Builder's separate image; verify unsuppressed scans,
then remove applicable exceptions. Keep #13178 open for this follow-up.
A package version change will stop this exact-version rule matching
automatically, but must not be treated as proof that the new runtime is
patched.

This SGG-only PR does not change Builder's own `.grype.yml` or unblock
Builder's standalone scans. Any matching Builder exception needs
separate scope/approval. Builder documentation PR
HHS/simpler-grants-pdf-builder#1283 is guidance only. Check the workflow
checkout revision before retrying older immutable deployment refs.

## Validation steps

Completed locally:
- Parsed YAML and compared against main: exactly one new CVE rule; exact
package/version/type constraints verified; existing ignore entries and
severity cutoff unchanged.
- Confirmed Grype v0.97.1 source supports package `name`, `version`, and
`type` and combines rule criteria:
https://github.com/anchore/grype/blob/v0.97.1/grype/match/ignore.go.
- `git diff --check` passed. No application code or workflow logic
changed.

Required before merge (not performed locally; Docker/Grype are
unavailable here):
- [ ] Assign owner and obtain the required shared-service
infrastructure/security risk acceptance; document per-service exposure
assessment and compensating controls.
- [ ] Recheck patch availability and approve a concrete review
date/removal tracking plan.
- [ ] Scan each intended image using the same scanner/DB with and
without the proposed rule; verify only the intended finding moves to
ignored results.
- [ ] Confirm an unrelated Medium finding still fails and other Python
versions/packages are not covered by this rule.
- [ ] Verify weekly bypass-ignore reporting remains unsuppressed;
arrange equivalent NOFO verification without deploying.

Do not trigger a production deployment to validate this draft. PR CI may
produce additional scan evidence, but does not substitute for risk
acceptance.

---------

Co-authored-by: Benjamin Brasso <[email protected]>