diff --git a/.github/dapper-headers.json b/.github/dapper-headers.json new file mode 100644 index 0000000..90a12fb --- /dev/null +++ b/.github/dapper-headers.json @@ -0,0 +1,10 @@ +{ + "repository": "PastureStack/kubernetes-agent", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "justification": "vulnerable_code_not_present", + "reason": "No linux-libc-dev package or findings exist in the current Go-only Dapper image. No header CVE is permitted by this empty set.", + "checkedAt": "2026-10-23", + "ids": [] +} diff --git a/.github/dapper-unfixed.json b/.github/dapper-unfixed.json new file mode 100644 index 0000000..9e393d6 --- /dev/null +++ b/.github/dapper-unfixed.json @@ -0,0 +1,709 @@ +{ + "repository": "PastureStack/kubernetes-agent", + "unfixed": [ + { + "id": "CVE-2026-102473", + "package": "dash", + "version": "0.5.12-12ubuntu3", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102473", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-102474", + "package": "dash", + "version": "0.5.12-12ubuntu3", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102474", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-52005", + "package": "git", + "version": "1:2.53.0-1ubuntu1", + "purl": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-52005", + "reason": "Canonical Ubuntu 26.04 status: resolute_git: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-52005", + "package": "git-man", + "version": "1:2.53.0-1ubuntu1", + "purl": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-52005", + "reason": "Canonical Ubuntu 26.04 status: resolute_git: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41256", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41256", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41257", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41257", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43895", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43895", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43896", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43896", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-44777", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-44777", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-gconv-modules-extra", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-gconv-modules-extra", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc6", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc6", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2025-66382", + "package": "libexpat1", + "version": "2.7.4-1ubuntu0.2", + "purl": "pkg:deb/ubuntu/libexpat1@2.7.4-1ubuntu0.2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-66382", + "reason": "Canonical Ubuntu 26.04 status: resolute_expat: deferred (2026-09-28). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-67693", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-67693", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-88647", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88647", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-88648", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88648", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95184", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95184", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95209", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95209", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95210", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95210", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41256", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41256", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41257", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41257", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43895", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43895", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43896", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43896", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-44777", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-44777", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-13757", + "package": "libp11-kit0", + "version": "0.26.2-2", + "purl": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-13757", + "reason": "Canonical Ubuntu 26.04 status: resolute_p11-kit: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-103111", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-103111", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-86145", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-86145", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89156", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89156", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89157", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89157", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89158", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89158", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89160", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89160", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89161", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89161", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89162", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89162", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-107161", + "package": "libsasl2-2", + "version": "2.1.28+dfsg1-9ubuntu3", + "purl": "pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-107161", + "package": "libsasl2-modules-db", + "version": "2.1.28+dfsg1-9ubuntu3", + "purl": "pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "libsystemd0", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "libudev1", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-56433", + "package": "login.defs", + "version": "1:4.17.4-2ubuntu3", + "purl": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-56433", + "package": "passwd", + "version": "1:4.17.4-2ubuntu3", + "purl": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35341", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35341", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35344", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35344", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35345", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35345", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35348", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35348", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35350", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35350", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35351", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35351", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35352", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35352", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35354", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35354", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35357", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35357", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35359", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35359", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35360", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35360", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35363", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35363", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35364", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35364", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35367", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35367", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35368", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35368", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35370", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35370", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35371", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35371", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35373", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35373", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35374", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35374", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35377", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35377", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18477", + "package": "tar", + "version": "1.35+dfsg-4ubuntu0.4", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18477", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18508", + "package": "tar", + "version": "1.35+dfsg-4ubuntu0.4", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18508", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + } + ] +} diff --git a/.github/runtime-unfixed.json b/.github/runtime-unfixed.json new file mode 100644 index 0000000..964820a --- /dev/null +++ b/.github/runtime-unfixed.json @@ -0,0 +1,4 @@ +{ + "repository": "PastureStack/kubernetes-agent", + "unfixed": [] +} diff --git a/.github/scripts/check-builder-header-boundary.sh b/.github/scripts/check-builder-header-boundary.sh new file mode 100644 index 0000000..bc0edf8 --- /dev/null +++ b/.github/scripts/check-builder-header-boundary.sh @@ -0,0 +1,28 @@ +#!/usr/bin/env bash +set -euo pipefail +test "$#" -eq 1 +if ! docker run --rm --entrypoint sh "$1" -ec 'dpkg-query -W -f="\${Status}" linux-libc-dev 2>/dev/null | grep -Fxq "install ok installed"'; then + printf '%s\n' '{"package":null}' + exit 0 +fi +docker run --rm --entrypoint sh "$1" -ec ' + test "$(dpkg-query -W -f="\${Version}" linux-libc-dev)" = 7.0.0-38.38 + if dpkg-query -W -f="\${db:Status-Abbrev} \${binary:Package}\\n" | + awk "\$1 == \"ii\" {print \$2}" | grep -Eq "^linux-(image|modules)([-:]|$)"; then + echo "Unexpected kernel runtime package" >&2; exit 1 + fi + for directory in /boot /lib/modules /usr/lib/modules; do + if test -d "$directory" && test -n "$(find "$directory" -type f -print -quit)"; then + echo "Unexpected kernel runtime file" >&2; exit 1 + fi + done + dpkg-query -L linux-libc-dev | while IFS= read -r path; do + if test -f "$path"; then + case "$path" in + /usr/include/*|/usr/share/doc/linux-libc-dev/*|/usr/share/lintian/overrides/linux-libc-dev) ;; + *) echo "Unexpected linux-libc-dev payload: $path" >&2; exit 1 ;; + esac + fi + done +' +printf '%s\n' '{"package":"linux-libc-dev","version":"7.0.0-38.38","kernel_images":false,"kernel_modules":false}' diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py new file mode 100644 index 0000000..4eac3ef --- /dev/null +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -0,0 +1,159 @@ +"""Enforce release findings; only exact, reviewed unfixed low/medium entries may pass.""" +import argparse +import json +import sys +from pathlib import Path + + +def violations(report, ledger, repository): + if (not isinstance(report, dict) or report.get("SchemaVersion") != 2 + or not isinstance(report.get("Results"), list) or not report["Results"]): + raise ValueError("missing or malformed Trivy scan results") + for result in report["Results"]: + if not isinstance(result, dict) or not isinstance(result.get("Target"), str): + raise ValueError("malformed Trivy result") + for key in ("Vulnerabilities", "Secrets"): + if key in result and result[key] is not None and not isinstance(result[key], list): + raise ValueError("malformed Trivy findings") + if ledger.get("repository") != repository: + raise ValueError("allowlist repository mismatch") + reviewed = {} + for entry in ledger.get("unfixed", []): + key = (entry["id"], entry["package"], entry["version"], entry.get("purl", "")) + if key in reviewed: + raise ValueError("duplicate reviewed finding") + if (entry.get("severity") not in ("LOW", "MEDIUM") + or entry.get("status") != "no_official_fix" + or not entry.get("officialEvidence", "").startswith("https://") + or not entry.get("reason") or not entry.get("checkedAt")): + raise ValueError("incomplete official no-fix evidence") + reviewed[key] = entry + errors = [] + for result in report.get("Results") or []: + if result.get("Secrets"): + errors.append("secret findings remain") + for finding in result.get("Vulnerabilities") or []: + severity = finding.get("Severity", "UNKNOWN") + key = (finding.get("VulnerabilityID"), finding.get("PkgName"), + finding.get("InstalledVersion"), + (finding.get("PkgIdentifier") or {}).get("PURL", "")) + entry = reviewed.get(key) + fixed = str(finding.get("FixedVersion") or "").strip() + if (severity not in ("LOW", "MEDIUM") or fixed + or entry is None or entry["severity"] != severity): + errors.append("%s %s@%s severity=%s fixed=%s" % ( + key[0], key[1], key[2], severity, fixed or "none")) + return errors + + + +def builder_violations(report, ledger, repository, header_boundary, header_ledger, + package_graphs=None, docker_proof=None): + # The complete raw scan is required; never infer safety from missing analysis. + if not isinstance(report, dict) or report.get("SchemaVersion") != 2: + raise ValueError("malformed complete builder report") + results = report.get("Results") + if not isinstance(results, list) or not results: + raise ValueError("missing builder analysis") + expected = ["usr/local/go/bin/go"] + if repository == "PastureStack/ecr-credential-sync": + expected += ["usr/bin/docker", "usr/libexec/docker/cli-plugins/docker-buildx"] + if repository == "PastureStack/kubernetes-authentication-bridge": + expected += ["usr/bin/docker", "usr/local/libexec/docker/cli-plugins/docker-buildx"] + binaries = {r.get("Target"): r for r in results if r.get("Type") == "gobinary"} + for target in expected: + if not binaries.get(target, {}).get("Packages"): + raise ValueError("missing nonempty binary analysis: " + target) + if any(not result.get("Packages") for result in binaries.values()): + raise ValueError("incomplete Go binary package analysis") + has_headers = any(f.get("PkgName") == "linux-libc-dev" for r in results for f in (r.get("Vulnerabilities") or [])) + if has_headers and header_boundary != {"package": "linux-libc-dev", "version": "7.0.0-38.38", + "kernel_images": False, "kernel_modules": False}: + raise ValueError("missing exact installed-header boundary proof") + if header_ledger.get("repository") != repository: + raise ValueError("header review repository mismatch") + if (header_ledger.get("package") != "linux-libc-dev" + or header_ledger.get("version") != "7.0.0-38.38" + or header_ledger.get("purl") != "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04"): + raise ValueError("changed header review boundary") + header_keys = {(identifier, header_ledger["package"], header_ledger["version"], header_ledger["purl"]) + for identifier in header_ledger.get("ids", [])} + expected_purl = "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04" + openpgp_absent = False + if package_graphs: + if repository not in ("PastureStack/kubernetes-authentication-bridge", "PastureStack/ecr-credential-sync"): + raise ValueError("unexpected OpenPGP proof consumer") + expected_roots = {"buildx": "github.com/docker/buildx/cmd/buildx"} + if repository == "PastureStack/ecr-credential-sync": + expected_roots["docker"] = "github.com/docker/cli/cmd/docker" + if set(package_graphs) != set(expected_roots): + raise ValueError("unexpected source package graph set") + for name, root in expected_roots.items(): + packages = set(package_graphs[name].splitlines()) + if root not in packages or any( + p == "golang.org/x/crypto/openpgp" or + p.startswith("golang.org/x/crypto/openpgp/") for p in packages): + raise ValueError("OpenPGP package boundary not proved") + openpgp_absent = True + retained = [] + for result in results: + copied = dict(result) + copied["Vulnerabilities"] = [] + for finding in result.get("Vulnerabilities") or []: + key = (finding.get("VulnerabilityID"), finding.get("PkgName"), + finding.get("InstalledVersion"), + (finding.get("PkgIdentifier") or {}).get("PURL", "")) + is_header = (key in header_keys and key[1] == "linux-libc-dev" + and key[2] == "7.0.0-38.38" and key[3] == expected_purl) + unfixed = not str(finding.get("FixedVersion") or "").strip() + if is_header and unfixed: + continue + if (unfixed and openpgp_absent and key == ( + "GO-2026-5932", "golang.org/x/crypto", "v0.57.0", + "pkg:golang/golang.org/x/crypto@v0.57.0")): + continue + if (unfixed and repository == "PastureStack/ecr-credential-sync" + and key == ("CVE-2026-85747", "github.com/docker/distribution", + "v2.8.3+incompatible", + "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible") + and docker_proof and len(docker_proof.get("cases", [])) == 7 + and all(c.get("passed") is True for c in docker_proof["cases"]) + and {c.get("case") for c in docker_proof["cases"]} == { + "valid_schema2", "forged_schema2", "valid_oci", "forged_oci", + "valid_list", "forged_list_parent", "forged_list_child"} + and docker_proof.get("sourceCommit") == "a7dcaa6fdb6ed04aacbfdc76357fdae01605609e" + and len(docker_proof.get("binarySha256", "")) == 64): + continue + copied["Vulnerabilities"].append(finding) + retained.append(copied) + return violations(dict(report, Results=retained), ledger, repository) + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + parser.add_argument("--repository", required=True) + parser.add_argument("--scope", choices=("runtime", "builder"), default="runtime") + args = parser.parse_args() + repo_root = Path(__file__).resolve().parents[2] + report = json.load(sys.stdin) + ledger_name = "runtime-unfixed.json" if args.scope == "runtime" else "dapper-unfixed.json" + ledger = json.loads((repo_root / ".github" / ledger_name).read_text(encoding="utf-8")) + if args.scope == "runtime": + failures = violations(report, ledger, args.repository) + else: + evidence_dir = "dist" if args.repository in ( + "PastureStack/kubernetes-agent", + "PastureStack/kubernetes-authentication-bridge") else "evidence" + boundary = json.loads((repo_root / evidence_dir / "dapper-header-boundary.json").read_text(encoding="utf-8")) + headers = json.loads((repo_root / ".github" / "dapper-headers.json").read_text(encoding="utf-8")) + graphs = None + docker_proof = None + if args.repository in ("PastureStack/kubernetes-authentication-bridge", + "PastureStack/ecr-credential-sync"): + graphs = {"buildx": (repo_root / evidence_dir / "buildx-package-graph.txt").read_text(encoding="utf-8")} + if args.repository == "PastureStack/ecr-credential-sync": + graphs["docker"] = (repo_root / evidence_dir / "docker-package-graph.txt").read_text(encoding="utf-8") + docker_proof = json.loads((repo_root / evidence_dir / "docker-manifest-digest-proof.json").read_text(encoding="utf-8")) + failures = builder_violations(report, ledger, args.repository, boundary, headers, graphs, docker_proof) + if failures: + raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) + print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/.github/scripts/test_builder_vulnerability_policy.py b/.github/scripts/test_builder_vulnerability_policy.py new file mode 100644 index 0000000..e614ad8 --- /dev/null +++ b/.github/scripts/test_builder_vulnerability_policy.py @@ -0,0 +1,70 @@ +import copy +import importlib.util +from pathlib import Path +import unittest + +spec = importlib.util.spec_from_file_location("policy", Path(__file__).with_name("enforce-runtime-vulnerabilities.py")) +policy = importlib.util.module_from_spec(spec) +spec.loader.exec_module(policy) +REPO = "PastureStack/authentication-service" +PURL = "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04" + +class BuilderPolicy(unittest.TestCase): + def setUp(self): + self.report = {"SchemaVersion": 2, "Results": [ + {"Target": "usr/local/go/bin/go", "Type": "gobinary", "Packages": [{"Name": "stdlib", "Version": "v1.27.3"}]}, + {"Target": "os", "Vulnerabilities": []}]} + self.ledger = {"repository": REPO, "unfixed": []} + self.boundary = {"package": "linux-libc-dev", "version": "7.0.0-38.38", "kernel_images": False, "kernel_modules": False} + self.headers = {"repository": REPO, "package": "linux-libc-dev", "version": "7.0.0-38.38", "purl": PURL, "ids": ["HEADER-1"]} + def check(self): + return policy.builder_violations(self.report, self.ledger, REPO, self.boundary, self.headers) + def finding(self, severity="LOW", fixed=""): + item = {"VulnerabilityID": "HEADER-1", "PkgName": "linux-libc-dev", "InstalledVersion": "7.0.0-38.38", + "PkgIdentifier": {"PURL": PURL}, "Severity": severity, "FixedVersion": fixed} + self.report["Results"][1]["Vulnerabilities"] = [item] + return item + def test_complete_clean_scan(self): + self.assertEqual(self.check(), []) + def test_missing_expected_binary(self): + self.report["Results"] = self.report["Results"][1:] + with self.assertRaises(ValueError): self.check() + def test_empty_binary_packages(self): + self.report["Results"][0]["Packages"] = [] + with self.assertRaises(ValueError): self.check() + def test_other_binary_missing_analysis(self): + self.report["Results"].append({"Target":"other", "Type":"gobinary"}) + with self.assertRaises(ValueError): self.check() + def test_exact_nonexecuted_header(self): + self.finding("HIGH") + self.assertEqual(self.check(), []) + def test_fixed_header_is_never_exempt(self): + self.finding("LOW", "7.0.0-99") + self.assertTrue(self.check()) + def test_new_header_advisory_blocks(self): + self.finding()["VulnerabilityID"] = "HEADER-NEW" + self.assertTrue(self.check()) + def test_header_purl_drift_blocks(self): + self.finding()["PkgIdentifier"]["PURL"] += "-different" + self.assertTrue(self.check()) + def test_missing_header_boundary_blocks(self): + self.finding() + self.boundary = {} + with self.assertRaises(ValueError): self.check() + def test_unregistered_low_medium_unknown_block(self): + for severity in ("LOW", "MEDIUM", "HIGH", "CRITICAL", "UNKNOWN"): + self.finding(severity)["PkgName"] = "other" + self.assertTrue(self.check()) + def test_secrets_block(self): + self.report["Results"][1]["Secrets"] = [{"RuleID": "test"}] + self.assertTrue(self.check()) + def test_nofix_ledger_does_not_exempt_fixed_finding(self): + finding = self.finding("LOW", "2") + finding.update(PkgName="test", InstalledVersion="1", PkgIdentifier={"PURL":"pkg:test/test@1"}) + self.ledger["unfixed"] = [{"id":"HEADER-1", "package":"test", "version":"1", "purl":"pkg:test/test@1", + "severity":"LOW", "status":"no_official_fix", "officialEvidence":"https://fixture.invalid/test", + "reason":"test", "checkedAt":"2026-10-23"}] + self.assertTrue(self.check()) + +if __name__ == "__main__": + unittest.main() diff --git a/.github/scripts/test_runtime_vulnerability_policy.py b/.github/scripts/test_runtime_vulnerability_policy.py new file mode 100644 index 0000000..f1683fc --- /dev/null +++ b/.github/scripts/test_runtime_vulnerability_policy.py @@ -0,0 +1,77 @@ +import copy +import importlib.util +import pathlib +import unittest + +PATH = pathlib.Path(__file__).with_name('enforce-runtime-vulnerabilities.py') +SPEC = importlib.util.spec_from_file_location('gate', PATH) +GATE = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(GATE) +REPO = 'PastureStack/network-policy-manager' + + +class RuntimePolicy(unittest.TestCase): + def setUp(self): + self.finding = {'VulnerabilityID': 'TEST-1', 'PkgName': 'lib', 'InstalledVersion': '1', + 'Severity': 'MEDIUM', 'FixedVersion': '', + 'PkgIdentifier': {'PURL': 'pkg:test/lib@1'}} + self.report = {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': [self.finding]}]} + self.ledger = {'repository': REPO, 'unfixed': [{'id': 'TEST-1', 'package': 'lib', + 'version': '1', 'severity': 'MEDIUM', 'purl': 'pkg:test/lib@1', + 'status': 'no_official_fix', 'officialEvidence': 'https://fixture.invalid/advisory', + 'reason': 'Test fixture only', 'checkedAt': '2026-10-23'}]} + + def test_exact_reviewed_unfixed_medium_passes(self): + self.assertEqual(GATE.violations(self.report, self.ledger, REPO), []) + + def test_clean_scan_passes(self): + self.assertEqual(GATE.violations({'SchemaVersion': 2, 'Results': [{'Target': 'fixture'}]}, + {'repository': REPO, 'unfixed': []}, REPO), []) + + def test_missing_or_malformed_scan_fails_closed(self): + for report in ({}, {'Results': []}, {'SchemaVersion': 2, 'Results': []}, + {'SchemaVersion': 2, 'Results': [{}]}, + {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': {}}]}): + with self.assertRaises(ValueError): + GATE.violations(report, self.ledger, REPO) + + def test_unregistered_medium_blocks(self): + self.ledger['unfixed'] = [] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_medium_blocks(self): + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_low_blocks(self): + self.finding['Severity'] = 'LOW' + self.ledger['unfixed'][0]['severity'] = 'LOW' + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_high_critical_and_unknown_always_block(self): + for severity in ('HIGH', 'CRITICAL', 'UNKNOWN'): + self.finding['Severity'] = severity + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_version_or_purl_drift_blocks(self): + for key in ('version', 'purl'): + ledger = copy.deepcopy(self.ledger) + ledger['unfixed'][0][key] = 'different' + self.assertTrue(GATE.violations(self.report, ledger, REPO)) + + def test_secrets_always_block(self): + self.report['Results'][0]['Secrets'] = [{'RuleID': 'test'}] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_repository_drift_fails_closed(self): + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, 'another/repo') + + def test_incomplete_evidence_fails_closed(self): + del self.ledger['unfixed'][0]['checkedAt'] + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, REPO) + +if __name__ == '__main__': + unittest.main() diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 24d858f..08e7238 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,11 +17,11 @@ jobs: env: GH_TOKEN: ${{ github.token }} PRODUCER_RUN: ${{ inputs.producer_run }} - RELEASE_TAG: v0.7.3 + RELEASE_TAG: v0.7.4 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: v0.7.3 + ref: v0.7.4 fetch-depth: 0 persist-credentials: false - name: Verify immutable tag and successful producer @@ -47,7 +47,7 @@ jobs: gzip -dc dist/security-runtime/images.tar.gz | docker load printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT - source_image='pasturestack/kubernetes-agent:v0.7.3' + source_image='pasturestack/kubernetes-agent:v0.7.4' remote_image="ghcr.io/pasturestack/kubernetes-agent:$RELEASE_TAG" if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1 diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 6fe7548..117e0d6 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -19,9 +19,9 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 120 env: - CANDIDATE_VERSION: 0.7.3 - CANDIDATE_TAG: v0.7.3 - IMAGE: pasturestack/kubernetes-agent:v0.7.3 + CANDIDATE_VERSION: 0.7.4 + CANDIDATE_TAG: v0.7.4 + IMAGE: pasturestack/kubernetes-agent:v0.7.4 DAPPER_IMAGE: pasturestack-kubernetes-agent-dapper:security-gate KUBERNETES_SERVER_VERSION: v1.36.4 KUBE_APISERVER_SHA256: 90939ee07af61ac3701c665647f9ce27f2f988f5c7fff406aa5794fd3e6328a6 @@ -242,9 +242,9 @@ jobs: "$TRIVY_IMAGE" image --cache-dir /root/.cache/trivy \ --skip-db-update --offline-scan "$@" } - run_image_scan --scanners vuln,secret \ + run_image_scan --scanners vuln,secret --list-all-pkgs \ --format json --output /evidence/runtime-scan.json "$IMAGE" - run_image_scan --scanners vuln,secret \ + run_image_scan --scanners vuln,secret --list-all-pkgs \ --format json --output /evidence/dapper-scan.json "$DAPPER_IMAGE" run_image_scan --scanners vuln \ --vex /source/security/dapper.openvex.json \ @@ -276,6 +276,14 @@ jobs: '{source:{critical:$source_critical,high:$source_high,secrets:$source_secrets},runtime:{critical:$runtime_critical,high:$runtime_high,secrets:$runtime_secrets},build_environment:{raw:{critical:$dapper_critical,high:$dapper_high},applicable:{critical:$dapper_applicable_critical,high:$dapper_applicable_high},vex:"security/dapper.openvex.json"}}' \ > dist/security-counts.json + - name: Enforce full runtime vulnerability policy + run: | + bash .github/scripts/check-builder-header-boundary.sh "$DAPPER_IMAGE" > dist/dapper-header-boundary.json + python3 .github/scripts/test_builder_vulnerability_policy.py + python3 .github/scripts/enforce-runtime-vulnerabilities.py --scope builder --repository PastureStack/kubernetes-agent < dist/dapper-scan.json + python3 .github/scripts/test_runtime_vulnerability_policy.py + python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/kubernetes-agent < dist/runtime-scan.json + - name: Record evidence checksums if: always() shell: bash diff --git a/README.md b/README.md index 74d824b..7241ed1 100644 --- a/README.md +++ b/README.md @@ -51,3 +51,15 @@ The inherited project remains licensed under [Apache License 2.0](LICENSE). Copy ## October 2026 security maintenance Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned `ca-certificates 20260816ubuntu0.26.04.1` security package after their frozen APT baseline; the final trust store and installed version are verified. Release artifacts must pass the repository's existing checks before publication. + +## Full-severity security rebuild candidate + +The next compatible release candidate is **v0.7.4**, not yet published. It retains the existing Go binary/API contract and shell-free, non-root runtime, and overlays the official Debian 12 tzdata 2026c-0+deb12u1 and ca-certificates 20250419~deb12u2 payloads. Package metadata is updated from the same verified packages; revoked roots are removed rather than merged back. + +The full-severity runtime gate rejects every finding with an official fix, +including LOW, MEDIUM and UNKNOWN. Only exact reviewed LOW/MEDIUM no-fix entries +may pass. Existing v0.7.3 remains published for provenance, but is not the fully +patched candidate. +### Complete build-environment gate + +The Dapper scan retains all severities and requires nonempty package analysis for the expected Go binaries. Any available fixed version fails, including Low, Medium and Unknown findings. Other Low/Medium findings require an exact package/version/PURL entry backed by the official vendor tracker. The pinned userspace kernel-header exception additionally requires the reviewed CVE set, actual header payload paths, and absence of kernel images/modules; it never permits an available fix. Unknown module findings require the separately verified exact source package graph, not a generic severity exemption. diff --git a/package/Dockerfile b/package/Dockerfile index de3f5e0..32d2f62 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,4 +1,46 @@ -FROM gcr.io/distroless/static-debian12@sha256:4b2a093ef4649bccd586625090a3c668b254cfe180dee54f4c94f3e9bd7e381e +# syntax=docker/dockerfile:1.7 +FROM gcr.io/distroless/static-debian12@sha256:4b2a093ef4649bccd586625090a3c668b254cfe180dee54f4c94f3e9bd7e381e AS original-runtime +FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b AS security-rootfs +COPY --from=original-runtime / /rootfs/ +ADD --checksum=sha256:c6bdac9aa03e89a112c8d900cb60321889cfec535e0397b74383bd10c8b3cb44 https://security.debian.org/debian-security/pool/updates/main/t/tzdata/tzdata_2026c-0+deb12u1_all.deb /tmp/tzdata.deb +ADD --checksum=sha256:b9f76b5271a7ac373fd5e7e1b5b826a71ddd702b42a0d104955ecb1acfffc94b https://security.debian.org/debian-security/pool/updates/main/c/ca-certificates/ca-certificates_20250419~deb12u2_all.deb /tmp/ca-certificates.deb +# Update actual package payloads and their installed metadata together. +# Only this build-owned rootfs is changed; no shell/package manager enters the runtime. +RUN set -eux; \ + test "$(dpkg-deb -f /tmp/tzdata.deb Version)" = '2026c-0+deb12u1'; \ + test "$(dpkg-deb -f /tmp/ca-certificates.deb Version)" = '20250419~deb12u2'; \ + rm -rf /rootfs/etc/ssl/certs /rootfs/usr/share/ca-certificates; \ + for package in tzdata ca-certificates; do \ + test "$(dpkg-deb -f "/tmp/$package.deb" Package)" = "$package"; \ + status_file=$(grep -l "^Package: $package$" /rootfs/var/lib/dpkg/status.d/* || true); \ + if [ "$package" = ca-certificates ] && [ -z "$status_file" ]; then \ + status_file=/rootfs/var/lib/dpkg/status.d/ca-certificates; \ + touch "$status_file"; \ + fi; \ + test "$(printf '%s\n' "$status_file" | wc -l)" -eq 1; \ + test -f "$status_file"; \ + dpkg-deb --extract "/tmp/$package.deb" /rootfs; \ + { dpkg-deb --field "/tmp/$package.deb"; printf 'Status: install ok installed\n'; } > "$status_file"; \ + done; \ + mkdir -p /rootfs/etc/ssl/certs; \ + find /rootfs/usr/share/ca-certificates -type f -name '*.crt' | LC_ALL=C sort | \ + while IFS= read -r certificate; do \ + sed -e '$a\' "$certificate"; \ + name=$(basename "$certificate" .crt); \ + ln -s "${certificate#/rootfs}" "/rootfs/etc/ssl/certs/$name.pem"; \ + done > /rootfs/etc/ssl/certs/ca-certificates.crt; \ + test -s /rootfs/etc/ssl/certs/ca-certificates.crt; \ + test ! -e /rootfs/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt; \ + test ! -e /rootfs/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt; \ + test ! -e /rootfs/bin/sh; \ + test ! -e /rootfs/usr/bin/apt-get + +FROM scratch +COPY --from=security-rootfs /rootfs/ / +# Preserve original-runtime configuration (verified from its immutable config). +ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \ + SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt +WORKDIR / ARG IMAGE_VERSION=dev ARG SOURCE_REVISION=unknown diff --git a/scripts/validate b/scripts/validate index 890d8ff..d28c637 100755 --- a/scripts/validate +++ b/scripts/validate @@ -79,11 +79,15 @@ if grep -R --exclude=validate -E 'GO_TEST_RACE=false|go test .*\$\{test_flags\[@ echo "KUBERNETES_AGENT_RACE_GATE_CAN_BE_DISABLED" >&2 exit 1 fi -if grep -Eq '^FROM (ubuntu|alpine|debian):' package/Dockerfile || \ - grep -Eq 'apt-get|apk add|yum install|ENTRYPOINT \["/.*sh"' package/Dockerfile; then +# Build-only extraction stages may use packaging tools; the final runtime may not. +final_stage=$(awk '/^FROM / { stage=$0; body="" } { body=body $0 "\n" } END { print body }' package/Dockerfile) +if ! printf '%s\n' "$final_stage" | grep -Fxq 'FROM scratch' || \ + printf '%s\n' "$final_stage" | grep -Eq '^FROM (ubuntu|alpine|debian):|^RUN |ENTRYPOINT \["/.*sh"'; then echo "KUBERNETES_AGENT_RUNTIME_PACKAGE_MANAGER_OR_SHELL_PRESENT" >&2 exit 1 fi +grep -Fq 'COPY --from=security-rootfs /rootfs/ /' package/Dockerfile + if grep -R -E 'ghcr\.io/[^/]+/[^:[:space:]]+@sha256:' README.md SECURITY.md COMPATIBILITY.md package scripts; then echo "KUBERNETES_AGENT_USER_VISIBLE_IMAGE_DIGEST_PRESENT" >&2 exit 1 diff --git a/scripts/version b/scripts/version index 36c223a..0acf59e 100755 --- a/scripts/version +++ b/scripts/version @@ -10,7 +10,7 @@ if [ -z "${candidate}" ]; then candidate=0.0.0 fi if ! [[ "${candidate}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - echo "VERSION_OVERRIDE must be a numeric semantic version such as 0.7.3" >&2 + echo "VERSION_OVERRIDE must be a numeric semantic version such as 0.7.4" >&2 return 1 2>/dev/null || exit 1 fi VERSION=${candidate}