From 32138125a67c1b971c02ad95f779b1c9da008303 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Sat, 22 Aug 2026 10:00:34 +0200 Subject: [PATCH 1/2] fix(release): renew image advisories for v0.24.0 Bind Discovery, Evidence, Mint, and Relay to the official v0.24.0 Linux AMD64 candidates built from d1a6c7b925faf35dbc5a9f3269991f0d5e722f92, and add the Discovery baseline the candidate workflow has expected since Discovery joined RELEASE_IMAGE_NAMES. Evidence regenerated from the private candidate packages with the scanner versions the candidate workflow pins (syft 1.45.1, grype 0.114.0, crane 0.21.2) and a daemon-backed pull, per release/OPERATIONS.md. The pinned distroless base is still the exact DiffID prefix of every candidate and the four reviewed base libraries are byte-identical to the v0.23.0 review, so only /usr/local/bin/ and the application layer moved. Each rationale was re-verified against the v0.24.0 binaries rather than carried forward, and two are now more precise: - CVE-2026-5450 states the sscanf call sites it relies on. Evidence, Mint, and Relay reach __isoc23_sscanf at exactly two fixed-format call sites, %lu and %lx. Discovery imports no scanf entry point at all. - CVE-2026-5435 names the resolver symbol actually imported, __res_init, instead of describing the path only by absence. CVE-2026-14456 holds for the same reason as before for Evidence, Mint, and Relay: no OpenSSL library is linked or named, and TLS terminates with rustls and aws-lc-rs. Discovery links no TLS stack at all, so its rationale says that instead of claiming a rustls terminator it does not have. expires_at stays 2026-09-03 so renewal does not silently extend the risk-acceptance window. Security-sensitive: these baselines are the release provenance gate that decides whether a candidate may publish with known unfixed advisories. Every exception is accepted_risk over a Debian no-DSA or postponed issue with no fixed Trixie version, and every assertion is re-pinned to the reviewed candidate digest, so a rebuilt or altered image fails closed. release/OPERATIONS.md gains the step this renewal needed and the procedure omitted: the live pins in test_check_advisory_baselines.py restate the reviewed evidence and must be moved forward by hand. Signed-off-by: Jeremi Joslin --- .../relay-v2/security/advisory-baseline.json | 68 ++-- release/OPERATIONS.md | 11 +- .../scripts/test_check_advisory_baselines.py | 14 +- .../security/discovery-advisory-baseline.json | 295 ++++++++++++++++++ .../security/evidence-advisory-baseline.json | 68 ++-- release/security/mint-advisory-baseline.json | 68 ++-- 6 files changed, 415 insertions(+), 109 deletions(-) create mode 100644 release/security/discovery-advisory-baseline.json diff --git a/products/relay-v2/security/advisory-baseline.json b/products/relay-v2/security/advisory-baseline.json index 6ce8b23f6..72040e3ef 100644 --- a/products/relay-v2/security/advisory-baseline.json +++ b/products/relay-v2/security/advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:6b6ac9bdb2dd2fb70ee79206378fe74ae84b1b056ccf2c165fba4e2bd0402144", + "sha256:c36dc82eab1250c2e3fc430589b275d8f66d8e5c0a18fd030873a8cac6a81982", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1" + "definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Relay candidate had no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Relay candidate had no effective vulnerable DNS-printing path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Relay candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.23.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:1b53d7b56025114b448e6a8d613108897641ca9de1299c81e237fa037ed2cce1", + "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:5195ece8083b3641203133e85a78f51728c679cebda50fec24e830df743a4d87" + "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" } ], - "definition_digest": "sha256:ec054e4a5d653ee76f29d9a14ec0d3319a3885025ed932e1e8dda10cda907aeb" + "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" } } ] diff --git a/release/OPERATIONS.md b/release/OPERATIONS.md index f09b039cc..13c87bff5 100644 --- a/release/OPERATIONS.md +++ b/release/OPERATIONS.md @@ -327,7 +327,7 @@ prefix of the candidate's authoritative uncompressed DiffIDs: ```sh baseline=products/relay-v2/security/advisory-baseline.json -# Evidence and Mint use release/security/-advisory-baseline.json. +# Discovery, Evidence, and Mint use release/security/-advisory-baseline.json. jq --slurpfile baseline "${baseline}" -e ' .rootfs.diff_ids[0:($baseline[0].runtime.layer_ids | length)] == $baseline[0].runtime.layer_ids @@ -394,7 +394,14 @@ These are `.rootfs.diff_ids`, not the compressed digests in a manifest's PY ``` -5. Check the edited baseline against the regenerated candidate evidence, then +5. Move the live pins in `release/scripts/test_check_advisory_baselines.py` + forward by hand: `LIVE_REFERENCE_IMAGE_DIGESTS`, + `LIVE_REFERENCE_SOURCE_REVISION`, and `LIVE_REVIEW_EVALUATION_DATE`. That + test restates the reviewed evidence instead of reading it back out of the + baselines, so a renewal that skips this step fails it. A service renewed for + the first time also joins `LIVE_BASELINES`, `LIVE_REFERENCE_PROVENANCE`, and + `LIVE_EXECUTABLES`. +6. Check the edited baseline against the regenerated candidate evidence, then rerun the focused advisory tests and candidate workflow. Never invent a digest or reuse evidence from a different candidate. diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index f923df5af..8e783b267 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -20,27 +20,31 @@ CHECKER = Path(__file__).with_name("check-advisory-baselines.py") LIVE_BASELINES = ( ROOT / "products/relay-v2/security/advisory-baseline.json", + ROOT / "release/security/discovery-advisory-baseline.json", ROOT / "release/security/evidence-advisory-baseline.json", ROOT / "release/security/mint-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "relay": "sha256:bba41cf6d867b319b05282e2e94746cebf6f0bd1dbf7dcc3c1666813f7241847", - "evidence": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "mint": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", + "relay": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", + "discovery": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "evidence": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "mint": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", } -LIVE_REFERENCE_SOURCE_REVISION = "5c4e28578cf3c632faca77bf9d81cd18e95c635f" +LIVE_REFERENCE_SOURCE_REVISION = "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest # exception. Move it forward by hand when the baselines are renewed. -LIVE_REVIEW_EVALUATION_DATE = "2026-08-20" +LIVE_REVIEW_EVALUATION_DATE = "2026-08-22" LIVE_REFERENCE_PROVENANCE = { "relay": "official_candidate", + "discovery": "official_candidate", "evidence": "official_candidate", "mint": "official_candidate", } LIVE_EXECUTABLES = { "relay": "/usr/local/bin/relay", + "discovery": "/usr/local/bin/discovery", "evidence": "/usr/local/bin/evidence", "mint": "/usr/local/bin/mint", } diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json new file mode 100644 index 000000000..ed9e6929e --- /dev/null +++ b/release/security/discovery-advisory-baseline.json @@ -0,0 +1,295 @@ +{ + "version": 4, + "service": "discovery", + "runtime": { + "image": "gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775", + "layer_ids": [ + "sha256:50abe06dfc0957e14cb8332ed242e8b884ef2563a9eb202e5172f243f62792f7", + "sha256:621c35e751a51a9a9dc3e80aa0b7fe8be2a93402ea6ccd307d30852cd7776cda", + "sha256:c8b007d0206e4b10ed4d3b3d99dfeab47c2648e82011989fd78a5731baf33fc3", + "sha256:bec7e6bb35e05d1284f28b10d2150c259717d91c658c4c10c08424bb9466caba", + "sha256:275a30dd8ce958b21daa9ad962c6fbc09f98306ee2f486b65c9075dc257b1412", + "sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368", + "sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc", + "sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4", + "sha256:bd3cdfae1d3fdd83a2231d608969b38b82349777c2fff9a7c12d54f8ac5c9b38", + "sha256:4cde6b0bb6f50a5f255eef7b2a42162c661cf776b803225dcac9a659e396bb6b", + "sha256:ad51d0769d16ba578106a177987dfe3d2e02c1668c852b795b2f6b024068242a", + "sha256:187cfc6d1e3e8a40a5e64653bcd3239c140807dcf1c09e48021178705a5a6139", + "sha256:5fd2536c39c0700be8b7b4344e375196da2f126842fd8ede66996a18860a3890", + "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", + "sha256:c0e409312adc366898967307565f692bb33d43a439d3de48e27d14b742389725", + "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", + "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", + "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", + "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", + "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" + ], + "application_layer_ids": [ + "sha256:9c34752fe979137e4188319f1dc04e4715dade650f03f355b73fec697ee393ad" + ], + "config": { + "user": "65532", + "entrypoint": ["/usr/local/bin/discovery"], + "command": ["--runtime", "/etc/registry-discovery/runtime.yaml"], + "working_dir": "/home/nonroot", + "environment": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" + ], + "healthcheck": null, + "args_escaped": true, + "exposed_ports": ["8080/tcp"], + "stop_signal": "" + }, + "definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099" + }, + "policies": [ + { + "tool": "zizmor", + "minimum_severity": "high", + "action": "block_unreviewed" + }, + { + "tool": "grype", + "minimum_severity": "high", + "action": "block_unreviewed", + "block_fixable": true + } + ], + "exceptions": [ + { + "vulnerability_id": "CVE-2026-5450", + "package": "libc6", + "installed_version": "2.41-12+deb13u3", + "severity": "Critical", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate reaches no scanf-family function at all: the reviewed binary imports none of the glibc scanf entry points, including the __isoc23_ aliases, and embeds no scanf symbol name to resolve dynamically, so no vulnerable allocating-character scanf path exists in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + }, + { + "vulnerability_id": "CVE-2026-5928", + "package": "libc6", + "installed_version": "2.41-12+deb13u3", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + }, + { + "vulnerability_id": "CVE-2026-5435", + "package": "libc6", + "installed_version": "2.41-12+deb13u3", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Discovery candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports no glibc resolver symbol at all. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + }, + { + "vulnerability_id": "CVE-2026-14456", + "package": "libssl3t64", + "installed_version": "3.5.6-1~deb13u2", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Discovery candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and links no TLS stack of any kind, serving its immutable index in plaintext behind the deployment's own terminator. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", + "expires_at": "2026-09-03", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_provenance": "official_candidate", + "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:438c546d8e8cc48496bf3a95f753051afd9db66a629a74e31a9ded71586b56e0" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:fa430b8f298f817a266046af84a77533185ad6fc4406c7d3787b5a0a0c207826" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", + "sha256": "sha256:30c61ab012a4241bed033725a09b61f5fdd3bb7df95ee852d0b096520524c7af" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + } + ], + "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + } + } + ] +} diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index 7daa82980..f93afc597 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:47baa51099a97968c6231fc8683726d0f97535dad203a8a6333f73a12f55e1c2", + "sha256:07112d7cf9758545d376842d3da2b43045cda4c019650ca959637033e630a5af", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd" + "definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc" }, "policies": [ { @@ -68,8 +68,8 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } }, { @@ -126,8 +126,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } }, { @@ -184,8 +184,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.23.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } }, { @@ -242,8 +242,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.23.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:8896bc15dd9e16e6c9fff73c1b42f1b953c27f2bc4e3609f6ff567ee60e41979", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:759e6b9454f28584fc7ac6d506ec56fd3dabd7daf5065080a2007a81feadf3bd", + "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:47c9933ccc406d1d873fe9437ca60e00a1ef78c78e7a3bb571b86a72a273ba9b" + "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" } ], - "definition_digest": "sha256:c6ddf609f7ddcdceab1a778779bb32a323d74fc3e1fe8b357f5053df84fe0b4a" + "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" } } ] diff --git a/release/security/mint-advisory-baseline.json b/release/security/mint-advisory-baseline.json index 8f5cb8bbc..869d8850e 100644 --- a/release/security/mint-advisory-baseline.json +++ b/release/security/mint-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:3a58a738ee6e4801e9a00cedd52e516b3c525684569264bf3b1c973cf3217a62", + "sha256:87f6c179626b6c3bc64dc1c2e754850958b83442e28caa552753866c7320e692", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8081/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337" + "definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1" }, "policies": [ { @@ -68,8 +68,8 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } }, { @@ -126,8 +126,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.23.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } }, { @@ -184,8 +184,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.23.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } }, { @@ -242,8 +242,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.23.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", - "reviewed_at": "2026-08-20", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:94dafa4e93a1864efc1c62ca5e593a5b9f12eddfee71d29aaf4ea68b1f4b5cb5", - "reference_source_revision": "5c4e28578cf3c632faca77bf9d81cd18e95c635f", + "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:9c8c18a72538becb28dab46d8a66259187ceb982272cbd1e6ecc46eae89eb337", + "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:7ff5d48e0c35337501a4680165e90a6e9ea4f6f25c9106cc88094f62d0a7262d" + "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" } ], - "definition_digest": "sha256:3eaccd4fe9d0dfc43f4ae0756748f32052e68bb8ac7c27599c45280daac0de85" + "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" } } ] From a5e339b95e5486a936f21725a4ea71dea892e78b Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Sat, 22 Aug 2026 10:00:34 +0200 Subject: [PATCH 2/2] chore(release): allow discovery-candidate cleanup The discovery-candidate package now exists, so it joins the exact cleanup allowlist and its pinned copy in the gate inventory. Listing an absent package fails closed, which is why it waited for the release that first published it. Signed-off-by: Jeremi Joslin --- release/scripts/check-gates-inventory.py | 2 +- release/scripts/cleanup-release-candidates.py | 1 + release/scripts/test_cleanup_release_candidates.py | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py index 2885295d8..a76c52e9f 100644 --- a/release/scripts/check-gates-inventory.py +++ b/release/scripts/check-gates-inventory.py @@ -641,7 +641,7 @@ "Candidate cleanup exact package allowlist", "release/scripts/cleanup-release-candidates.py", ( - 'CANDIDATE_PACKAGES = (\n # Listing an absent package fails closed, so a candidate name joins this\n # allowlist with the release that first publishes it.\n "evidence-candidate",\n "mint-candidate",\n "relay-candidate",\n)', + 'CANDIDATE_PACKAGES = (\n # Listing an absent package fails closed, so a candidate name joins this\n # allowlist with the release that first publishes it.\n "discovery-candidate",\n "evidence-candidate",\n "mint-candidate",\n "relay-candidate",\n)', 'PUBLIC_PACKAGES = (\n # Retired public names stay denylisted so cleanup can never delete history.', ' "discovery",\n', ' "evidence",\n', diff --git a/release/scripts/cleanup-release-candidates.py b/release/scripts/cleanup-release-candidates.py index 8bbd9a2f2..3924fdbe7 100755 --- a/release/scripts/cleanup-release-candidates.py +++ b/release/scripts/cleanup-release-candidates.py @@ -21,6 +21,7 @@ CANDIDATE_PACKAGES = ( # Listing an absent package fails closed, so a candidate name joins this # allowlist with the release that first publishes it. + "discovery-candidate", "evidence-candidate", "mint-candidate", "relay-candidate", diff --git a/release/scripts/test_cleanup_release_candidates.py b/release/scripts/test_cleanup_release_candidates.py index de03d5592..4ea9b73b0 100644 --- a/release/scripts/test_cleanup_release_candidates.py +++ b/release/scripts/test_cleanup_release_candidates.py @@ -70,6 +70,7 @@ def test_dry_run_uses_server_time_and_does_not_delete(self) -> None: def test_apply_deletes_expired_versions_from_all_candidates(self) -> None: client = FakeClient( { + "discovery-candidate": [version(6, "2026-07-03T00:00:00Z")], "evidence-candidate": [version(4, "2026-07-03T00:00:00Z")], "mint-candidate": [version(5, "2026-07-03T00:00:00Z")], "relay-candidate": [version(3, "2026-07-03T00:00:00Z")], @@ -83,6 +84,7 @@ def test_apply_deletes_expired_versions_from_all_candidates(self) -> None: ) self.assertEqual( [ + ("discovery-candidate", 6), ("evidence-candidate", 4), ("mint-candidate", 5), ("relay-candidate", 3),