[Xavier Fournet (xfournet)]

Proposed changes

• Remove ssl_client from the published images, legacy ones included. It is the TLS helper of BusyBox wget (CVE-2025-60876, no fixed version), needed only to download the OpenSSL and Python sources during the build.
• Alpine installs ssl_client automatically next to busybox and libssl3 (install_if), so apk del ssl_client keeps it. The world constraint apk add --no-cache '!ssl_client' purges it, after the last wget download, and keeps it out of later apk add and apk upgrade, including in the images built from these ones.
• As a consequence, BusyBox wget can no longer fetch HTTPS URLs in these images and the images built from them. None of the current consumers uses it: the OpenCTI platform and worker FIPS images and the 16 connector FIPS images only run apk, git and pip.

Related issues

• Closes #59

How to test this PR

• podman build --target python-fips . and --target python-nodejs-fips . succeed, FIPS assertions included; openssl list -providers reports the FIPS provider 3.1.2.
• In both images, apk info -e ssl_client finds nothing, /etc/apk/world holds !ssl_client, and ssl_client stays absent after apk add --no-cache jq.
• The mitre connector's Dockerfile_fips, built on the new python-fips image, installs its requirements (git and pip from GitHub) and imports pycti and connectors_sdk; ssl_client stays absent.
• legacy/Dockerfile_python and legacy/Dockerfile_python_nodejs build; ssl_client is absent and the FIPS provider is listed.

Checklist

• The PR title follows the Conventional Commits convention type(scope?): description (#issue)
• I signed my commits
• This PR is linked to an issue
• I consider the submitted work as finished

🤖 Generated with Claude Code

[Xavier Fournet (xfournet)]

Closing: removing ssl_client does not fix CVE-2025-60876, which sits in the BusyBox wget applet itself, and the '!ssl_client' world constraint would outlive the fix in every image built from these ones. Nothing in these images runs wget on an untrusted URL; the next apk upgrade will pick up Alpine's fix once it ships (alpine/aports#17872).