chore: remove util-linux family, gzip, cracklib from runtime image

[jmromeroes]

Stacks on top of #196 (libgcrypt removal).

What this does

Removes 10 additional RHEL packages that have no runtime consumers, per Ross's feedback (Slack thread):

• util-linux family (7 packages): util-linux, util-linux-core, libblkid, libmount, libsmartcols, libuuid, libfdisk — all reported against the same underlying CVEs by the scanner even though the vuln is in libblkid.
• cracklib chain (3 packages): cracklib, cracklib-dicts, gzip — transitively pulled in by pam (already removed via rpm -e --nodeps in tier 1). Ross rejected the gzip waiver noting gzip could be removed instead.

How this works

openssh declares an RPM file-dep on /sbin/nologin (owned by util-linux), so a straight microdnf remove refuses. We use rpm -e --nodeps to break that declared dep and substitute /sbin/nologin with a symlink to /bin/false — coreutils-single (still in the image) provides /bin/false with identical exit behavior, so any /etc/passwd shell entries referencing nologin still resolve.

The removal happens in this order because the rpm binary dynamically links against libsqlite3, liblzma, libbz2, libarchive (via librpm.so), and transitively libxml2:

1. rpm -e --nodeps for the current tier 1 list (unchanged): gawk libfido2 systemd-libs p11-kit p11-kit-trust libtasn1 pam libpwquality expat
2. microdnf remove for everything the depsolver can cleanly resolve (this step adds cracklib, cracklib-dicts, gzip; removes libxml2/libarchive/sqlite-libs/xz-libs/bzip2-libs/rpm/rpm-libs from this step so rpm stays alive one step longer)
3. rpm -e --nodeps util-linux util-linux-core libblkid libmount libsmartcols libuuid libfdisk (breaks openssh's declared file-dep on /sbin/nologin)
4. ln -sf /bin/false /sbin/nologin
5. rpm -e --nodeps rpm rpm-libs libarchive libxml2 sqlite-libs xz-libs bzip2-libs — rpm has already loaded its libs at process start, so it can remove them from the same transaction

Verification

Static analysis

• Zero linkers for libblkid, libmount, libsmartcols, libuuid, libfdisk, libsqlite3, liblzma, libbz2 across all ELF files in the built image (verified via readelf -d).
• Zero references to gzip or gunzip in start.sh or the IQ Server bundle.
• SQLite query of /var/lib/rpm/rpmdb.sqlite confirms all 16 target packages absent from the Name table — the Sonatype scanner reads this DB to build its inventory.

Full end-to-end runtime test (real license, real APIs)

Started the built image with the sonatype-lc-only.lic license, then exercised the complete IQ Server stack:

Test	Result
License upload via POST /api/v2/product/license	HTTP 200
All 6 healthchecks (DB × 4 subchecks, deadlocks, license, connections, shutdown, work-dir)	All healthy
Docker healthcheck	health=healthy
DB write: create org + application	IDs returned
Policy evaluation of log4j-core@2.14.0	8 CVEs found (incl. log4shell), 10 violations
Multi-ecosystem eval (maven + npm + pypi, 3 components)	23 CVEs, 28 violations
Full scan pipeline — 4-component CycloneDX SBOM	172 policy violations (92 critical, 76 severe, 4 moderate)
HTML report generation	200 OK
PDF report generation (Birt + PDFBox — fonts, XML, streaming)	670 KB, 11 pages
Raw report JSON (Jackson serialization)	52 KB, valid
ssh -V + ssh-keygen -t ed25519	Both work
Git+SSH handshake (github.com)	SSH connection completes
Git+HTTPS	deps intact
Java runtime	Java 25 functional

Log analysis

Full log scan surfaced 25 WARN/ERROR lines. All fall into one of these expected categories, none related to tier 2 removals:

• PDFBox "Using fallback font LiberationSans" — UBI-minimal ships without Times/Helvetica/Courier; LiberationSans is the standard fallback (pre-existing behavior).
• HDS URL not configured — expected in test env.
• Telemetry submit failed — expected in test env (no internet).
• Lucene Vector API warning — Java 25 vs Lucene version compatibility notice.
• RelayRegistrationService startup-order retry — unrelated to package changes.

CVEs eliminated (from open waiver requests)

Package	CVEs
util-linux family (×7)	multiple libblkid/libmount/libsmartcols CVEs
gzip	CVE-2026-41991 (Ross-rejected waiver)

7 REQUESTED waivers for CVE-2026-13595 on the util-linux subpackages have been withdrawn via API (HTTP 204).

Testing done

Built and ran Dockerfile.slim locally via docker build --platform linux/amd64. Same removal pattern applied identically to Dockerfile and Dockerfile.rh.

🤖 Generated with Claude Code

[jmromeroes]

This got auto-closed as merged when I fast-forwarded 's branch to include this commit. Everything ended up on #196. See you there!