Publish curated ITWorx_MCP_Hub source from 3237e4d8aec312d63d13b4e80664422a7520b5f9

infrastructure/images/security-bases/ingestion-clamd/Dockerfile

@@ -0,0 +1,9 @@
+FROM clamav/clamav:1.4.6@sha256:a5f03c12a79dbe9f6d8a527b6bb1ea053fa8dd061d3738a26897f055ee2d9303
+ARG SOURCE_DATE_EPOCH
+COPY --chmod=0555 verify-pcre2.sh /usr/local/libexec/itworx-verify-pcre2
+# Alpine 3.24 security database explicitly fixes CVE-2026-103111 in this exact package.
+RUN set -eux; \
+    test "$(cut -d. -f1,2 /etc/alpine-release)" = '3.24'; \
+    apk add --no-cache --upgrade 'pcre2=10.49-r0'; \
+    /usr/local/libexec/itworx-verify-pcre2
+LABEL org.itworx.security-base.pcre2.version="10.49-r0"

infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+# Query the authoritative installed database, never apk-info's verbose display fields.
+version=$(awk -v RS='' '
+{
+    name_count = 0; version_count = 0; selected = 0; package_version = ""
+    count = split($0, lines, "\n")
+    for (i = 1; i <= count; i++) {
+        if (substr(lines[i], 1, 2) == "P:") {
+            name_count++
+            if (lines[i] == "P:pcre2") selected = 1
+        }
+        if (substr(lines[i], 1, 2) == "V:") {
+            version_count++
+            package_version = substr(lines[i], 3)
+        }
+    }
+    if (selected) {
+        matches++
+        if (name_count != 1 || version_count != 1) invalid = 1
+        selected_version = package_version
+    }
+}
+END {
+    if (matches != 1 || invalid || selected_version != "10.49-r0") exit 1
+    print "10.49-r0"
+}
+' /lib/apk/db/installed)
+test "$version" = '10.49-r0'
+clamd --version | grep -Eq '^ClamAV 1\.4\.6(/|$)'