chore: fix security vulns

[0xawaz]

No description provided.

[aquint-zama]

lgtm (you could use shellcheck when adding shell to check for issues, here some double quotes are asked but seems gtg)

[chilcano]

I've scanned the fhevm-backend repo and it has 22 vulns reported by Trivy.

• 15 vulns in the code base (rust, golang, etc.)
• 7 misconfig all Dockerfiles
  • 3 misconfigs are about non-root user -> I added it to Trivy Ignore File till 2025-03-01 where they should be fixed.
  • 4 misconfig are about HEALTHCHECK -> I added it to Trivy Ignore File.

I've scanned the zama-ai/fhevm-db-migration:latest docker image and Trivy found over 3000 vulns. Like fhevm-backend repo I created its corresponding trivyignorefile.img.fhevm-db-migration.yaml and added all vulns IDs with LOW score, and other misconfis; now Trivy detected 2839 vulns.

You can update both trivy ignore files:

• trivyignorefile.repo.fhevm-backend.yaml
• trivyignorefile.img.fhevm-db-migration.yaml

My recommendation is reduce as low as possible the vulns found in docker image because it has too much.
The good new is that many of them come from linux packages installed in the docker base image. If you replace that, then you will get less vulns.

[0xawaz]

My recommendation is reduce as low as possible the vulns found in docker image because it has too much.
The good new is that many of them come from linux packages installed in the docker base image. If you replace that, then you will get less vulns.

@chilcano I upgraded rust from 1.74 to 1.83.0-slim which has only low severity vulns according to docker scout.
I also scanned it with trivy, it still shows some high vulns, some are false positive like the private keys, which is installed by cargo and set as format example in some cases.
non-root user is also fixed, I suggest to go with this version at this stage.

[0xawaz]

lgtm (you could use shellcheck when adding shell to check for issues, here some double quotes are asked but seems gtg)

@aquint-zama shellcheck issues are fixed now

[chilcano]

Changes are good.