diff --git a/products/relay-v2/security/advisory-baseline.json b/products/relay-v2/security/advisory-baseline.json index 6ce8b23f6..72040e3ef 100644 --- a/products/relay-v2/security/advisory-baseline.json +++ b/products/relay-v2/security/advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:6b6ac9bdb2dd2fb70ee79206378fe74ae84b1b056ccf2c165fba4e2bd0402144", + "sha256:c36dc82eab1250c2e3fc430589b275d8f66d8e5c0a18fd030873a8cac6a81982", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1" + "definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Relay candidate had no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Relay candidate had no effective vulnerable DNS-printing path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Relay candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.23.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } } ] diff --git a/release/OPERATIONS.md b/release/OPERATIONS.md index f09b039cc..13c87bff5 100644 --- a/release/OPERATIONS.md +++ b/release/OPERATIONS.md @@ -327,7 +327,7 @@ prefix of the candidate's authoritative uncompressed DiffIDs: ```sh baseline=products/relay-v2/security/advisory-baseline.json -# Evidence and Mint use release/security/-advisory-baseline.json. +# Discovery, Evidence, and Mint use release/security/-advisory-baseline.json. jq --slurpfile baseline "${baseline}" -e ' .rootfs.diff_ids[0:($baseline[0].runtime.layer_ids | length)] == $baseline[0].runtime.layer_ids @@ -394,7 +394,14 @@ These are `.rootfs.diff_ids`, not the compressed digests in a manifest's PY ``` -5. Check the edited baseline against the regenerated candidate evidence, then +5. Move the live pins in `release/scripts/test_check_advisory_baselines.py` + forward by hand: `LIVE_REFERENCE_IMAGE_DIGESTS`, + `LIVE_REFERENCE_SOURCE_REVISION`, and `LIVE_REVIEW_EVALUATION_DATE`. That + test restates the reviewed evidence instead of reading it back out of the + baselines, so a renewal that skips this step fails it. A service renewed for + the first time also joins `LIVE_BASELINES`, `LIVE_REFERENCE_PROVENANCE`, and + `LIVE_EXECUTABLES`. +6. Check the edited baseline against the regenerated candidate evidence, then rerun the focused advisory tests and candidate workflow. Never invent a digest or reuse evidence from a different candidate. diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py index 2885295d8..a76c52e9f 100644 --- a/release/scripts/check-gates-inventory.py +++ b/release/scripts/check-gates-inventory.py @@ -641,7 +641,7 @@ "Candidate cleanup exact package allowlist", "release/scripts/cleanup-release-candidates.py", ( - 'CANDIDATE_PACKAGES = (\n # Listing an absent package fails closed, so a candidate name joins this\n # allowlist with the release that first publishes it.\n "evidence-candidate",\n "mint-candidate",\n "relay-candidate",\n)', + 'CANDIDATE_PACKAGES = (\n # Listing an absent package fails closed, so a candidate name joins this\n # allowlist with the release that first publishes it.\n "discovery-candidate",\n "evidence-candidate",\n "mint-candidate",\n "relay-candidate",\n)', 'PUBLIC_PACKAGES = (\n # Retired public names stay denylisted so cleanup can never delete history.', ' "discovery",\n', ' "evidence",\n', diff --git a/release/scripts/cleanup-release-candidates.py b/release/scripts/cleanup-release-candidates.py index 8bbd9a2f2..3924fdbe7 100755 --- a/release/scripts/cleanup-release-candidates.py +++ b/release/scripts/cleanup-release-candidates.py @@ -21,6 +21,7 @@ CANDIDATE_PACKAGES = ( # Listing an absent package fails closed, so a candidate name joins this # allowlist with the release that first publishes it. + "discovery-candidate", "evidence-candidate", "mint-candidate", "relay-candidate", diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index f923df5af..8e783b267 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -20,27 +20,31 @@ CHECKER = Path(__file__).with_name("check-advisory-baselines.py") LIVE_BASELINES = ( ROOT / "products/relay-v2/security/advisory-baseline.json", + ROOT / "release/security/discovery-advisory-baseline.json", ROOT / "release/security/evidence-advisory-baseline.json", ROOT / "release/security/mint-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "relay": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "evidence": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "mint": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", + "relay": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "discovery": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "evidence": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "mint": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", } -LIVE_REFERENCE_SOURCE_REVISION = "5c4e28578cf3c632faca77bf9d81cd18e95c635f" +LIVE_REFERENCE_SOURCE_REVISION = "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest # exception. Move it forward by hand when the baselines are renewed. -LIVE_REVIEW_EVALUATION_DATE = "2026-08-20" +LIVE_REVIEW_EVALUATION_DATE = "2026-08-22" LIVE_REFERENCE_PROVENANCE = { "relay": "official_candidate", + "discovery": "official_candidate", "evidence": "official_candidate", "mint": "official_candidate", } LIVE_EXECUTABLES = { "relay": "/usr/local/bin/relay", + "discovery": "/usr/local/bin/discovery", "evidence": "/usr/local/bin/evidence", "mint": "/usr/local/bin/mint", } diff --git a/release/scripts/test_cleanup_release_candidates.py b/release/scripts/test_cleanup_release_candidates.py index de03d5592..4ea9b73b0 100644 --- a/release/scripts/test_cleanup_release_candidates.py +++ b/release/scripts/test_cleanup_release_candidates.py @@ -70,6 +70,7 @@ def test_dry_run_uses_server_time_and_does_not_delete(self) -> None: def test_apply_deletes_expired_versions_from_all_candidates(self) -> None: client = FakeClient( { + "discovery-candidate": [version(6, "2026-07-03T00:00:00Z")], "evidence-candidate": [version(4, "2026-07-03T00:00:00Z")], "mint-candidate": [version(5, "2026-07-03T00:00:00Z")], "relay-candidate": [version(3, "2026-07-03T00:00:00Z")], @@ -83,6 +84,7 @@ def test_apply_deletes_expired_versions_from_all_candidates(self) -> None: ) self.assertEqual( [ + ("discovery-candidate", 6), ("evidence-candidate", 4), ("mint-candidate", 5), ("relay-candidate", 3), diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json new file mode 100644 index 000000000..ed9e6929e --- /dev/null +++ b/release/security/discovery-advisory-baseline.json @@ -0,0 +1,295 @@ +{ + "version": 4, + "service": "discovery", + "runtime": { + "image": "gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775", + "layer_ids": [ + "sha256:50abe06dfc0957e14cb8332ed242e8b884ef2563a9eb202e5172f243f62792f7", + "sha256:621c35e751a51a9a9dc3e80aa0b7fe8be2a93402ea6ccd307d30852cd7776cda", + "sha256:c8b007d0206e4b10ed4d3b3d99dfeab47c2648e82011989fd78a5731baf33fc3", + "sha256:bec7e6bb35e05d1284f28b10d2150c259717d91c658c4c10c08424bb9466caba", + "sha256:275a30dd8ce958b21daa9ad962c6fbc09f98306ee2f486b65c9075dc257b1412", + "sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368", + "sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc", + "sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4", + "sha256:bd3cdfae1d3fdd83a2231d608969b38b82349777c2fff9a7c12d54f8ac5c9b38", + "sha256:4cde6b0bb6f50a5f255eef7b2a42162c661cf776b803225dcac9a659e396bb6b", + "sha256:ad51d0769d16ba578106a177987dfe3d2e02c1668c852b795b2f6b024068242a", + "sha256:187cfc6d1e3e8a40a5e64653bcd3239c140807dcf1c09e48021178705a5a6139", + "sha256:5fd2536c39c0700be8b7b4344e375196da2f126842fd8ede66996a18860a3890", + "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", + "sha256:c0e409312adc366898967307565f692bb33d43a439d3de48e27d14b742389725", + "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", + "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", + "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", + "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", + "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" + ], + "application_layer_ids": [ + "sha256:9c34752fe979137e4188319f1dc04e4715dade650f03f355b73fec697ee393ad" + ], + "config": { + "user": "65532", + "entrypoint": ["/usr/local/bin/discovery"], + "command": ["--runtime", "/etc/registry-discovery/runtime.yaml"], + "working_dir": "/home/nonroot", + "environment": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" + ], + "healthcheck": null, + "args_escaped": true, + "exposed_ports": ["8080/tcp"], + "stop_signal": "" + }, + "definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099" + }, + "policies": [ + { + "tool": "zizmor", + "minimum_severity": "high", + "action": "block_unreviewed" + }, + { + "tool": "grype", + "minimum_severity": "high", + "action": "block_unreviewed", + "block_fixable": true + } + ], + "exceptions": [ + { + "vulnerability_id": "CVE-2026-5450", + "package": "libc6", + "installed_version": "2.41-12+deb13u3", + "severity": "Critical", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate reaches no scanf-family function at all: the reviewed binary imports none of the glibc scanf entry points, including the __isoc23_ aliases, and embeds no scanf symbol name to resolve dynamically, so no vulnerable allocating-character scanf path exists in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + }, + { + "vulnerability_id": "CVE-2026-5928", + "package": "libc6", + "installed_version": "2.41-12+deb13u3", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + }, + { + "vulnerability_id": "CVE-2026-5435", + "package": "libc6", + "installed_version": "2.41-12+deb13u3", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Discovery candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports no glibc resolver symbol at all. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + }, + { + "vulnerability_id": "CVE-2026-14456", + "package": "libssl3t64", + "installed_version": "3.5.6-1~deb13u2", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Discovery candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and links no TLS stack of any kind, serving its immutable index in plaintext behind the deployment's own terminator. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + } + ] +} diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index 7daa82980..f93afc597 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:47baa51099a97968c6231fc8683726d0f97535dad203a8a6333f73a12f55e1c2", + "sha256:07112d7cf9758545d376842d3da2b43045cda4c019650ca959637033e630a5af", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd" + "definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc" }, "policies": [ { @@ -68,8 +68,8 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } }, { @@ -126,8 +126,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } }, { @@ -184,8 +184,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.23.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } }, { @@ -242,8 +242,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.23.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } } ] diff --git a/release/security/mint-advisory-baseline.json b/release/security/mint-advisory-baseline.json index 8f5cb8bbc..869d8850e 100644 --- a/release/security/mint-advisory-baseline.json +++ b/release/security/mint-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:3a58a738ee6e4801e9a00cedd52e516b3c525684569264bf3b1c973cf3217a62", + "sha256:87f6c179626b6c3bc64dc1c2e754850958b83442e28caa552753866c7320e692", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8081/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337" + "definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1" }, "policies": [ { @@ -68,8 +68,8 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } }, { @@ -126,8 +126,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } }, { @@ -184,8 +184,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.23.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } }, { @@ -242,8 +242,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.23.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } } ]