From 9ebd84b8b09be40a812e52582b971aa2d753e447 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:09:45 +0800 Subject: [PATCH 01/10] Fix full-severity runtime findings and enforce exact release policy --- .github/runtime-unfixed.json | 467 ++++++++++++++++++ .../enforce-runtime-vulnerabilities.py | 58 +++ .../test_runtime_vulnerability_policy.py | 77 +++ .github/workflows/codeql-verification.yml | 6 +- .github/workflows/release.yml | 6 +- .github/workflows/security-release-gate.yml | 46 +- .github/workflows/validate.yml | 16 +- README.md | 9 + package/Dockerfile | 19 + package/ubuntu-security-packages.lock | 34 ++ scripts/install-ubuntu-security-updates | 54 ++ scripts/package-image | 10 +- scripts/version | 2 +- 13 files changed, 771 insertions(+), 33 deletions(-) create mode 100644 .github/runtime-unfixed.json create mode 100644 .github/scripts/enforce-runtime-vulnerabilities.py create mode 100644 .github/scripts/test_runtime_vulnerability_policy.py create mode 100644 package/ubuntu-security-packages.lock create mode 100644 scripts/install-ubuntu-security-updates diff --git a/.github/runtime-unfixed.json b/.github/runtime-unfixed.json new file mode 100644 index 00000000..f64ae492 --- /dev/null +++ b/.github/runtime-unfixed.json @@ -0,0 +1,467 @@ +{ + "repository": "PastureStack/node-agent", + "unfixed": [ + { + "severity": "MEDIUM", + "package": "dash", + "id": "CVE-2026-102473", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.5.12-12ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102473", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "dash", + "id": "CVE-2026-102474", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.5.12-12ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102474", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-bin", + "id": "CVE-2026-18374", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-bin", + "id": "CVE-2026-89092", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-gconv-modules-extra", + "id": "CVE-2026-18374", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-gconv-modules-extra", + "id": "CVE-2026-89092", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc6", + "id": "CVE-2026-18374", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc6", + "id": "CVE-2026-89092", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-103111", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-103111", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-86145", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-86145", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89156", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89156", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89157", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89157", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89158", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89158", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89160", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89160", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89161", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89161", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89162", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89162", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "libsystemd0", + "id": "CVE-2026-40228", + "purl": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "version": "259.5-0ubuntu3.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "libudev1", + "id": "CVE-2026-40228", + "purl": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "version": "259.5-0ubuntu3.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "login.defs", + "id": "CVE-2024-56433", + "purl": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1", + "version": "1:4.17.4-2ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "passwd", + "id": "CVE-2024-56433", + "purl": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1", + "version": "1:4.17.4-2ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35341", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35341", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35344", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35344", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35345", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35345", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35348", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35348", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35350", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35350", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35351", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35351", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35352", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35352", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35354", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35354", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35357", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35357", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35359", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35359", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35360", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35360", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35363", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35363", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35364", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35364", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35367", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35367", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35368", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35368", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35370", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35370", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35371", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35371", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35373", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35373", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35374", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35374", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35377", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.8.0-0ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35377", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "tar", + "id": "CVE-2026-18477", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "version": "1.35+dfsg-4ubuntu0.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18477", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "tar", + "id": "CVE-2026-18508", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "version": "1.35+dfsg-4ubuntu0.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18508", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + } + ] +} diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py new file mode 100644 index 00000000..383356bd --- /dev/null +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -0,0 +1,58 @@ +"""Enforce release findings; only exact, reviewed unfixed low/medium entries may pass.""" +import argparse +import json +from pathlib import Path + + +def violations(report, ledger, repository): + if (not isinstance(report, dict) or report.get("SchemaVersion") != 2 + or not isinstance(report.get("Results"), list) or not report["Results"]): + raise ValueError("missing or malformed Trivy scan results") + for result in report["Results"]: + if not isinstance(result, dict) or not isinstance(result.get("Target"), str): + raise ValueError("malformed Trivy result") + for key in ("Vulnerabilities", "Secrets"): + if key in result and result[key] is not None and not isinstance(result[key], list): + raise ValueError("malformed Trivy findings") + if ledger.get("repository") != repository: + raise ValueError("allowlist repository mismatch") + reviewed = {} + for entry in ledger.get("unfixed", []): + key = (entry["id"], entry["package"], entry["version"], entry.get("purl", "")) + if key in reviewed: + raise ValueError("duplicate reviewed finding") + if (entry.get("severity") not in ("LOW", "MEDIUM") + or entry.get("status") != "no_official_fix" + or not entry.get("officialEvidence", "").startswith("https://") + or not entry.get("reason") or not entry.get("checkedAt")): + raise ValueError("incomplete official no-fix evidence") + reviewed[key] = entry + errors = [] + for result in report.get("Results") or []: + if result.get("Secrets"): + errors.append("secret findings remain") + for finding in result.get("Vulnerabilities") or []: + severity = finding.get("Severity", "UNKNOWN") + key = (finding.get("VulnerabilityID"), finding.get("PkgName"), + finding.get("InstalledVersion"), + (finding.get("PkgIdentifier") or {}).get("PURL", "")) + entry = reviewed.get(key) + fixed = str(finding.get("FixedVersion") or "").strip() + if (severity not in ("LOW", "MEDIUM") or fixed + or entry is None or entry["severity"] != severity): + errors.append("%s %s@%s severity=%s fixed=%s" % ( + key[0], key[1], key[2], severity, fixed or "none")) + return errors + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + parser.add_argument("report") + parser.add_argument("ledger") + parser.add_argument("--repository", required=True) + args = parser.parse_args() + failures = violations(json.loads(Path(args.report).read_text()), + json.loads(Path(args.ledger).read_text()), args.repository) + if failures: + raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) + print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/.github/scripts/test_runtime_vulnerability_policy.py b/.github/scripts/test_runtime_vulnerability_policy.py new file mode 100644 index 00000000..f1683fc5 --- /dev/null +++ b/.github/scripts/test_runtime_vulnerability_policy.py @@ -0,0 +1,77 @@ +import copy +import importlib.util +import pathlib +import unittest + +PATH = pathlib.Path(__file__).with_name('enforce-runtime-vulnerabilities.py') +SPEC = importlib.util.spec_from_file_location('gate', PATH) +GATE = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(GATE) +REPO = 'PastureStack/network-policy-manager' + + +class RuntimePolicy(unittest.TestCase): + def setUp(self): + self.finding = {'VulnerabilityID': 'TEST-1', 'PkgName': 'lib', 'InstalledVersion': '1', + 'Severity': 'MEDIUM', 'FixedVersion': '', + 'PkgIdentifier': {'PURL': 'pkg:test/lib@1'}} + self.report = {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': [self.finding]}]} + self.ledger = {'repository': REPO, 'unfixed': [{'id': 'TEST-1', 'package': 'lib', + 'version': '1', 'severity': 'MEDIUM', 'purl': 'pkg:test/lib@1', + 'status': 'no_official_fix', 'officialEvidence': 'https://fixture.invalid/advisory', + 'reason': 'Test fixture only', 'checkedAt': '2026-10-23'}]} + + def test_exact_reviewed_unfixed_medium_passes(self): + self.assertEqual(GATE.violations(self.report, self.ledger, REPO), []) + + def test_clean_scan_passes(self): + self.assertEqual(GATE.violations({'SchemaVersion': 2, 'Results': [{'Target': 'fixture'}]}, + {'repository': REPO, 'unfixed': []}, REPO), []) + + def test_missing_or_malformed_scan_fails_closed(self): + for report in ({}, {'Results': []}, {'SchemaVersion': 2, 'Results': []}, + {'SchemaVersion': 2, 'Results': [{}]}, + {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': {}}]}): + with self.assertRaises(ValueError): + GATE.violations(report, self.ledger, REPO) + + def test_unregistered_medium_blocks(self): + self.ledger['unfixed'] = [] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_medium_blocks(self): + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_low_blocks(self): + self.finding['Severity'] = 'LOW' + self.ledger['unfixed'][0]['severity'] = 'LOW' + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_high_critical_and_unknown_always_block(self): + for severity in ('HIGH', 'CRITICAL', 'UNKNOWN'): + self.finding['Severity'] = severity + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_version_or_purl_drift_blocks(self): + for key in ('version', 'purl'): + ledger = copy.deepcopy(self.ledger) + ledger['unfixed'][0][key] = 'different' + self.assertTrue(GATE.violations(self.report, ledger, REPO)) + + def test_secrets_always_block(self): + self.report['Results'][0]['Secrets'] = [{'RuleID': 'test'}] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_repository_drift_fails_closed(self): + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, 'another/repo') + + def test_incomplete_evidence_fails_closed(self): + del self.ledger['unfixed'][0]['checkedAt'] + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, REPO) + +if __name__ == '__main__': + unittest.main() diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index d47ab734..37eac5a9 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -38,10 +38,10 @@ jobs: set -euo pipefail test -z "$(git status --porcelain)" git merge-base --is-ancestor 73e3a7c5f438dbda42c4078885a66e6f156aa731 HEAD - grep -Fq 'VERSION_OVERRIDE: v0.13.32' .github/workflows/validate.yml + grep -Fq 'VERSION_OVERRIDE: v0.13.33' .github/workflows/validate.yml grep -Fq 'SHA256SUMS' scripts/package grep -Fq 'bash scripts/verify-package "$linux_asset"' .github/workflows/validate.yml - grep -Fq 'bash scripts/verify-package dist/artifacts/node-agent-0.13.32.tar.gz' .github/workflows/security-release-gate.yml + grep -Fq 'bash scripts/verify-package dist/artifacts/node-agent-0.13.33.tar.gz' .github/workflows/security-release-gate.yml - name: Install the release Go toolchain uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 @@ -68,7 +68,7 @@ jobs: export GOFLAGS=-mod=vendor mkdir -p "$GITHUB_WORKSPACE/bin" CGO_ENABLED=0 go build -trimpath -tags 'netgo osusergo' \ - -ldflags='-w -s -X main.VERSION=v0.13.32' \ + -ldflags='-w -s -X main.VERSION=v0.13.33' \ -o "$GITHUB_WORKSPACE/bin/node-agent" ./ - name: Analyze without publishing temporary alerts diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bd6d1ee8..9ee9f389 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,11 +17,11 @@ jobs: env: GH_TOKEN: ${{ github.token }} PRODUCER_RUN: ${{ inputs.producer_run }} - RELEASE_TAG: v0.13.32 + RELEASE_TAG: v0.13.33 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: v0.13.32 + ref: v0.13.33 fetch-depth: 0 persist-credentials: false - name: Verify immutable tag and successful producer @@ -47,7 +47,7 @@ jobs: gzip -dc dist/security-runtime/images.tar.gz | docker load printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT - source_image='pasturestack/node-agent:v0.13.32' + source_image='pasturestack/node-agent:v0.13.33' remote_image="ghcr.io/pasturestack/node-agent:$RELEASE_TAG" if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1 diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 823bee29..7d7bab31 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -19,9 +19,9 @@ jobs: timeout-minutes: 120 env: DAPPER_IMAGE: pasturestack/node-agent-dapper:${{ github.sha }} - RUNTIME_IMAGE: pasturestack/node-agent:v0.13.32 + RUNTIME_IMAGE: pasturestack/node-agent:v0.13.33 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 - VERSION_OVERRIDE: v0.13.32 + VERSION_OVERRIDE: v0.13.33 steps: - name: Check out candidate uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -50,25 +50,25 @@ jobs: set -euo pipefail CROSS=1 VERSION_OVERRIDE="$VERSION_OVERRIDE" make DAPPER_IMAGE="$DAPPER_IMAGE" ci make DAPPER_IMAGE="$DAPPER_IMAGE" IMAGE_NAME=pasturestack/node-agent \ - TAG=v0.13.32 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image - test -s dist/artifacts/node-agent-0.13.32.tar.gz - test -s dist/artifacts/node-agent-0.13.32-windows-amd64.zip + TAG=v0.13.33 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image + test -s dist/artifacts/node-agent-0.13.33.tar.gz + test -s dist/artifacts/node-agent-0.13.33-windows-amd64.zip test "$(cat dist/image)" = "$RUNTIME_IMAGE" - gzip -t dist/artifacts/node-agent-0.13.32.tar.gz - bash scripts/verify-package dist/artifacts/node-agent-0.13.32.tar.gz - unzip -t dist/artifacts/node-agent-0.13.32-windows-amd64.zip + gzip -t dist/artifacts/node-agent-0.13.33.tar.gz + bash scripts/verify-package dist/artifacts/node-agent-0.13.33.tar.gz + unzip -t dist/artifacts/node-agent-0.13.33-windows-amd64.zip ( cd dist/artifacts - sha256sum node-agent-0.13.32.tar.gz node-agent-0.13.32-windows-amd64.zip > SHA256SUMS + sha256sum node-agent-0.13.33.tar.gz node-agent-0.13.33-windows-amd64.zip > SHA256SUMS sha256sum -c SHA256SUMS ) - sha256sum dist/artifacts/node-agent-0.13.32.tar.gz \ - dist/artifacts/node-agent-0.13.32-windows-amd64.zip \ + sha256sum dist/artifacts/node-agent-0.13.33.tar.gz \ + dist/artifacts/node-agent-0.13.33-windows-amd64.zip \ bin/node-agent bin/windows/amd64/node-agent.exe > evidence/product-artifacts.sha256 docker image inspect "$RUNTIME_IMAGE" > evidence/runtime-image-inspect.json docker run --rm --entrypoint /usr/bin/node-agent "$RUNTIME_IMAGE" --version \ > evidence/runtime-version.txt - grep -Fxq 'node-agent version v0.13.32' evidence/runtime-version.txt + grep -Fxq 'node-agent version v0.13.33' evidence/runtime-version.txt - name: Verify reproducible Linux binary shell: bash @@ -103,6 +103,8 @@ jobs: trap 'rm -rf "$source_tree" "$product_tree"' EXIT git archive --format=tar HEAD | tar -xf - -C "$source_tree" cp bin/node-agent "$product_tree/node-agent" + unzip -p dist/artifacts/node-agent-0.13.33-windows-amd64.zip pasturestack/node-agent.exe > "$product_tree/node-agent.exe" + test -s "$product_tree/node-agent.exe" docker run --rm -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image --download-db-only docker run --rm -v "$source_tree:/scan:ro" -v "$PWD/evidence:/evidence" \ -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" fs \ @@ -114,7 +116,7 @@ jobs: --output /evidence/product-security.json /scan docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \ - --skip-db-update --offline-scan --scanners vuln,secret --format json \ + --skip-db-update --offline-scan --scanners vuln,secret --list-all-pkgs --format json \ --output /work/evidence/runtime-security.json "$RUNTIME_IMAGE" docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \ @@ -251,6 +253,16 @@ jobs: print('{}_components={}'.format(scope, len(bom['components']))) PY + - name: Enforce full runtime vulnerability policy + run: | + python3 .github/scripts/test_runtime_vulnerability_policy.py + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + evidence/runtime-security.json .github/runtime-unfixed.json \ + --repository PastureStack/node-agent + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + evidence/product-security.json .github/runtime-unfixed.json \ + --repository PastureStack/node-agent + - name: Retain exact runtime for immutable release shell: bash run: | @@ -259,7 +271,7 @@ jobs: docker image inspect "$RUNTIME_IMAGE" > dist/security-runtime/images.json docker save "$RUNTIME_IMAGE" | gzip -n > dist/security-runtime/images.tar.gz cp evidence/runtime-security.json evidence/runtime.cdx.json dist/security-runtime/ - cp dist/artifacts/node-agent-0.13.32.tar.gz dist/artifacts/node-agent-0.13.32-windows-amd64.zip dist/security-runtime/ + cp dist/artifacts/node-agent-0.13.33.tar.gz dist/artifacts/node-agent-0.13.33-windows-amd64.zip dist/security-runtime/ printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt (cd dist/security-runtime && sha256sum -- * > SHA256SUMS) - name: Upload exact runtime release bytes @@ -273,10 +285,10 @@ jobs: - name: Retain exact scanned release packages uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: node-agent-scanned-0.13.32 + name: node-agent-scanned-0.13.33 path: | - dist/artifacts/node-agent-0.13.32.tar.gz - dist/artifacts/node-agent-0.13.32-windows-amd64.zip + dist/artifacts/node-agent-0.13.33.tar.gz + dist/artifacts/node-agent-0.13.33-windows-amd64.zip dist/artifacts/SHA256SUMS if-no-files-found: error retention-days: 30 diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index ce73f346..0e8b0694 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -52,7 +52,7 @@ jobs: id: package env: CROSS: "1" - VERSION_OVERRIDE: v0.13.32 + VERSION_OVERRIDE: v0.13.33 VALIDATION_SCOPE: ${{ inputs.validation_scope || 'full' }} run: | set -euo pipefail @@ -75,8 +75,8 @@ jobs: exit 1 ;; esac - linux_asset="dist/artifacts/node-agent-0.13.32.tar.gz" - windows_asset="dist/artifacts/node-agent-0.13.32-windows-amd64.zip" + linux_asset="dist/artifacts/node-agent-0.13.33.tar.gz" + windows_asset="dist/artifacts/node-agent-0.13.33-windows-amd64.zip" test -s "$linux_asset" test -s "$windows_asset" gzip -t "$linux_asset" @@ -92,8 +92,8 @@ jobs: ( cd dist/artifacts sha256sum \ - node-agent-0.13.32.tar.gz \ - node-agent-0.13.32-windows-amd64.zip >SHA256SUMS + node-agent-0.13.33.tar.gz \ + node-agent-0.13.33-windows-amd64.zip >SHA256SUMS sha256sum -c SHA256SUMS ) printf 'NODE_AGENT_VALIDATION_OK source=%s version=%s scope=%s artifacts=linux,windows\n' \ @@ -102,10 +102,10 @@ jobs: - name: Retain reviewed release candidate uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: node-agent-0.13.32 + name: node-agent-0.13.33 path: | - dist/artifacts/node-agent-0.13.32.tar.gz - dist/artifacts/node-agent-0.13.32-windows-amd64.zip + dist/artifacts/node-agent-0.13.33.tar.gz + dist/artifacts/node-agent-0.13.33-windows-amd64.zip dist/artifacts/SHA256SUMS if-no-files-found: error retention-days: 30 diff --git a/README.md b/README.md index 0c2506d3..7bac36c7 100644 --- a/README.md +++ b/README.md @@ -67,3 +67,12 @@ Maintained Go builds select the patched Go 1.27.3 compiler without raising the e # Python installer security rebuild The disposable Dapper image rebuilds pip `26.2.2+pasturestack.1` from checksum-pinned official inputs using upstream vendoring and the original urllib3 patches. Only urllib3 changes to released `2.8.0`; this is a local security rebuild, not a new official PyPA release. The expected wheel SHA-256 is `be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a`. Ubuntu's Python ABI is retained. The image tests live pip, available ensurepip/new-venv seeds, virtualenv, streaming limits, and trusted/untrusted TLS. See `scripts/pip-security/README.md` for source and license evidence. + +## Full-severity security rebuild candidate + +The next compatible release candidate is **v0.13.33**, not yet published. It updates only already-installed Ubuntu 26.04 packages using the official signed 2026-10-23 snapshot and obtains the trust bundle from the SHA-pinned official CA package. Host ID, persistent agent state, startup arguments and the required host-api v0.38.8 remain unchanged. + +The full-severity runtime gate rejects every finding with an official fix, +including LOW, MEDIUM and UNKNOWN. Only exact reviewed LOW/MEDIUM no-fix entries +may pass. Existing v0.13.32 remains published for provenance, but is not the fully +patched candidate. diff --git a/package/Dockerfile b/package/Dockerfile index 66626263..30f4f9c3 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,5 +1,22 @@ +# syntax=docker/dockerfile:1.7 +FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b AS certificates +COPY ca-certificates.deb /tmp/ca-certificates.deb +RUN set -eu; \ + test "$(dpkg-deb -f /tmp/ca-certificates.deb Version)" = 20260816ubuntu0.26.04.1; \ + dpkg-deb --extract /tmp/ca-certificates.deb /ca; \ + mkdir -p /out; \ + find /ca/usr/share/ca-certificates -type f -name '*.crt' | LC_ALL=C sort | \ + while IFS= read -r certificate; do sed -e '$a\' "$certificate"; done > /out/ca-certificates.crt; \ + test -s /out/ca-certificates.crt; \ + test ! -e /ca/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt + FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b +COPY --from=certificates /out/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt +COPY --from=certificates /ca/usr/share/doc/ca-certificates/ /licenses/ca-certificates/ +COPY ubuntu-security-packages.lock /licenses/ubuntu-security-packages.lock +COPY install-ubuntu-security-updates /usr/local/libexec/pasturestack/install-ubuntu-security-updates + ARG PASTURESTACK_IMAGE_VERSION=dev LABEL org.opencontainers.image.source="https://github.com/PastureStack/node-agent" \ @@ -20,5 +37,7 @@ RUN set -eu; \ test "$(dpkg-query -W -f='${Version}' "$package")" = 3.5.5-1ubuntu3.7; \ rm -f "/tmp/${package}.deb"; \ done +RUN sh /usr/local/libexec/pasturestack/install-ubuntu-security-updates \ + /licenses/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt COPY node-agent /usr/bin/ CMD ["node-agent"] diff --git a/package/ubuntu-security-packages.lock b/package/ubuntu-security-packages.lock new file mode 100644 index 00000000..b0dfc097 --- /dev/null +++ b/package/ubuntu-security-packages.lock @@ -0,0 +1,34 @@ +# Official Ubuntu 26.04 security/updates snapshot: 20261023T000000Z +# Existing packages only; ABI series and unrelated packages are preserved. +bsdutils=1:2.41.3-3ubuntu2.2 +curl=8.18.0-1ubuntu2.8 +diffutils=1:3.12-1ubuntu0.1 +gnu-coreutils=9.7-3ubuntu2.1 +gpgv=2.4.8-4ubuntu3.1 +libattr1=1:2.5.2-4ubuntu0.1 +libblkid1=2.41.3-3ubuntu2.2 +libbz2-1.0=1.0.8-6ubuntu0.1 +libc-bin=2.43-2ubuntu2.4 +libc-gconv-modules-extra=2.43-2ubuntu2.4 +libc6=2.43-2ubuntu2.4 +libc6-dev=2.43-2ubuntu2.4 +libc-dev-bin=2.43-2ubuntu2.4 +libexpat1=2.7.4-1ubuntu0.2 +libcurl4t64=8.18.0-1ubuntu2.8 +libgcrypt20=1.12.0-2ubuntu1.1 +libmount1=2.41.3-3ubuntu2.2 +libperl5.40=5.40.1-7ubuntu0.3 +libsmartcols1=2.41.3-3ubuntu2.2 +libssh2-1t64=1.11.1-1ubuntu0.26.04.4 +libssl3t64=3.5.5-1ubuntu3.7 +libuuid1=2.41.3-3ubuntu2.2 +linux-libc-dev=7.0.0-38.38 +login=1:4.16.0-2+really2.41.3-3ubuntu2.2 +mount=2.41.3-3ubuntu2.2 +openssl=3.5.5-1ubuntu3.7 +openssl-provider-legacy=3.5.5-1ubuntu3.7 +perl=5.40.1-7ubuntu0.3 +perl-base=5.40.1-7ubuntu0.3 +perl-modules-5.40=5.40.1-7ubuntu0.3 +util-linux=2.41.3-3ubuntu2.2 +zlib1g=1:1.3.dfsg+really1.3.1-1ubuntu3.2 diff --git a/scripts/install-ubuntu-security-updates b/scripts/install-ubuntu-security-updates new file mode 100644 index 00000000..a8630ddc --- /dev/null +++ b/scripts/install-ubuntu-security-updates @@ -0,0 +1,54 @@ +#!/bin/sh +# Same-series official micro-updates. Never install a package just for a scan. +set -eu +test "$#" -eq 2 || { echo 'usage: security-updates LOCK TRUSTED_CA_BUNDLE' >&2; exit 2; } +lock=$1 +trusted_ca=$2 +. /etc/os-release +test "$ID:$VERSION_ID" = ubuntu:26.04 +test -s "$lock" +test -s "$trusted_ca" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT HUP INT TERM +dpkg-query -W -f='${binary:Package}\t${db:Status-Status}\n' | LC_ALL=C sort > "$tmp/before" +set -- +while IFS= read -r entry || test -n "$entry"; do + case "$entry" in ''|'#'*) continue;; esac + case "$entry" in *[!a-zA-Z0-9.:+~=_-]*) echo "Invalid lock entry" >&2; exit 1;; esac + package=${entry%%=*} + version=${entry#*=} + test "$package" != "$version" + status=$(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null || true) + test "$status" = installed || continue + installed=$(dpkg-query -W -f='${Version}' "$package") + # A newer base may already contain the fix; never downgrade it. + dpkg --compare-versions "$installed" ge "$version" && continue + set -- "$@" "$entry" +done < "$lock" +if test "$#" -gt 0; then + mkdir -p "$tmp/lists/partial" + printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/20261023T000000Z\nSuites: resolute-updates resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' > "$tmp/security.sources" + apt_security() { + apt-get -o Dir::Etc::sourcelist="$tmp/security.sources" \ + -o Dir::State::lists="$tmp/lists" \ + -o Dir::Cache::pkgcache="$tmp/pkgcache.bin" -o Dir::Cache::srcpkgcache="$tmp/srcpkgcache.bin" \ + -o Dir::Etc::sourceparts=- -o Acquire::https::CaInfo="$trusted_ca" \ + -o Acquire::https::Verify-Peer=true -o Acquire::https::Verify-Host=true \ + -o Acquire::AllowInsecureRepositories=false -o APT::Get::AllowUnauthenticated=false \ + -o Acquire::Retries=5 "$@" + } + apt_security update + DEBIAN_FRONTEND=noninteractive apt_security install -y --only-upgrade --no-install-recommends --no-remove "$@" +fi +while IFS= read -r entry || test -n "$entry"; do + case "$entry" in ''|'#'*) continue;; esac + package=${entry%%=*} + version=${entry#*=} + status=$(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null || true) + test "$status" = installed || continue + dpkg --compare-versions "$(dpkg-query -W -f='${Version}' "$package")" ge "$version" +done < "$lock" +dpkg-query -W -f='${binary:Package}\t${db:Status-Status}\n' | LC_ALL=C sort > "$tmp/after" +# A security micro-update must not add/remove packages or change installed status. +cmp "$tmp/before" "$tmp/after" +printf 'UBUNTU_SECURITY_MICRO_UPDATES_OK\n' diff --git a/scripts/package-image b/scripts/package-image index 558e75d5..477bde87 100755 --- a/scripts/package-image +++ b/scripts/package-image @@ -27,6 +27,14 @@ trap cleanup EXIT cp package/Dockerfile "$tmpdir/Dockerfile" cp bin/node-agent "$tmpdir/node-agent" +cp package/ubuntu-security-packages.lock "$tmpdir/" +cp scripts/install-ubuntu-security-updates "$tmpdir/" +curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ + --retry 2 --connect-timeout 10 --max-time 120 \ + -o "$tmpdir/ca-certificates.deb" \ + https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb +printf '%s %s\n' 5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd \ + "$tmpdir/ca-certificates.deb" | sha256sum --check curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ --retry 2 --connect-timeout 10 --max-time 120 \ @@ -41,7 +49,7 @@ curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ printf '%s %s\n' 51cf418571059831096abd40e0bd5debaa1ae48a6f8d87d9e4e5f7f12aa4db52 \ "$tmpdir/openssl-provider-legacy.deb" | sha256sum --check -DOCKER_BUILDKIT="${DOCKER_BUILDKIT:-0}" docker build \ +DOCKER_BUILDKIT="${DOCKER_BUILDKIT:-1}" docker build \ --network="${DOCKER_BUILD_NETWORK:-default}" \ --build-arg PASTURESTACK_IMAGE_VERSION="${tag}" \ -t "${image_name}:${tag}" \ diff --git a/scripts/version b/scripts/version index 270e8d9b..4db86efb 100755 --- a/scripts/version +++ b/scripts/version @@ -5,4 +5,4 @@ if [ -n "$VERSION_OVERRIDE" ]; then return 0 fi -VERSION=v0.13.32 +VERSION=v0.13.33 From e67ae036b6cb10a8b1165b449703c338928fc1ec Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:21:50 +0800 Subject: [PATCH 02/10] Apply official installed-package micro-updates to build environments --- Dockerfile.dapper | 3 +++ package/ubuntu-security-packages.lock | 1 + 2 files changed, 4 insertions(+) diff --git a/Dockerfile.dapper b/Dockerfile.dapper index aacf5648..10ae9a31 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -2,6 +2,8 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b RUN rm -f /usr/bin/pebble +COPY package/ubuntu-security-packages.lock /licenses/ubuntu-security-packages.lock +COPY scripts/install-ubuntu-security-updates /usr/local/libexec/pasturestack/install-ubuntu-security-updates ARG DAPPER_HOST_ARCH=amd64 ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH} @@ -90,6 +92,7 @@ RUN set -eux; \ test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \ test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \ rm -f /opt/pasturestack-ca-certificates.deb && \ + sh /usr/local/libexec/pasturestack/install-ubuntu-security-updates /licenses/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt && \ rm -rf /var/lib/apt/lists/* && \ rm -f /usr/bin/pebble && \ rm -f /bin/sh && ln -s /bin/bash /bin/sh diff --git a/package/ubuntu-security-packages.lock b/package/ubuntu-security-packages.lock index b0dfc097..dec5e1e1 100644 --- a/package/ubuntu-security-packages.lock +++ b/package/ubuntu-security-packages.lock @@ -32,3 +32,4 @@ perl-base=5.40.1-7ubuntu0.3 perl-modules-5.40=5.40.1-7ubuntu0.3 util-linux=2.41.3-3ubuntu2.2 zlib1g=1:1.3.dfsg+really1.3.1-1ubuntu3.2 +libsqlite3-0=3.46.1-9ubuntu0.3 From 67174923243dc9e35cb6f5ff9134291e67c99c25 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:31:40 +0800 Subject: [PATCH 03/10] Constrain policy input to stdin and repository-owned ledger --- .github/scripts/enforce-runtime-vulnerabilities.py | 7 +++---- .github/workflows/security-release-gate.yml | 8 ++------ 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py index 383356bd..b952eee1 100644 --- a/.github/scripts/enforce-runtime-vulnerabilities.py +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -1,6 +1,7 @@ """Enforce release findings; only exact, reviewed unfixed low/medium entries may pass.""" import argparse import json +import sys from pathlib import Path @@ -47,12 +48,10 @@ def violations(report, ledger, repository): if __name__ == "__main__": parser = argparse.ArgumentParser() - parser.add_argument("report") - parser.add_argument("ledger") parser.add_argument("--repository", required=True) args = parser.parse_args() - failures = violations(json.loads(Path(args.report).read_text()), - json.loads(Path(args.ledger).read_text()), args.repository) + failures = violations(json.load(sys.stdin), + json.loads((Path(__file__).resolve().parents[1] / "runtime-unfixed.json").read_text(encoding="utf-8")), args.repository) if failures: raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 7d7bab31..b5ca7dab 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -256,12 +256,8 @@ jobs: - name: Enforce full runtime vulnerability policy run: | python3 .github/scripts/test_runtime_vulnerability_policy.py - python3 .github/scripts/enforce-runtime-vulnerabilities.py \ - evidence/runtime-security.json .github/runtime-unfixed.json \ - --repository PastureStack/node-agent - python3 .github/scripts/enforce-runtime-vulnerabilities.py \ - evidence/product-security.json .github/runtime-unfixed.json \ - --repository PastureStack/node-agent + python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/node-agent < evidence/runtime-security.json + python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/node-agent < evidence/product-security.json - name: Retain exact runtime for immutable release shell: bash From 8a62acc7c12aa0fb4da0232e79c39341f1a6f93a Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:57:28 +0800 Subject: [PATCH 04/10] Complete builder policy and preserve checksum-verified runtime packaging --- .github/dapper-headers.json | 3162 +++++++++++++++++ .github/dapper-unfixed.json | 830 +++++ .../scripts/check-builder-header-boundary.sh | 28 + .../enforce-runtime-vulnerabilities.py | 123 +- .../test_builder_vulnerability_policy.py | 70 + .github/scripts/test_node_builder_vex.py | 35 + .github/workflows/security-release-gate.yml | 6 + README.md | 3 + scripts/package-image | 2 +- security/dapper-runtime-metadata.openvex.json | 94 + 10 files changed, 4350 insertions(+), 3 deletions(-) create mode 100644 .github/dapper-headers.json create mode 100644 .github/dapper-unfixed.json create mode 100644 .github/scripts/check-builder-header-boundary.sh create mode 100644 .github/scripts/test_builder_vulnerability_policy.py create mode 100644 .github/scripts/test_node_builder_vex.py create mode 100644 security/dapper-runtime-metadata.openvex.json diff --git a/.github/dapper-headers.json b/.github/dapper-headers.json new file mode 100644 index 00000000..fa04216a --- /dev/null +++ b/.github/dapper-headers.json @@ -0,0 +1,3162 @@ +{ + "repository": "PastureStack/node-agent", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "justification": "vulnerable_code_not_present", + "reason": "Exact user-space API headers only. The gate checks actual package payload paths and absence of kernel images/modules. Any fixed or new finding is rejected before this scope can apply.", + "checkedAt": "2026-10-23", + "ids": [ + "CVE-2013-7445", + "CVE-2015-7837", + "CVE-2016-8660", + "CVE-2017-0537", + "CVE-2017-13165", + "CVE-2017-13693", + "CVE-2018-1121", + "CVE-2018-12928", + "CVE-2018-12929", + "CVE-2018-12930", + "CVE-2018-12931", + "CVE-2018-17977", + "CVE-2019-14899", + "CVE-2019-15213", + "CVE-2019-15794", + "CVE-2019-19378", + "CVE-2019-19814", + "CVE-2019-20426", + "CVE-2020-14304", + "CVE-2020-35501", + "CVE-2021-26934", + "CVE-2021-3714", + "CVE-2021-3864", + "CVE-2022-0400", + "CVE-2022-0480", + "CVE-2022-1247", + "CVE-2022-25836", + "CVE-2022-2961", + "CVE-2022-3238", + "CVE-2022-41848", + "CVE-2022-44034", + "CVE-2022-4543", + "CVE-2022-45885", + "CVE-2022-48846", + "CVE-2022-48929", + "CVE-2022-49940", + "CVE-2022-50090", + "CVE-2022-50230", + "CVE-2022-50232", + "CVE-2022-50240", + "CVE-2022-50380", + "CVE-2022-50551", + "CVE-2023-0030", + "CVE-2023-0160", + "CVE-2023-1193", + "CVE-2023-26242", + "CVE-2023-31082", + "CVE-2023-33053", + "CVE-2023-52879", + "CVE-2023-53642", + "CVE-2023-54105", + "CVE-2023-54187", + "CVE-2023-54190", + "CVE-2023-6238", + "CVE-2024-0564", + "CVE-2024-35895", + "CVE-2024-35995", + "CVE-2024-53216", + "CVE-2024-56568", + "CVE-2025-40190", + "CVE-2026-100070", + "CVE-2026-100071", + "CVE-2026-100072", + "CVE-2026-100073", + "CVE-2026-100074", + "CVE-2026-100075", + "CVE-2026-100076", + "CVE-2026-100077", + "CVE-2026-100078", + "CVE-2026-100079", + "CVE-2026-46055", + "CVE-2026-64190", + "CVE-2026-68086", + "CVE-2026-68102", + "CVE-2026-68103", + "CVE-2026-68305", + "CVE-2026-68451", + "CVE-2026-68452", + "CVE-2026-68453", + "CVE-2026-72094", + "CVE-2026-72198", + "CVE-2026-72200", + "CVE-2026-72203", + "CVE-2026-72344", + "CVE-2026-72404", + "CVE-2026-72497", + "CVE-2026-74342", + "CVE-2026-74440", + "CVE-2026-74441", + "CVE-2026-74442", + "CVE-2026-74443", + "CVE-2026-74444", + "CVE-2026-74445", + "CVE-2026-74446", + "CVE-2026-74447", + "CVE-2026-74448", + "CVE-2026-74449", + "CVE-2026-74450", + "CVE-2026-74451", + "CVE-2026-74452", + "CVE-2026-74453", + "CVE-2026-74454", + "CVE-2026-74455", + "CVE-2026-74456", + "CVE-2026-74457", + "CVE-2026-74458", + "CVE-2026-74459", + "CVE-2026-74460", + "CVE-2026-74461", + "CVE-2026-74462", + "CVE-2026-74463", + "CVE-2026-74464", + "CVE-2026-74465", + "CVE-2026-74466", + "CVE-2026-74467", + "CVE-2026-74468", + "CVE-2026-74469", + "CVE-2026-74470", + "CVE-2026-74471", + "CVE-2026-74472", + "CVE-2026-74473", + "CVE-2026-74474", + "CVE-2026-74475", + "CVE-2026-74476", + "CVE-2026-74477", + "CVE-2026-74478", + "CVE-2026-74479", + "CVE-2026-74480", + "CVE-2026-74481", + "CVE-2026-74482", + "CVE-2026-74483", + "CVE-2026-74484", + "CVE-2026-74485", + "CVE-2026-74486", + "CVE-2026-74487", + "CVE-2026-74488", + "CVE-2026-74490", + "CVE-2026-74491", + "CVE-2026-74492", + "CVE-2026-74493", + "CVE-2026-74494", + "CVE-2026-74495", + "CVE-2026-74496", + "CVE-2026-74497", + "CVE-2026-74498", + "CVE-2026-74499", + "CVE-2026-74500", + "CVE-2026-74501", + "CVE-2026-74502", + "CVE-2026-74503", + "CVE-2026-74504", + "CVE-2026-74505", + "CVE-2026-74506", + "CVE-2026-74507", + "CVE-2026-74508", + "CVE-2026-74509", + "CVE-2026-74510", + "CVE-2026-74512", + "CVE-2026-74513", + "CVE-2026-74514", + "CVE-2026-74515", + "CVE-2026-74516", + "CVE-2026-74517", + "CVE-2026-74518", + "CVE-2026-74519", + "CVE-2026-74520", + "CVE-2026-74521", + "CVE-2026-74522", + "CVE-2026-74523", + "CVE-2026-74524", + "CVE-2026-74525", + "CVE-2026-74526", + "CVE-2026-74527", + "CVE-2026-74528", + "CVE-2026-74529", + "CVE-2026-74530", + "CVE-2026-74531", + "CVE-2026-74532", + "CVE-2026-74533", + "CVE-2026-74534", + "CVE-2026-74535", + "CVE-2026-74536", + "CVE-2026-74537", + "CVE-2026-74538", + "CVE-2026-74539", + "CVE-2026-74540", + "CVE-2026-74541", + "CVE-2026-74542", + "CVE-2026-74543", + "CVE-2026-74544", + "CVE-2026-74545", + "CVE-2026-74546", + "CVE-2026-74547", + "CVE-2026-74548", + "CVE-2026-74549", + "CVE-2026-74550", + "CVE-2026-74551", + "CVE-2026-74552", + "CVE-2026-74553", + "CVE-2026-74554", + "CVE-2026-74555", + "CVE-2026-74556", + "CVE-2026-74557", + "CVE-2026-74558", + "CVE-2026-74559", + "CVE-2026-74560", + "CVE-2026-74561", + "CVE-2026-74562", + "CVE-2026-74563", + "CVE-2026-74564", + "CVE-2026-74565", + "CVE-2026-74566", + "CVE-2026-74567", + "CVE-2026-74568", + "CVE-2026-74569", + "CVE-2026-74571", + "CVE-2026-74572", + "CVE-2026-74573", + "CVE-2026-74574", + "CVE-2026-74575", + "CVE-2026-74576", + "CVE-2026-74577", + "CVE-2026-74578", + "CVE-2026-74579", + "CVE-2026-74580", + "CVE-2026-74581", + "CVE-2026-74582", + "CVE-2026-74583", + "CVE-2026-74585", + "CVE-2026-74586", + "CVE-2026-74587", + "CVE-2026-74588", + "CVE-2026-74589", + "CVE-2026-74590", + "CVE-2026-74591", + "CVE-2026-74592", + "CVE-2026-74593", + "CVE-2026-74594", + "CVE-2026-74595", + "CVE-2026-74596", + "CVE-2026-74597", + "CVE-2026-74598", + "CVE-2026-74599", + "CVE-2026-74600", + "CVE-2026-74601", + "CVE-2026-74602", + "CVE-2026-74603", + "CVE-2026-74604", + "CVE-2026-74605", + "CVE-2026-74606", + "CVE-2026-74607", + "CVE-2026-74608", + "CVE-2026-74609", + "CVE-2026-74610", + "CVE-2026-74611", + "CVE-2026-74612", + "CVE-2026-74613", + "CVE-2026-74614", + "CVE-2026-74615", + "CVE-2026-74616", + "CVE-2026-74617", + "CVE-2026-74618", + "CVE-2026-74619", + "CVE-2026-74620", + "CVE-2026-74621", + "CVE-2026-74622", + "CVE-2026-74623", + "CVE-2026-74624", + "CVE-2026-74625", + "CVE-2026-74626", + "CVE-2026-74627", + "CVE-2026-74628", + "CVE-2026-74629", + "CVE-2026-74630", + "CVE-2026-74631", + "CVE-2026-74632", + "CVE-2026-74633", + "CVE-2026-74634", + "CVE-2026-74635", + "CVE-2026-74636", + "CVE-2026-74637", + "CVE-2026-74638", + "CVE-2026-74639", + "CVE-2026-74640", + "CVE-2026-74641", + "CVE-2026-74643", + "CVE-2026-74644", + "CVE-2026-74645", + "CVE-2026-74646", + "CVE-2026-74647", + "CVE-2026-74648", + "CVE-2026-74649", + "CVE-2026-74650", + "CVE-2026-74651", + "CVE-2026-74652", + "CVE-2026-74653", + "CVE-2026-74654", + "CVE-2026-74655", + "CVE-2026-74656", + "CVE-2026-74657", + "CVE-2026-74658", + "CVE-2026-74659", + "CVE-2026-74660", + "CVE-2026-74661", + "CVE-2026-74662", + "CVE-2026-74663", + "CVE-2026-74664", + "CVE-2026-74665", + "CVE-2026-74666", + "CVE-2026-74667", + "CVE-2026-74668", + "CVE-2026-74669", + "CVE-2026-74670", + "CVE-2026-74671", + "CVE-2026-74672", + "CVE-2026-74673", + "CVE-2026-74674", + "CVE-2026-74675", + "CVE-2026-74676", + "CVE-2026-74677", + "CVE-2026-74678", + "CVE-2026-74679", + "CVE-2026-74680", + "CVE-2026-74681", + "CVE-2026-74682", + "CVE-2026-74683", + "CVE-2026-74684", + "CVE-2026-74685", + "CVE-2026-74686", + "CVE-2026-74687", + "CVE-2026-74688", + "CVE-2026-74689", + "CVE-2026-74690", + "CVE-2026-74691", + "CVE-2026-74692", + "CVE-2026-74693", + "CVE-2026-74694", + "CVE-2026-74695", + "CVE-2026-74696", + "CVE-2026-74697", + "CVE-2026-74698", + "CVE-2026-74699", + "CVE-2026-74700", + "CVE-2026-74701", + "CVE-2026-74702", + "CVE-2026-74703", + "CVE-2026-74704", + "CVE-2026-74705", + "CVE-2026-74706", + "CVE-2026-74707", + "CVE-2026-74708", + "CVE-2026-74709", + "CVE-2026-74710", + "CVE-2026-74711", + "CVE-2026-74712", + "CVE-2026-74713", + "CVE-2026-74714", + "CVE-2026-74715", + "CVE-2026-74716", + "CVE-2026-74717", + "CVE-2026-74718", + "CVE-2026-74719", + "CVE-2026-74720", + "CVE-2026-74721", + "CVE-2026-74722", + "CVE-2026-74723", + "CVE-2026-74724", + "CVE-2026-74725", + "CVE-2026-74726", + "CVE-2026-74727", + "CVE-2026-74728", + "CVE-2026-74729", + "CVE-2026-74730", + "CVE-2026-74733", + "CVE-2026-74734", + "CVE-2026-74735", + "CVE-2026-74736", + "CVE-2026-74737", + "CVE-2026-74738", + "CVE-2026-74739", + "CVE-2026-74740", + "CVE-2026-74741", + "CVE-2026-74742", + "CVE-2026-74743", + "CVE-2026-74744", + "CVE-2026-74745", + "CVE-2026-74746", + "CVE-2026-74747", + "CVE-2026-74748", + "CVE-2026-74750", + "CVE-2026-74752", + "CVE-2026-74753", + "CVE-2026-74754", + "CVE-2026-80519", + "CVE-2026-80520", + "CVE-2026-80521", + "CVE-2026-80522", + "CVE-2026-80523", + "CVE-2026-80524", + "CVE-2026-80525", + "CVE-2026-80526", + "CVE-2026-80527", + "CVE-2026-80528", + "CVE-2026-80529", + "CVE-2026-80530", + "CVE-2026-80531", + "CVE-2026-80532", + "CVE-2026-80533", + "CVE-2026-80534", + "CVE-2026-80535", + "CVE-2026-80536", + "CVE-2026-80537", + "CVE-2026-80538", + "CVE-2026-80539", + "CVE-2026-80540", + "CVE-2026-80541", + "CVE-2026-80542", + "CVE-2026-80547", + "CVE-2026-80548", + "CVE-2026-80549", + "CVE-2026-80550", + "CVE-2026-80551", + "CVE-2026-80552", + "CVE-2026-80553", + "CVE-2026-80554", + "CVE-2026-80555", + "CVE-2026-80556", + "CVE-2026-80557", + "CVE-2026-80558", + "CVE-2026-80559", + "CVE-2026-80560", + "CVE-2026-80561", + "CVE-2026-80562", + "CVE-2026-80563", + "CVE-2026-80564", + "CVE-2026-80565", + "CVE-2026-80566", + "CVE-2026-80567", + "CVE-2026-80568", + "CVE-2026-80569", + "CVE-2026-80570", + "CVE-2026-80571", + "CVE-2026-80572", + "CVE-2026-80573", + "CVE-2026-80574", + "CVE-2026-80575", + "CVE-2026-80576", + "CVE-2026-80577", + "CVE-2026-80578", + "CVE-2026-80579", + "CVE-2026-80580", + "CVE-2026-80581", + "CVE-2026-80582", + "CVE-2026-80583", + "CVE-2026-80584", + "CVE-2026-80585", + "CVE-2026-80586", + "CVE-2026-80587", + "CVE-2026-80588", + "CVE-2026-80589", + "CVE-2026-80590", + "CVE-2026-80608", + "CVE-2026-80678", + "CVE-2026-80679", + "CVE-2026-80680", + "CVE-2026-80681", + "CVE-2026-80683", + "CVE-2026-80684", + "CVE-2026-80685", + "CVE-2026-80686", + "CVE-2026-80687", + "CVE-2026-80688", + "CVE-2026-80689", + "CVE-2026-80690", + "CVE-2026-80691", + "CVE-2026-80692", + "CVE-2026-80693", + "CVE-2026-80694", + "CVE-2026-80695", + "CVE-2026-80696", + "CVE-2026-80697", + "CVE-2026-80698", + "CVE-2026-80699", + "CVE-2026-80700", + "CVE-2026-80701", + "CVE-2026-80702", + "CVE-2026-80703", + "CVE-2026-80704", + "CVE-2026-80705", + "CVE-2026-80706", + "CVE-2026-80707", + "CVE-2026-80708", + "CVE-2026-80709", + "CVE-2026-80710", + "CVE-2026-80711", + "CVE-2026-80712", + "CVE-2026-80713", + "CVE-2026-80714", + "CVE-2026-80715", + "CVE-2026-80716", + "CVE-2026-80717", + "CVE-2026-80718", + "CVE-2026-80720", + "CVE-2026-80721", + "CVE-2026-80722", + "CVE-2026-80723", + "CVE-2026-80724", + "CVE-2026-80727", + "CVE-2026-80729", + "CVE-2026-80730", + "CVE-2026-80731", + "CVE-2026-80732", + "CVE-2026-80733", + "CVE-2026-80734", + "CVE-2026-80735", + "CVE-2026-80736", + "CVE-2026-80737", + "CVE-2026-80738", + "CVE-2026-80739", + "CVE-2026-80740", + "CVE-2026-80741", + "CVE-2026-80742", + "CVE-2026-80743", + "CVE-2026-80744", + "CVE-2026-80745", + "CVE-2026-80747", + "CVE-2026-80748", + "CVE-2026-80749", + "CVE-2026-80750", + "CVE-2026-80751", + "CVE-2026-80752", + "CVE-2026-80753", + "CVE-2026-80754", + "CVE-2026-80755", + "CVE-2026-80756", + "CVE-2026-80757", + "CVE-2026-80758", + "CVE-2026-80759", + "CVE-2026-80760", + "CVE-2026-80761", + "CVE-2026-80762", + "CVE-2026-80763", + "CVE-2026-80764", + "CVE-2026-80765", + "CVE-2026-80766", + "CVE-2026-80767", + "CVE-2026-80768", + "CVE-2026-80769", + "CVE-2026-80770", + "CVE-2026-80771", + "CVE-2026-80772", + "CVE-2026-80774", + "CVE-2026-80775", + "CVE-2026-80776", + "CVE-2026-80777", + "CVE-2026-80778", + "CVE-2026-80779", + "CVE-2026-80780", + "CVE-2026-80781", + "CVE-2026-80782", + "CVE-2026-80783", + "CVE-2026-80784", + "CVE-2026-80785", + "CVE-2026-80786", + "CVE-2026-80787", + "CVE-2026-80788", + "CVE-2026-80789", + "CVE-2026-80790", + "CVE-2026-80791", + "CVE-2026-80792", + "CVE-2026-80793", + "CVE-2026-80794", + "CVE-2026-80795", + "CVE-2026-80796", + "CVE-2026-80797", + "CVE-2026-80798", + "CVE-2026-80799", + "CVE-2026-80800", + "CVE-2026-80801", + "CVE-2026-80802", + "CVE-2026-80803", + "CVE-2026-80804", + "CVE-2026-80805", + "CVE-2026-80806", + "CVE-2026-80807", + "CVE-2026-80808", + "CVE-2026-80809", + "CVE-2026-80810", + "CVE-2026-80811", + "CVE-2026-80812", + "CVE-2026-80813", + "CVE-2026-80814", + "CVE-2026-80815", + "CVE-2026-80816", + "CVE-2026-80817", + "CVE-2026-80818", + "CVE-2026-80819", + "CVE-2026-80820", + "CVE-2026-80821", + "CVE-2026-80822", + "CVE-2026-80823", + "CVE-2026-80824", + "CVE-2026-80825", + "CVE-2026-80826", + "CVE-2026-80827", + "CVE-2026-80828", + "CVE-2026-80829", + "CVE-2026-80830", + "CVE-2026-80831", + "CVE-2026-80832", + "CVE-2026-80833", + "CVE-2026-80834", + "CVE-2026-80835", + "CVE-2026-80836", + "CVE-2026-80837", + "CVE-2026-80838", + "CVE-2026-80839", + "CVE-2026-80840", + "CVE-2026-80841", + "CVE-2026-80842", + "CVE-2026-80843", + "CVE-2026-80844", + "CVE-2026-80845", + "CVE-2026-80846", + "CVE-2026-80847", + "CVE-2026-80848", + "CVE-2026-80849", + "CVE-2026-80850", + "CVE-2026-80851", + "CVE-2026-80852", + "CVE-2026-80854", + "CVE-2026-80855", + "CVE-2026-80856", + "CVE-2026-80857", + "CVE-2026-80858", + "CVE-2026-80859", + "CVE-2026-80860", + "CVE-2026-80861", + "CVE-2026-80862", + "CVE-2026-80863", + "CVE-2026-80864", + "CVE-2026-80887", + "CVE-2026-80888", + "CVE-2026-80889", + "CVE-2026-80890", + "CVE-2026-80891", + "CVE-2026-80892", + "CVE-2026-80893", + "CVE-2026-80894", + "CVE-2026-80895", + "CVE-2026-80896", + "CVE-2026-80897", + "CVE-2026-80898", + "CVE-2026-80899", + "CVE-2026-80900", + "CVE-2026-80901", + "CVE-2026-80902", + "CVE-2026-80903", + "CVE-2026-80904", + "CVE-2026-80905", + "CVE-2026-80906", + "CVE-2026-80907", + "CVE-2026-80908", + "CVE-2026-80909", + "CVE-2026-80910", + "CVE-2026-80911", + "CVE-2026-80912", + "CVE-2026-80913", + "CVE-2026-80914", + "CVE-2026-80915", + "CVE-2026-80916", + "CVE-2026-80917", + "CVE-2026-80918", + "CVE-2026-80920", + "CVE-2026-80921", + "CVE-2026-80922", + "CVE-2026-80923", + "CVE-2026-80924", + "CVE-2026-80925", + "CVE-2026-80926", + "CVE-2026-80927", + "CVE-2026-80928", + "CVE-2026-80929", + "CVE-2026-80930", + "CVE-2026-80931", + "CVE-2026-80932", + "CVE-2026-80933", + "CVE-2026-80934", + "CVE-2026-80935", + "CVE-2026-80936", + "CVE-2026-80937", + "CVE-2026-80938", + "CVE-2026-80939", + "CVE-2026-80940", + "CVE-2026-80941", + "CVE-2026-80942", + "CVE-2026-80943", + "CVE-2026-80944", + "CVE-2026-80945", + "CVE-2026-80946", + "CVE-2026-80947", + "CVE-2026-80948", + "CVE-2026-80949", + "CVE-2026-80950", + "CVE-2026-80951", + "CVE-2026-80952", + "CVE-2026-80953", + "CVE-2026-80954", + "CVE-2026-80955", + "CVE-2026-80956", + "CVE-2026-80957", + "CVE-2026-80958", + "CVE-2026-80959", + "CVE-2026-80960", + "CVE-2026-80961", + "CVE-2026-80962", + "CVE-2026-80963", + "CVE-2026-80964", + "CVE-2026-80965", + "CVE-2026-80966", + "CVE-2026-80967", + "CVE-2026-80968", + "CVE-2026-80969", + "CVE-2026-80970", + "CVE-2026-80971", + "CVE-2026-80972", + "CVE-2026-80973", + "CVE-2026-80974", + "CVE-2026-80975", + "CVE-2026-80976", + "CVE-2026-80977", + "CVE-2026-80978", + "CVE-2026-80979", + "CVE-2026-80980", + "CVE-2026-80981", + "CVE-2026-80982", + "CVE-2026-80983", + "CVE-2026-80984", + "CVE-2026-80985", + "CVE-2026-80986", + "CVE-2026-80987", + "CVE-2026-80988", + "CVE-2026-80989", + "CVE-2026-80990", + "CVE-2026-80991", + "CVE-2026-80992", + "CVE-2026-80993", + "CVE-2026-80994", + "CVE-2026-80996", + "CVE-2026-80997", + "CVE-2026-80999", + "CVE-2026-81000", + "CVE-2026-81001", + "CVE-2026-81002", + "CVE-2026-81003", + "CVE-2026-81004", + "CVE-2026-81005", + "CVE-2026-81006", + "CVE-2026-81007", + "CVE-2026-81008", + "CVE-2026-81009", + "CVE-2026-81010", + "CVE-2026-81011", + "CVE-2026-81012", + "CVE-2026-81013", + "CVE-2026-81014", + "CVE-2026-81015", + "CVE-2026-81016", + "CVE-2026-81017", + "CVE-2026-81018", + "CVE-2026-89437", + "CVE-2026-89438", + "CVE-2026-89439", + "CVE-2026-89440", + "CVE-2026-89441", + "CVE-2026-89442", + "CVE-2026-89443", + "CVE-2026-89444", + "CVE-2026-89445", + "CVE-2026-89446", + "CVE-2026-89447", + "CVE-2026-89448", + "CVE-2026-89449", + "CVE-2026-89450", + "CVE-2026-89451", + "CVE-2026-89452", + "CVE-2026-89453", + "CVE-2026-89454", + "CVE-2026-89455", + "CVE-2026-89456", + "CVE-2026-89457", + "CVE-2026-89458", + "CVE-2026-89460", + "CVE-2026-89461", + "CVE-2026-89462", + "CVE-2026-89463", + "CVE-2026-89464", + "CVE-2026-89465", + "CVE-2026-89466", + "CVE-2026-89467", + "CVE-2026-89468", + "CVE-2026-89469", + "CVE-2026-89470", + "CVE-2026-89471", + "CVE-2026-89472", + "CVE-2026-89473", + "CVE-2026-89474", + "CVE-2026-89475", + "CVE-2026-89476", + "CVE-2026-89477", + "CVE-2026-89478", + "CVE-2026-89479", + "CVE-2026-89480", + "CVE-2026-89481", + "CVE-2026-89482", + "CVE-2026-89483", + "CVE-2026-89484", + "CVE-2026-89485", + "CVE-2026-89486", + "CVE-2026-89487", + "CVE-2026-89488", + "CVE-2026-89489", + "CVE-2026-89490", + "CVE-2026-89491", + "CVE-2026-89492", + "CVE-2026-89493", + "CVE-2026-89494", + "CVE-2026-89495", + "CVE-2026-89496", + "CVE-2026-89497", + "CVE-2026-89498", + "CVE-2026-89500", + "CVE-2026-89501", + "CVE-2026-89502", + "CVE-2026-89503", + "CVE-2026-89504", + "CVE-2026-89506", + "CVE-2026-89507", + "CVE-2026-89508", + "CVE-2026-89509", + "CVE-2026-89510", + "CVE-2026-89511", + "CVE-2026-89512", + "CVE-2026-89513", + "CVE-2026-89514", + "CVE-2026-89515", + "CVE-2026-89517", + "CVE-2026-89518", + "CVE-2026-89519", + "CVE-2026-89520", + "CVE-2026-89521", + "CVE-2026-89522", + "CVE-2026-89523", + "CVE-2026-89524", + "CVE-2026-89525", + "CVE-2026-89526", + "CVE-2026-89527", + "CVE-2026-89528", + "CVE-2026-89529", + "CVE-2026-89530", + "CVE-2026-89531", + "CVE-2026-89532", + "CVE-2026-89533", + "CVE-2026-89534", + "CVE-2026-89535", + "CVE-2026-89536", + "CVE-2026-89537", + "CVE-2026-89538", + "CVE-2026-89539", + "CVE-2026-89540", + "CVE-2026-89541", + "CVE-2026-89542", + "CVE-2026-89543", + "CVE-2026-89544", + "CVE-2026-89545", + "CVE-2026-89546", + "CVE-2026-89547", + "CVE-2026-89548", + "CVE-2026-89549", + "CVE-2026-89550", + "CVE-2026-89551", + "CVE-2026-89552", + "CVE-2026-89553", + "CVE-2026-89554", + "CVE-2026-89555", + "CVE-2026-89556", + "CVE-2026-89557", + "CVE-2026-89558", + "CVE-2026-89559", + "CVE-2026-89560", + "CVE-2026-89561", + "CVE-2026-89562", + "CVE-2026-89563", + "CVE-2026-89564", + "CVE-2026-89565", + "CVE-2026-89566", + "CVE-2026-89567", + "CVE-2026-89568", + "CVE-2026-89569", + "CVE-2026-89570", + "CVE-2026-89571", + "CVE-2026-89572", + "CVE-2026-89573", + "CVE-2026-89574", + "CVE-2026-89575", + "CVE-2026-89576", + "CVE-2026-89577", + "CVE-2026-89578", + "CVE-2026-89579", + "CVE-2026-89580", + "CVE-2026-89581", + "CVE-2026-89582", + "CVE-2026-89583", + "CVE-2026-89584", + "CVE-2026-89585", + "CVE-2026-89586", + "CVE-2026-89587", + "CVE-2026-89588", + "CVE-2026-89589", + "CVE-2026-89590", + "CVE-2026-89591", + "CVE-2026-89592", + "CVE-2026-89593", + "CVE-2026-89594", + "CVE-2026-89595", + "CVE-2026-89596", + "CVE-2026-89597", + "CVE-2026-89598", + "CVE-2026-89599", + "CVE-2026-89600", + "CVE-2026-89601", + "CVE-2026-89602", + "CVE-2026-89604", + "CVE-2026-89605", + "CVE-2026-89606", + "CVE-2026-89607", + "CVE-2026-89608", + "CVE-2026-89609", + "CVE-2026-89615", + "CVE-2026-89616", + "CVE-2026-89617", + "CVE-2026-89618", + "CVE-2026-89619", + "CVE-2026-89620", + "CVE-2026-89621", + "CVE-2026-89622", + "CVE-2026-89623", + "CVE-2026-89624", + "CVE-2026-89625", + "CVE-2026-89626", + "CVE-2026-89627", + "CVE-2026-89628", + "CVE-2026-89629", + "CVE-2026-89630", + "CVE-2026-89631", + "CVE-2026-89632", + "CVE-2026-89633", + "CVE-2026-89634", + "CVE-2026-89636", + "CVE-2026-89637", + "CVE-2026-89638", + "CVE-2026-89640", + "CVE-2026-89641", + "CVE-2026-89642", + "CVE-2026-89643", + "CVE-2026-89644", + "CVE-2026-89645", + "CVE-2026-89646", + "CVE-2026-89647", + "CVE-2026-89648", + "CVE-2026-89649", + "CVE-2026-89650", + "CVE-2026-89651", + "CVE-2026-89652", + "CVE-2026-89653", + "CVE-2026-89654", + "CVE-2026-89655", + "CVE-2026-89656", + "CVE-2026-89657", + "CVE-2026-89658", + "CVE-2026-89659", + "CVE-2026-89660", + "CVE-2026-89661", + "CVE-2026-89662", + "CVE-2026-89663", + "CVE-2026-89664", + "CVE-2026-89665", + "CVE-2026-89666", + "CVE-2026-89667", + "CVE-2026-89668", + "CVE-2026-89669", + "CVE-2026-89670", + "CVE-2026-89671", + "CVE-2026-89672", + "CVE-2026-89673", + "CVE-2026-89674", + "CVE-2026-89675", + "CVE-2026-89676", + "CVE-2026-89677", + "CVE-2026-89678", + "CVE-2026-89679", + "CVE-2026-89680", + "CVE-2026-89682", + "CVE-2026-89683", + "CVE-2026-89684", + "CVE-2026-89685", + "CVE-2026-89686", + "CVE-2026-89687", + "CVE-2026-89688", + "CVE-2026-89689", + "CVE-2026-89690", + "CVE-2026-89691", + "CVE-2026-89692", + "CVE-2026-89693", + "CVE-2026-89694", + "CVE-2026-89695", + "CVE-2026-89696", + "CVE-2026-89697", + "CVE-2026-89698", + "CVE-2026-89699", + "CVE-2026-89700", + "CVE-2026-89701", + "CVE-2026-89702", + "CVE-2026-89703", + "CVE-2026-89704", + "CVE-2026-89705", + "CVE-2026-89706", + "CVE-2026-89707", + "CVE-2026-89708", + "CVE-2026-89709", + "CVE-2026-89710", + "CVE-2026-89711", + "CVE-2026-89712", + "CVE-2026-89713", + "CVE-2026-89714", + "CVE-2026-89715", + "CVE-2026-89716", + "CVE-2026-89717", + "CVE-2026-89718", + "CVE-2026-89719", + "CVE-2026-89720", + "CVE-2026-89721", + "CVE-2026-89722", + "CVE-2026-89723", + "CVE-2026-89724", + "CVE-2026-89725", + "CVE-2026-89726", + "CVE-2026-89727", + "CVE-2026-89728", + "CVE-2026-89729", + "CVE-2026-89730", + "CVE-2026-89731", + "CVE-2026-89732", + "CVE-2026-89733", + "CVE-2026-89734", + "CVE-2026-89735", + "CVE-2026-89736", + "CVE-2026-89737", + "CVE-2026-89738", + "CVE-2026-89739", + "CVE-2026-89740", + "CVE-2026-89741", + "CVE-2026-89742", + "CVE-2026-89743", + "CVE-2026-89744", + "CVE-2026-89745", + "CVE-2026-89746", + "CVE-2026-89747", + "CVE-2026-89749", + "CVE-2026-89750", + "CVE-2026-89751", + "CVE-2026-89752", + "CVE-2026-89753", + "CVE-2026-89754", + "CVE-2026-89755", + "CVE-2026-89756", + "CVE-2026-89757", + "CVE-2026-89758", + "CVE-2026-89759", + "CVE-2026-89761", + "CVE-2026-89762", + "CVE-2026-89763", + "CVE-2026-89764", + "CVE-2026-89765", + "CVE-2026-89766", + "CVE-2026-89767", + "CVE-2026-89768", + "CVE-2026-89769", + "CVE-2026-89771", + "CVE-2026-89772", + "CVE-2026-89775", + "CVE-2026-89776", + "CVE-2026-89777", + "CVE-2026-89778", + "CVE-2026-89779", + "CVE-2026-89780", + "CVE-2026-89781", + "CVE-2026-89782", + "CVE-2026-89783", + "CVE-2026-89784", + "CVE-2026-89785", + "CVE-2026-89786", + "CVE-2026-89787", + "CVE-2026-89788", + "CVE-2026-89789", + "CVE-2026-89790", + "CVE-2026-89791", + "CVE-2026-89792", + "CVE-2026-89793", + "CVE-2026-89794", + "CVE-2026-89795", + "CVE-2026-89796", + "CVE-2026-89797", + "CVE-2026-89798", + "CVE-2026-89799", + "CVE-2026-89800", + "CVE-2026-89801", + "CVE-2026-89802", + "CVE-2026-89803", + "CVE-2026-89804", + "CVE-2026-89805", + "CVE-2026-89806", + "CVE-2026-89807", + "CVE-2026-89808", + "CVE-2026-89809", + "CVE-2026-89810", + "CVE-2026-89811", + "CVE-2026-89812", + "CVE-2026-89813", + "CVE-2026-89814", + "CVE-2026-89815", + "CVE-2026-89816", + "CVE-2026-89817", + "CVE-2026-89818", + "CVE-2026-89819", + "CVE-2026-89820", + "CVE-2026-89821", + "CVE-2026-89822", + "CVE-2026-89823", + "CVE-2026-89824", + "CVE-2026-89825", + "CVE-2026-89826", + "CVE-2026-89827", + "CVE-2026-89828", + "CVE-2026-89829", + "CVE-2026-89830", + "CVE-2026-89831", + "CVE-2026-89832", + "CVE-2026-89833", + "CVE-2026-89834", + "CVE-2026-89835", + "CVE-2026-89836", + "CVE-2026-89837", + "CVE-2026-89838", + "CVE-2026-89839", + "CVE-2026-89840", + "CVE-2026-89841", + "CVE-2026-89842", + "CVE-2026-89843", + "CVE-2026-89844", + "CVE-2026-89845", + "CVE-2026-89846", + "CVE-2026-89847", + "CVE-2026-89848", + "CVE-2026-89849", + "CVE-2026-89850", + "CVE-2026-89851", + "CVE-2026-89852", + "CVE-2026-89853", + "CVE-2026-89854", + "CVE-2026-89855", + "CVE-2026-89856", + "CVE-2026-89857", + "CVE-2026-89858", + "CVE-2026-89859", + "CVE-2026-89860", + "CVE-2026-89861", + "CVE-2026-89862", + "CVE-2026-89863", + "CVE-2026-89864", + "CVE-2026-89865", + "CVE-2026-89866", + "CVE-2026-89867", + "CVE-2026-89868", + "CVE-2026-89869", + "CVE-2026-89870", + "CVE-2026-89871", + "CVE-2026-89872", + "CVE-2026-89873", + "CVE-2026-89874", + "CVE-2026-89875", + "CVE-2026-89876", + "CVE-2026-89877", + "CVE-2026-89878", + "CVE-2026-89879", + "CVE-2026-89880", + "CVE-2026-89881", + "CVE-2026-89882", + "CVE-2026-89883", + "CVE-2026-89884", + "CVE-2026-89885", + "CVE-2026-89886", + "CVE-2026-89887", + "CVE-2026-89888", + "CVE-2026-89889", + "CVE-2026-89890", + "CVE-2026-89891", + "CVE-2026-89892", + "CVE-2026-89893", + "CVE-2026-89894", + "CVE-2026-89895", + "CVE-2026-89896", + "CVE-2026-89897", + "CVE-2026-89898", + "CVE-2026-89899", + "CVE-2026-89901", + "CVE-2026-89902", + "CVE-2026-89903", + "CVE-2026-89904", + "CVE-2026-89905", + "CVE-2026-89906", + "CVE-2026-89907", + "CVE-2026-89908", + "CVE-2026-89909", + "CVE-2026-89911", + "CVE-2026-89912", + "CVE-2026-89913", + "CVE-2026-89914", + "CVE-2026-89915", + "CVE-2026-89916", + "CVE-2026-89917", + "CVE-2026-89918", + "CVE-2026-89919", + "CVE-2026-89920", + "CVE-2026-89921", + "CVE-2026-89922", + "CVE-2026-89923", + "CVE-2026-89924", + "CVE-2026-89925", + "CVE-2026-89926", + "CVE-2026-89927", + "CVE-2026-89928", + "CVE-2026-89929", + "CVE-2026-89930", + "CVE-2026-89931", + "CVE-2026-89932", + "CVE-2026-89933", + "CVE-2026-89934", + "CVE-2026-89935", + "CVE-2026-89936", + "CVE-2026-89937", + "CVE-2026-89938", + "CVE-2026-89939", + "CVE-2026-89940", + "CVE-2026-89941", + "CVE-2026-89942", + "CVE-2026-89944", + "CVE-2026-89945", + "CVE-2026-89946", + "CVE-2026-89947", + "CVE-2026-89948", + "CVE-2026-89949", + "CVE-2026-89950", + "CVE-2026-89951", + "CVE-2026-89952", + "CVE-2026-89953", + "CVE-2026-89954", + "CVE-2026-89955", + "CVE-2026-89956", + "CVE-2026-89957", + "CVE-2026-89958", + "CVE-2026-89959", + "CVE-2026-89960", + "CVE-2026-89961", + "CVE-2026-89962", + "CVE-2026-89963", + "CVE-2026-89964", + "CVE-2026-89965", + "CVE-2026-89966", + "CVE-2026-89967", + "CVE-2026-89968", + "CVE-2026-89969", + "CVE-2026-89970", + "CVE-2026-89971", + "CVE-2026-89972", + "CVE-2026-89973", + "CVE-2026-89974", + "CVE-2026-89975", + "CVE-2026-89976", + "CVE-2026-89977", + "CVE-2026-89978", + "CVE-2026-89979", + "CVE-2026-89981", + "CVE-2026-89982", + "CVE-2026-89983", + "CVE-2026-89984", + "CVE-2026-89986", + "CVE-2026-89987", + "CVE-2026-89988", + "CVE-2026-89989", + "CVE-2026-89990", + "CVE-2026-89991", + "CVE-2026-89992", + "CVE-2026-89993", + "CVE-2026-89994", + "CVE-2026-89995", + "CVE-2026-89996", + "CVE-2026-89997", + "CVE-2026-89998", + "CVE-2026-89999", + "CVE-2026-90000", + "CVE-2026-90001", + "CVE-2026-90002", + "CVE-2026-90003", + "CVE-2026-90005", + "CVE-2026-90006", + "CVE-2026-90007", + "CVE-2026-90008", + "CVE-2026-90011", + "CVE-2026-90012", + "CVE-2026-90013", + "CVE-2026-90014", + "CVE-2026-90015", + "CVE-2026-90016", + "CVE-2026-90017", + "CVE-2026-90018", + "CVE-2026-90019", + "CVE-2026-90020", + "CVE-2026-90021", + "CVE-2026-90022", + "CVE-2026-90023", + "CVE-2026-90024", + "CVE-2026-90025", + "CVE-2026-90026", + "CVE-2026-90027", + "CVE-2026-90028", + "CVE-2026-90029", + "CVE-2026-90030", + "CVE-2026-90031", + "CVE-2026-90032", + "CVE-2026-90033", + "CVE-2026-90034", + "CVE-2026-90035", + "CVE-2026-90036", + "CVE-2026-90037", + "CVE-2026-90039", + "CVE-2026-90040", + "CVE-2026-90041", + "CVE-2026-90042", + "CVE-2026-90043", + "CVE-2026-90044", + "CVE-2026-90045", + "CVE-2026-90046", + "CVE-2026-90047", + "CVE-2026-90048", + "CVE-2026-90049", + "CVE-2026-90051", + "CVE-2026-90053", + "CVE-2026-90054", + "CVE-2026-90055", + "CVE-2026-90056", + "CVE-2026-90057", + "CVE-2026-90058", + "CVE-2026-90059", + "CVE-2026-90060", + "CVE-2026-90061", + "CVE-2026-90062", + "CVE-2026-90063", + "CVE-2026-90065", + "CVE-2026-90066", + "CVE-2026-90067", + "CVE-2026-90068", + "CVE-2026-90069", + "CVE-2026-90070", + "CVE-2026-90071", + "CVE-2026-90072", + "CVE-2026-90073", + "CVE-2026-90074", + "CVE-2026-90075", + "CVE-2026-90076", + "CVE-2026-90077", + "CVE-2026-90078", + "CVE-2026-90079", + "CVE-2026-90080", + "CVE-2026-90081", + "CVE-2026-90082", + "CVE-2026-90083", + "CVE-2026-90084", + "CVE-2026-90085", + "CVE-2026-90086", + "CVE-2026-90087", + "CVE-2026-90088", + "CVE-2026-90089", + "CVE-2026-90090", + "CVE-2026-90091", + "CVE-2026-90092", + "CVE-2026-90093", + "CVE-2026-90094", + "CVE-2026-90095", + "CVE-2026-90097", + "CVE-2026-90098", + "CVE-2026-90099", + "CVE-2026-90100", + "CVE-2026-90101", + "CVE-2026-90102", + "CVE-2026-90103", + "CVE-2026-90104", + "CVE-2026-90105", + "CVE-2026-90106", + "CVE-2026-90107", + "CVE-2026-90108", + "CVE-2026-90109", + "CVE-2026-90110", + "CVE-2026-90111", + "CVE-2026-90112", + "CVE-2026-90113", + "CVE-2026-90114", + "CVE-2026-90115", + "CVE-2026-90116", + "CVE-2026-90119", + "CVE-2026-90120", + "CVE-2026-90121", + "CVE-2026-90122", + "CVE-2026-90124", + "CVE-2026-90125", + "CVE-2026-90126", + "CVE-2026-90127", + "CVE-2026-90128", + "CVE-2026-90129", + "CVE-2026-90130", + "CVE-2026-90135", + "CVE-2026-90136", + "CVE-2026-90137", + "CVE-2026-90138", + "CVE-2026-90139", + "CVE-2026-90140", + "CVE-2026-90141", + "CVE-2026-90142", + "CVE-2026-90143", + "CVE-2026-90144", + "CVE-2026-90145", + "CVE-2026-90146", + "CVE-2026-90147", + "CVE-2026-90148", + "CVE-2026-90149", + "CVE-2026-90150", + "CVE-2026-90151", + "CVE-2026-90152", + "CVE-2026-90153", + "CVE-2026-90154", + "CVE-2026-90155", + "CVE-2026-90156", + "CVE-2026-90157", + "CVE-2026-90158", + "CVE-2026-90159", + "CVE-2026-90160", + "CVE-2026-90161", + "CVE-2026-90162", + "CVE-2026-90163", + "CVE-2026-90164", + "CVE-2026-90165", + "CVE-2026-90166", + "CVE-2026-90167", + "CVE-2026-90169", + "CVE-2026-90170", + "CVE-2026-90174", + "CVE-2026-90175", + "CVE-2026-90176", + "CVE-2026-90177", + "CVE-2026-90178", + "CVE-2026-90179", + "CVE-2026-90180", + "CVE-2026-90182", + "CVE-2026-90183", + "CVE-2026-90184", + "CVE-2026-90185", + "CVE-2026-90186", + "CVE-2026-90187", + "CVE-2026-90188", + "CVE-2026-90189", + "CVE-2026-90190", + "CVE-2026-90191", + "CVE-2026-90192", + "CVE-2026-90193", + "CVE-2026-90194", + "CVE-2026-90195", + "CVE-2026-90196", + "CVE-2026-90197", + "CVE-2026-90198", + "CVE-2026-90199", + "CVE-2026-90200", + "CVE-2026-90201", + "CVE-2026-90202", + "CVE-2026-90203", + "CVE-2026-90204", + "CVE-2026-90205", + "CVE-2026-90206", + "CVE-2026-90207", + "CVE-2026-90208", + "CVE-2026-90209", + "CVE-2026-90211", + "CVE-2026-90212", + "CVE-2026-90213", + "CVE-2026-90214", + "CVE-2026-90215", + "CVE-2026-90216", + "CVE-2026-90217", + "CVE-2026-90218", + "CVE-2026-90219", + "CVE-2026-90220", + "CVE-2026-90221", + "CVE-2026-90222", + "CVE-2026-90223", + "CVE-2026-90224", + "CVE-2026-90225", + "CVE-2026-90226", + "CVE-2026-90227", + "CVE-2026-90228", + "CVE-2026-90229", + "CVE-2026-90230", + "CVE-2026-90231", + "CVE-2026-90232", + "CVE-2026-90233", + "CVE-2026-90234", + "CVE-2026-90235", + "CVE-2026-90237", + "CVE-2026-90240", + "CVE-2026-90241", + "CVE-2026-90242", + "CVE-2026-90243", + "CVE-2026-90244", + "CVE-2026-90245", + "CVE-2026-90246", + "CVE-2026-90247", + "CVE-2026-90248", + "CVE-2026-90249", + "CVE-2026-90250", + "CVE-2026-90251", + "CVE-2026-90252", + "CVE-2026-90253", + "CVE-2026-90254", + "CVE-2026-90255", + "CVE-2026-90256", + "CVE-2026-90257", + "CVE-2026-90258", + "CVE-2026-90259", + "CVE-2026-90260", + "CVE-2026-90261", + "CVE-2026-90262", + "CVE-2026-90263", + "CVE-2026-90264", + "CVE-2026-90265", + "CVE-2026-90267", + "CVE-2026-90269", + "CVE-2026-90270", + "CVE-2026-90271", + "CVE-2026-90272", + "CVE-2026-90273", + "CVE-2026-90274", + "CVE-2026-90275", + "CVE-2026-90276", + "CVE-2026-90277", + "CVE-2026-90278", + "CVE-2026-90279", + "CVE-2026-90280", + "CVE-2026-90281", + "CVE-2026-90282", + "CVE-2026-90283", + "CVE-2026-90284", + "CVE-2026-90285", + "CVE-2026-90286", + "CVE-2026-90287", + "CVE-2026-90288", + "CVE-2026-90289", + "CVE-2026-90290", + "CVE-2026-90291", + "CVE-2026-90292", + "CVE-2026-90293", + "CVE-2026-90294", + "CVE-2026-90295", + "CVE-2026-90296", + "CVE-2026-90297", + "CVE-2026-90298", + "CVE-2026-90300", + "CVE-2026-90301", + "CVE-2026-90302", + "CVE-2026-90303", + "CVE-2026-90306", + "CVE-2026-90307", + "CVE-2026-90308", + "CVE-2026-90309", + "CVE-2026-90311", + "CVE-2026-90312", + "CVE-2026-90313", + "CVE-2026-90314", + "CVE-2026-90315", + "CVE-2026-90316", + "CVE-2026-90317", + "CVE-2026-90318", + "CVE-2026-90319", + "CVE-2026-90320", + "CVE-2026-90321", + "CVE-2026-90322", + "CVE-2026-90323", + "CVE-2026-90324", + "CVE-2026-90325", + "CVE-2026-90326", + "CVE-2026-90327", + "CVE-2026-90328", + "CVE-2026-90329", + "CVE-2026-90330", + "CVE-2026-90331", + "CVE-2026-90332", + "CVE-2026-90333", + "CVE-2026-90334", + "CVE-2026-90335", + "CVE-2026-90336", + "CVE-2026-90337", + "CVE-2026-90338", + "CVE-2026-90341", + "CVE-2026-90342", + "CVE-2026-90343", + "CVE-2026-90344", + "CVE-2026-90345", + "CVE-2026-90346", + "CVE-2026-90347", + "CVE-2026-90348", + "CVE-2026-90349", + "CVE-2026-90350", + "CVE-2026-90351", + "CVE-2026-90352", + "CVE-2026-90353", + "CVE-2026-90354", + "CVE-2026-90355", + "CVE-2026-90356", + "CVE-2026-90357", + "CVE-2026-90358", + "CVE-2026-90359", + "CVE-2026-90360", + "CVE-2026-90361", + "CVE-2026-90362", + "CVE-2026-90363", + "CVE-2026-90364", + "CVE-2026-90365", + "CVE-2026-90366", + "CVE-2026-90367", + "CVE-2026-90368", + "CVE-2026-90369", + "CVE-2026-90370", + "CVE-2026-90371", + "CVE-2026-90372", + "CVE-2026-90373", + "CVE-2026-90374", + "CVE-2026-90375", + "CVE-2026-90376", + "CVE-2026-90377", + "CVE-2026-90378", + "CVE-2026-90379", + "CVE-2026-90380", + "CVE-2026-90381", + "CVE-2026-90382", + "CVE-2026-90383", + "CVE-2026-90384", + "CVE-2026-90385", + "CVE-2026-90386", + "CVE-2026-90387", + "CVE-2026-90388", + "CVE-2026-90389", + "CVE-2026-90390", + "CVE-2026-90391", + "CVE-2026-90392", + "CVE-2026-90393", + "CVE-2026-90394", + "CVE-2026-90395", + "CVE-2026-90396", + "CVE-2026-90397", + "CVE-2026-90398", + "CVE-2026-90399", + "CVE-2026-90400", + "CVE-2026-90401", + "CVE-2026-90402", + "CVE-2026-90403", + "CVE-2026-90404", + "CVE-2026-90406", + "CVE-2026-90407", + "CVE-2026-90408", + "CVE-2026-90409", + "CVE-2026-90410", + "CVE-2026-90411", + "CVE-2026-90412", + "CVE-2026-90413", + "CVE-2026-90414", + "CVE-2026-90415", + "CVE-2026-90416", + "CVE-2026-90417", + "CVE-2026-90418", + "CVE-2026-90419", + "CVE-2026-90420", + "CVE-2026-90421", + "CVE-2026-90422", + "CVE-2026-90423", + "CVE-2026-90424", + "CVE-2026-90425", + "CVE-2026-90426", + "CVE-2026-90427", + "CVE-2026-90428", + "CVE-2026-90429", + "CVE-2026-90430", + "CVE-2026-90431", + "CVE-2026-90433", + "CVE-2026-90434", + "CVE-2026-90435", + "CVE-2026-92476", + "CVE-2026-92477", + "CVE-2026-92479", + "CVE-2026-92480", + "CVE-2026-92481", + "CVE-2026-92482", + "CVE-2026-92483", + "CVE-2026-92484", + "CVE-2026-92485", + "CVE-2026-92486", + "CVE-2026-92488", + "CVE-2026-92489", + "CVE-2026-92490", + "CVE-2026-92491", + "CVE-2026-92493", + "CVE-2026-92494", + "CVE-2026-92495", + "CVE-2026-92496", + "CVE-2026-92497", + "CVE-2026-92498", + "CVE-2026-92499", + "CVE-2026-92500", + "CVE-2026-92501", + "CVE-2026-92503", + "CVE-2026-92504", + "CVE-2026-92505", + "CVE-2026-92506", + "CVE-2026-92507", + "CVE-2026-92508", + "CVE-2026-92509", + "CVE-2026-92510", + "CVE-2026-92511", + "CVE-2026-92512", + "CVE-2026-92513", + "CVE-2026-92514", + "CVE-2026-92515", + "CVE-2026-92516", + "CVE-2026-92517", + "CVE-2026-92518", + "CVE-2026-92519", + "CVE-2026-92520", + "CVE-2026-92521", + "CVE-2026-92522", + "CVE-2026-92523", + "CVE-2026-92524", + "CVE-2026-92525", + "CVE-2026-93037", + "CVE-2026-93039", + "CVE-2026-93040", + "CVE-2026-93041", + "CVE-2026-93042", + "CVE-2026-93043", + "CVE-2026-93044", + "CVE-2026-93045", + "CVE-2026-93046", + "CVE-2026-93047", + "CVE-2026-93048", + "CVE-2026-93049", + "CVE-2026-93050", + "CVE-2026-93051", + "CVE-2026-93052", + "CVE-2026-93053", + "CVE-2026-93054", + "CVE-2026-93055", + "CVE-2026-93056", + "CVE-2026-93058", + "CVE-2026-93059", + "CVE-2026-93061", + "CVE-2026-93062", + "CVE-2026-93063", + "CVE-2026-93064", + "CVE-2026-93065", + "CVE-2026-93066", + "CVE-2026-93067", + "CVE-2026-93068", + "CVE-2026-93069", + "CVE-2026-93070", + "CVE-2026-93071", + "CVE-2026-93072", + "CVE-2026-93073", + "CVE-2026-93077", + "CVE-2026-93078", + "CVE-2026-93079", + "CVE-2026-93080", + "CVE-2026-93081", + "CVE-2026-93082", + "CVE-2026-93083", + "CVE-2026-93084", + "CVE-2026-93085", + "CVE-2026-93086", + "CVE-2026-93089", + "CVE-2026-93090", + "CVE-2026-93091", + "CVE-2026-93092", + "CVE-2026-93093", + "CVE-2026-93094", + "CVE-2026-93095", + "CVE-2026-93096", + "CVE-2026-93097", + "CVE-2026-93098", + "CVE-2026-93099", + "CVE-2026-93100", + "CVE-2026-93101", + "CVE-2026-93102", + "CVE-2026-93103", + "CVE-2026-93104", + "CVE-2026-93105", + "CVE-2026-93106", + "CVE-2026-93107", + "CVE-2026-93108", + "CVE-2026-93109", + "CVE-2026-93110", + "CVE-2026-93112", + "CVE-2026-93113", + "CVE-2026-93114", + "CVE-2026-93115", + "CVE-2026-93116", + "CVE-2026-93117", + "CVE-2026-93118", + "CVE-2026-93119", + "CVE-2026-93120", + "CVE-2026-93121", + "CVE-2026-93122", + "CVE-2026-93123", + "CVE-2026-93125", + "CVE-2026-93126", + "CVE-2026-93127", + "CVE-2026-93128", + "CVE-2026-93129", + "CVE-2026-93130", + "CVE-2026-93131", + "CVE-2026-93132", + "CVE-2026-93133", + "CVE-2026-93134", + "CVE-2026-93135", + "CVE-2026-93136", + "CVE-2026-93137", + "CVE-2026-93138", + "CVE-2026-93140", + "CVE-2026-93141", + "CVE-2026-93142", + "CVE-2026-93143", + "CVE-2026-93144", + "CVE-2026-93145", + "CVE-2026-93146", + "CVE-2026-93148", + "CVE-2026-93149", + "CVE-2026-93150", + "CVE-2026-93151", + "CVE-2026-93152", + "CVE-2026-93153", + "CVE-2026-93154", + "CVE-2026-93155", + "CVE-2026-93156", + "CVE-2026-93157", + "CVE-2026-93158", + "CVE-2026-93159", + "CVE-2026-93160", + "CVE-2026-93161", + "CVE-2026-93162", + "CVE-2026-93163", + "CVE-2026-93164", + "CVE-2026-93165", + "CVE-2026-93167", + "CVE-2026-93168", + "CVE-2026-93169", + "CVE-2026-93170", + "CVE-2026-93172", + "CVE-2026-93173", + "CVE-2026-93174", + "CVE-2026-93175", + "CVE-2026-93176", + "CVE-2026-93177", + "CVE-2026-93178", + "CVE-2026-93179", + "CVE-2026-93180", + "CVE-2026-93181", + "CVE-2026-93182", + "CVE-2026-93183", + "CVE-2026-93184", + "CVE-2026-93185", + "CVE-2026-93186", + "CVE-2026-93188", + "CVE-2026-93189", + "CVE-2026-93190", + "CVE-2026-93191", + "CVE-2026-93192", + "CVE-2026-93193", + "CVE-2026-93194", + "CVE-2026-93195", + "CVE-2026-93196", + "CVE-2026-93198", + "CVE-2026-93199", + "CVE-2026-93200", + "CVE-2026-93201", + "CVE-2026-93202", + "CVE-2026-93203", + "CVE-2026-93204", + "CVE-2026-93205", + "CVE-2026-93206", + "CVE-2026-93207", + "CVE-2026-93208", + "CVE-2026-93209", + "CVE-2026-93210", + "CVE-2026-93211", + "CVE-2026-93212", + "CVE-2026-93213", + "CVE-2026-93214", + "CVE-2026-93215", + "CVE-2026-93216", + "CVE-2026-93217", + "CVE-2026-93218", + "CVE-2026-93219", + "CVE-2026-93220", + "CVE-2026-93221", + "CVE-2026-93222", + "CVE-2026-93223", + "CVE-2026-93224", + "CVE-2026-93225", + "CVE-2026-93226", + "CVE-2026-93227", + "CVE-2026-93228", + "CVE-2026-93229", + "CVE-2026-93230", + "CVE-2026-93231", + "CVE-2026-93233", + "CVE-2026-93234", + "CVE-2026-93235", + "CVE-2026-93236", + "CVE-2026-93237", + "CVE-2026-93238", + "CVE-2026-93239", + "CVE-2026-93240", + "CVE-2026-93241", + "CVE-2026-93242", + "CVE-2026-93243", + "CVE-2026-93244", + "CVE-2026-93245", + "CVE-2026-93247", + "CVE-2026-93248", + "CVE-2026-93249", + "CVE-2026-93250", + "CVE-2026-93251", + "CVE-2026-93252", + "CVE-2026-93253", + "CVE-2026-93255", + "CVE-2026-93256", + "CVE-2026-93258", + "CVE-2026-93259", + "CVE-2026-93260", + "CVE-2026-93261", + "CVE-2026-93262", + "CVE-2026-93264", + "CVE-2026-93265", + "CVE-2026-93266", + "CVE-2026-93267", + "CVE-2026-93268", + "CVE-2026-93269", + "CVE-2026-93270", + "CVE-2026-93271", + "CVE-2026-93272", + "CVE-2026-93273", + "CVE-2026-93274", + "CVE-2026-93275", + "CVE-2026-93276", + "CVE-2026-93278", + "CVE-2026-93279", + "CVE-2026-93280", + "CVE-2026-93281", + "CVE-2026-93282", + "CVE-2026-93283", + "CVE-2026-93284", + "CVE-2026-93285", + "CVE-2026-93286", + "CVE-2026-93287", + "CVE-2026-93288", + "CVE-2026-93781", + "CVE-2026-93782", + "CVE-2026-93783", + "CVE-2026-93784", + "CVE-2026-93785", + "CVE-2026-93786", + "CVE-2026-93787", + "CVE-2026-93788", + "CVE-2026-93789", + "CVE-2026-93790", + "CVE-2026-93791", + "CVE-2026-93792", + "CVE-2026-93793", + "CVE-2026-93794", + "CVE-2026-93795", + "CVE-2026-93796", + "CVE-2026-93797", + "CVE-2026-93798", + "CVE-2026-93799", + "CVE-2026-93800", + "CVE-2026-93801", + "CVE-2026-93802", + "CVE-2026-93803", + "CVE-2026-93804", + "CVE-2026-93805", + "CVE-2026-93806", + "CVE-2026-93807", + "CVE-2026-93808", + "CVE-2026-93809", + "CVE-2026-93810", + "CVE-2026-93811", + "CVE-2026-93812", + "CVE-2026-93813", + "CVE-2026-93814", + "CVE-2026-93815", + "CVE-2026-93816", + "CVE-2026-93817", + "CVE-2026-93818", + "CVE-2026-93819", + "CVE-2026-93820", + "CVE-2026-93821", + "CVE-2026-93822", + "CVE-2026-93823", + "CVE-2026-93824", + "CVE-2026-93825", + "CVE-2026-93826", + "CVE-2026-93827", + "CVE-2026-93828", + "CVE-2026-93829", + "CVE-2026-93830", + "CVE-2026-97407", + "CVE-2026-97408", + "CVE-2026-97409", + "CVE-2026-97410", + "CVE-2026-97411", + "CVE-2026-97412", + "CVE-2026-97413", + "CVE-2026-97414", + "CVE-2026-97415", + "CVE-2026-97416", + "CVE-2026-97417", + "CVE-2026-97418", + "CVE-2026-97419", + "CVE-2026-97420", + "CVE-2026-97421", + "CVE-2026-97422", + "CVE-2026-97423", + "CVE-2026-97424", + "CVE-2026-97425", + "CVE-2026-97426", + "CVE-2026-97427", + "CVE-2026-97428", + "CVE-2026-97429", + "CVE-2026-97430", + "CVE-2026-97431", + "CVE-2026-97432", + "CVE-2026-97433", + "CVE-2026-97434", + "CVE-2026-97435", + "CVE-2026-97436", + "CVE-2026-97437", + "CVE-2026-97438", + "CVE-2026-97439", + "CVE-2026-97440", + "CVE-2026-97441", + "CVE-2026-97442", + "CVE-2026-97443", + "CVE-2026-97444", + "CVE-2026-97445", + "CVE-2026-97446", + "CVE-2026-97447", + "CVE-2026-97448", + "CVE-2026-97449", + "CVE-2026-97450", + "CVE-2026-97451", + "CVE-2026-97452", + "CVE-2026-97453", + "CVE-2026-97454", + "CVE-2026-97455", + "CVE-2026-97456", + "CVE-2026-97472", + "CVE-2026-97473", + "CVE-2026-97474", + "CVE-2026-97475", + "CVE-2026-97476", + "CVE-2026-97477", + "CVE-2026-97478", + "CVE-2026-97479", + "CVE-2026-97480", + "CVE-2026-97481", + "CVE-2026-97482", + "CVE-2026-97483", + "CVE-2026-97484", + "CVE-2026-97485", + "CVE-2026-97486", + "CVE-2026-97487", + "CVE-2026-97488", + "CVE-2026-97489", + "CVE-2026-97490", + "CVE-2026-97491", + "CVE-2026-97492", + "CVE-2026-97493", + "CVE-2026-97494", + "CVE-2026-97495", + "CVE-2026-97496", + "CVE-2026-97497", + "CVE-2026-97498", + "CVE-2026-97499", + "CVE-2026-97500", + "CVE-2026-97501", + "CVE-2026-97502", + "CVE-2026-97503", + "CVE-2026-97505", + "CVE-2026-97506", + "CVE-2026-97507", + "CVE-2026-97508", + "CVE-2026-97509", + "CVE-2026-97510", + "CVE-2026-97511", + "CVE-2026-97512", + "CVE-2026-97513", + "CVE-2026-97514", + "CVE-2026-97515", + "CVE-2026-97516", + "CVE-2026-97517", + "CVE-2026-97518", + "CVE-2026-97519", + "CVE-2026-97520", + "CVE-2026-97521", + "CVE-2026-97522", + "CVE-2026-97523", + "CVE-2026-97524", + "CVE-2026-97525", + "CVE-2026-97526", + "CVE-2026-97527", + "CVE-2026-97528", + "CVE-2026-97529", + "CVE-2026-97530", + "CVE-2026-97531", + "CVE-2026-97532", + "CVE-2026-97533", + "CVE-2026-97534", + "CVE-2026-97535", + "CVE-2026-97536", + "CVE-2026-97537", + "CVE-2026-97538", + "CVE-2026-97539", + "CVE-2026-97540", + "CVE-2026-97541", + "CVE-2026-97542", + "CVE-2026-97543", + "CVE-2026-97544", + "CVE-2026-97545", + "CVE-2026-97546", + "CVE-2026-97547", + "CVE-2026-97548", + "CVE-2026-97549", + "CVE-2026-97550", + "CVE-2026-97551", + "CVE-2026-97552", + "CVE-2026-97553", + "CVE-2026-97554", + "CVE-2026-97555", + "CVE-2026-97556", + "CVE-2026-97557", + "CVE-2026-97558", + "CVE-2026-97559", + "CVE-2026-97560", + "CVE-2026-97561", + "CVE-2026-97562", + "CVE-2026-97563", + "CVE-2026-97564", + "CVE-2026-97565", + "CVE-2026-97566", + "CVE-2026-97567", + "CVE-2026-97568", + "CVE-2026-97571", + "CVE-2026-97572", + "CVE-2026-97573", + "CVE-2026-97574", + "CVE-2026-97575", + "CVE-2026-97576", + "CVE-2026-97577", + "CVE-2026-97578", + "CVE-2026-97579", + "CVE-2026-97580", + "CVE-2026-97581", + "CVE-2026-97582", + "CVE-2026-97583", + "CVE-2026-97584", + "CVE-2026-97585", + "CVE-2026-97586", + "CVE-2026-97587", + "CVE-2026-97588", + "CVE-2026-97589", + "CVE-2026-97590", + "CVE-2026-97591", + "CVE-2026-97592", + "CVE-2026-97593", + "CVE-2026-97594", + "CVE-2026-97595", + "CVE-2026-97596", + "CVE-2026-97597", + "CVE-2026-97598", + "CVE-2026-97599", + "CVE-2026-97600", + "CVE-2026-97601", + "CVE-2026-97602", + "CVE-2026-97603", + "CVE-2026-97604", + "CVE-2026-97605", + "CVE-2026-97606", + "CVE-2026-97607", + "CVE-2026-97608", + "CVE-2026-97609", + "CVE-2026-97610", + "CVE-2026-97611", + "CVE-2026-97612", + "CVE-2026-97613", + "CVE-2026-97614", + "CVE-2026-97615", + "CVE-2026-97616", + "CVE-2026-97617", + "CVE-2026-97618", + "CVE-2026-97619", + "CVE-2026-97620", + "CVE-2026-97621", + "CVE-2026-97899", + "CVE-2026-97900", + "CVE-2026-97901", + "CVE-2026-97902", + "CVE-2026-97903", + "CVE-2026-97904", + "CVE-2026-97905", + "CVE-2026-97906", + "CVE-2026-97907", + "CVE-2026-97908", + "CVE-2026-97909", + "CVE-2026-97910", + "CVE-2026-97912", + "CVE-2026-97913", + "CVE-2026-97914", + "CVE-2026-97915", + "CVE-2026-97916", + "CVE-2026-97917", + "CVE-2026-97918", + "CVE-2026-97919", + "CVE-2026-97920", + "CVE-2026-97921", + "CVE-2026-97922", + "CVE-2026-97923", + "CVE-2026-97924", + "CVE-2026-97925", + "CVE-2026-97926", + "CVE-2026-97927", + "CVE-2026-97928", + "CVE-2026-97929", + "CVE-2026-97930", + "CVE-2026-97931", + "CVE-2026-97932", + "CVE-2026-97933", + "CVE-2026-97934", + "CVE-2026-97935", + "CVE-2026-97936", + "CVE-2026-97938", + "CVE-2026-97939", + "CVE-2026-97940", + "CVE-2026-97942", + "CVE-2026-97943", + "CVE-2026-97944", + "CVE-2026-97945", + "CVE-2026-97946", + "CVE-2026-97947", + "CVE-2026-97948", + "CVE-2026-97949", + "CVE-2026-97950", + "CVE-2026-97951", + "CVE-2026-97952", + "CVE-2026-97953", + "CVE-2026-97954", + "CVE-2026-97955", + "CVE-2026-97956", + "CVE-2026-97957", + "CVE-2026-97958", + "CVE-2026-97959", + "CVE-2026-97960", + "CVE-2026-97961", + "CVE-2026-97962", + "CVE-2026-97963", + "CVE-2026-97964", + "CVE-2026-97965", + "CVE-2026-97966", + "CVE-2026-97967", + "CVE-2026-97968", + "CVE-2026-97969", + "CVE-2026-97970", + "CVE-2026-97971", + "CVE-2026-97972", + "CVE-2026-97973", + "CVE-2026-97974", + "CVE-2026-97975", + "CVE-2026-97976", + "CVE-2026-97977", + "CVE-2026-97978", + "CVE-2026-97979", + "CVE-2026-97981", + "CVE-2026-97982", + "CVE-2026-97983", + "CVE-2026-97984", + "CVE-2026-97985", + "CVE-2026-97986", + "CVE-2026-97987", + "CVE-2026-97988", + "CVE-2026-97989", + "CVE-2026-97990", + "CVE-2026-97991", + "CVE-2026-97992", + "CVE-2026-97993", + "CVE-2026-97994", + "CVE-2026-97995", + "CVE-2026-97996", + "CVE-2026-97997", + "CVE-2026-97998", + "CVE-2026-98000", + "CVE-2026-98001", + "CVE-2026-98002", + "CVE-2026-98003", + "CVE-2026-98004", + "CVE-2026-98005", + "CVE-2026-98006", + "CVE-2026-98007", + "CVE-2026-98008", + "CVE-2026-98009", + "CVE-2026-98010", + "CVE-2026-98011", + "CVE-2026-98012", + "CVE-2026-98013", + "CVE-2026-98014", + "CVE-2026-98015", + "CVE-2026-98016", + "CVE-2026-98017", + "CVE-2026-98018", + "CVE-2026-98019", + "CVE-2026-98020", + "CVE-2026-98021", + "CVE-2026-98022", + "CVE-2026-98023", + "CVE-2026-98024", + "CVE-2026-98025", + "CVE-2026-98026", + "CVE-2026-98027", + "CVE-2026-98028", + "CVE-2026-98029", + "CVE-2026-98030", + "CVE-2026-98031", + "CVE-2026-98032", + "CVE-2026-98033", + "CVE-2026-98034", + "CVE-2026-98037", + "CVE-2026-98038", + "CVE-2026-98039", + "CVE-2026-98041", + "CVE-2026-98043", + "CVE-2026-98044", + "CVE-2026-98045", + "CVE-2026-98046", + "CVE-2026-98047", + "CVE-2026-98048", + "CVE-2026-98049", + "CVE-2026-98050", + "CVE-2026-98051", + "CVE-2026-98052", + "CVE-2026-98053", + "CVE-2026-98054", + "CVE-2026-98055", + "CVE-2026-98056", + "CVE-2026-98057", + "CVE-2026-98058", + "CVE-2026-98059", + "CVE-2026-98060", + "CVE-2026-98061", + "CVE-2026-98062", + "CVE-2026-98063", + "CVE-2026-98064", + "CVE-2026-98065", + "CVE-2026-98066", + "CVE-2026-98067", + "CVE-2026-98068", + "CVE-2026-98069", + "CVE-2026-98070", + "CVE-2026-98071", + "CVE-2026-98072", + "CVE-2026-98073", + "CVE-2026-98074", + "CVE-2026-98075", + "CVE-2026-98076", + "CVE-2026-98077", + "CVE-2026-98078", + "CVE-2026-98079", + "CVE-2026-98080", + "CVE-2026-98081", + "CVE-2026-98082", + "CVE-2026-98083", + "CVE-2026-98084", + "CVE-2026-98085", + "CVE-2026-98086", + "CVE-2026-98087", + "CVE-2026-98088", + "CVE-2026-98089", + "CVE-2026-98090", + "CVE-2026-98091", + "CVE-2026-98092", + "CVE-2026-98093", + "CVE-2026-98094", + "CVE-2026-98095", + "CVE-2026-98096", + "CVE-2026-98097", + "CVE-2026-98098", + "CVE-2026-98099", + "CVE-2026-98101", + "CVE-2026-98102", + "CVE-2026-98103", + "CVE-2026-98104", + "CVE-2026-98105", + "CVE-2026-98106", + "CVE-2026-98107", + "CVE-2026-98108", + "CVE-2026-98109", + "CVE-2026-98110", + "CVE-2026-98111", + "CVE-2026-98112", + "CVE-2026-98113", + "CVE-2026-98114", + "CVE-2026-98115", + "CVE-2026-98116", + "CVE-2026-98117", + "CVE-2026-98118", + "CVE-2026-98119", + "CVE-2026-98120", + "CVE-2026-98121", + "CVE-2026-98122", + "CVE-2026-98123", + "CVE-2026-98124", + "CVE-2026-98125", + "CVE-2026-98126", + "CVE-2026-98127", + "CVE-2026-98128", + "CVE-2026-98129", + "CVE-2026-98130", + "CVE-2026-98131", + "CVE-2026-98134", + "CVE-2026-98142", + "CVE-2026-98143", + "CVE-2026-98144", + "CVE-2026-98146", + "CVE-2026-98147", + "CVE-2026-98148", + "CVE-2026-98149", + "CVE-2026-98150", + "CVE-2026-98151", + "CVE-2026-98152", + "CVE-2026-98153", + "CVE-2026-98154", + "CVE-2026-98155", + "CVE-2026-98156", + "CVE-2026-98157", + "CVE-2026-98158", + "CVE-2026-98159", + "CVE-2026-98160", + "CVE-2026-98161", + "CVE-2026-98162", + "CVE-2026-98163", + "CVE-2026-98164", + "CVE-2026-98166", + "CVE-2026-98167", + "CVE-2026-98168", + "CVE-2026-98169", + "CVE-2026-98170", + "CVE-2026-98171", + "CVE-2026-98172", + "CVE-2026-98173", + "CVE-2026-98174", + "CVE-2026-98175", + "CVE-2026-98176", + "CVE-2026-98177", + "CVE-2026-98179", + "CVE-2026-98180", + "CVE-2026-98181", + "CVE-2026-98182", + "CVE-2026-98184", + "CVE-2026-98185", + "CVE-2026-98186", + "CVE-2026-98187", + "CVE-2026-98188", + "CVE-2026-98189", + "CVE-2026-98190", + "CVE-2026-98191", + "CVE-2026-98192", + "CVE-2026-98193", + "CVE-2026-98194", + "CVE-2026-98195", + "CVE-2026-98196", + "CVE-2026-98197", + "CVE-2026-98198", + "CVE-2026-98199", + "CVE-2026-98200", + "CVE-2026-98201", + "CVE-2026-98202", + "CVE-2026-98203", + "CVE-2026-98204", + "CVE-2026-98205", + "CVE-2026-98206", + "CVE-2026-98207", + "CVE-2026-98208", + "CVE-2026-98209", + "CVE-2026-98210", + "CVE-2026-98211", + "CVE-2026-98212", + "CVE-2026-98213", + "CVE-2026-98214", + "CVE-2026-98215", + "CVE-2026-98216", + "CVE-2026-98217", + "CVE-2026-98218", + "CVE-2026-98221", + "CVE-2026-98222", + "CVE-2026-98223", + "CVE-2026-98224", + "CVE-2026-98226", + "CVE-2026-98227", + "CVE-2026-98228", + "CVE-2026-98229", + "CVE-2026-98230", + "CVE-2026-98231", + "CVE-2026-98232", + "CVE-2026-98233", + "CVE-2026-98234", + "CVE-2026-98235", + "CVE-2026-98236", + "CVE-2026-98237", + "CVE-2026-98238", + "CVE-2026-98239", + "CVE-2026-98240", + "CVE-2026-98241", + "CVE-2026-98242", + "CVE-2026-98244", + "CVE-2026-98245", + "CVE-2026-98246", + "CVE-2026-98247", + "CVE-2026-98248", + "CVE-2026-98249", + "CVE-2026-98251", + "CVE-2026-98252", + "CVE-2026-98253", + "CVE-2026-98254", + "CVE-2026-98255", + "CVE-2026-98256", + "CVE-2026-98257", + "CVE-2026-98258", + "CVE-2026-98259", + "CVE-2026-98260", + "CVE-2026-98261", + "CVE-2026-98262", + "CVE-2026-98263", + "CVE-2026-98264", + "CVE-2026-98265", + "CVE-2026-98266", + "CVE-2026-98267", + "CVE-2026-98268", + "CVE-2026-98269", + "CVE-2026-98270", + "CVE-2026-98271", + "CVE-2026-98272", + "CVE-2026-98273", + "CVE-2026-98274", + "CVE-2026-98275", + "CVE-2026-98276", + "CVE-2026-98277", + "CVE-2026-98278", + "CVE-2026-98279", + "CVE-2026-98280", + "CVE-2026-98281", + "CVE-2026-98282", + "CVE-2026-98283", + "CVE-2026-98284", + "CVE-2026-98285", + "CVE-2026-98286", + "CVE-2026-98287", + "CVE-2026-98288", + "CVE-2026-98289", + "CVE-2026-98290", + "CVE-2026-98291", + "CVE-2026-98292", + "CVE-2026-98293", + "CVE-2026-98294", + "CVE-2026-98295", + "CVE-2026-98296", + "CVE-2026-98297", + "CVE-2026-98298", + "CVE-2026-98299", + "CVE-2026-98300", + "CVE-2026-98301", + "CVE-2026-98302", + "CVE-2026-98303", + "CVE-2026-98304", + "CVE-2026-98306", + "CVE-2026-98307", + "CVE-2026-98308", + "CVE-2026-98309", + "CVE-2026-98311", + "CVE-2026-98312", + "CVE-2026-98314", + "CVE-2026-98316", + "CVE-2026-98317", + "CVE-2026-98318", + "CVE-2026-98319", + "CVE-2026-98320", + "CVE-2026-98321", + "CVE-2026-98322", + "CVE-2026-98323", + "CVE-2026-98324", + "CVE-2026-98325", + "CVE-2026-98326", + "CVE-2026-98327", + "CVE-2026-98328", + "CVE-2026-98329", + "CVE-2026-98330", + "CVE-2026-98331", + "CVE-2026-98332", + "CVE-2026-98333", + "CVE-2026-98334", + "CVE-2026-98335", + "CVE-2026-98336", + "CVE-2026-98337", + "CVE-2026-98338", + "CVE-2026-98339", + "CVE-2026-98340", + "CVE-2026-98341", + "CVE-2026-98342", + "CVE-2026-98343", + "CVE-2026-98344", + "CVE-2026-98345", + "CVE-2026-98346", + "CVE-2026-98347", + "CVE-2026-98348", + "CVE-2026-98349", + "CVE-2026-98350", + "CVE-2026-98351", + "CVE-2026-98352", + "CVE-2026-98354", + "CVE-2026-98355", + "CVE-2026-98356", + "CVE-2026-98357", + "CVE-2026-98358", + "CVE-2026-98359", + "CVE-2026-98360", + "CVE-2026-98361", + "CVE-2026-98362", + "CVE-2026-98363", + "CVE-2026-98364", + "CVE-2026-98365", + "CVE-2026-98366", + "CVE-2026-98367", + "CVE-2026-98368", + "CVE-2026-98369", + "CVE-2026-98370", + "CVE-2026-98371", + "CVE-2026-98372", + "CVE-2026-98373", + "CVE-2026-98374", + "CVE-2026-98375", + "CVE-2026-98376", + "CVE-2026-98377", + "CVE-2026-98378", + "CVE-2026-98379", + "CVE-2026-98380", + "CVE-2026-98381", + "CVE-2026-98382", + "CVE-2026-98383", + "CVE-2026-98384", + "CVE-2026-98386", + "CVE-2026-98387", + "CVE-2026-98388", + "CVE-2026-98389", + "CVE-2026-98390", + "CVE-2026-98391", + "CVE-2026-98392", + "CVE-2026-98393", + "CVE-2026-98394", + "CVE-2026-98398", + "CVE-2026-98399", + "CVE-2026-98400", + "CVE-2026-98401", + "CVE-2026-98402", + "CVE-2026-98403", + "CVE-2026-98404", + "CVE-2026-98406", + "CVE-2026-98407", + "CVE-2026-98408", + "CVE-2026-98409", + "CVE-2026-98410", + "CVE-2026-98411", + "CVE-2026-98412", + "CVE-2026-98413", + "CVE-2026-98414", + "CVE-2026-98415", + "CVE-2026-98416", + "CVE-2026-98417", + "CVE-2026-98419", + "CVE-2026-98420", + "CVE-2026-98421", + "CVE-2026-98422", + "CVE-2026-98423", + "CVE-2026-98424", + "CVE-2026-98425", + "CVE-2026-98426", + "CVE-2026-98427", + "CVE-2026-98428", + "CVE-2026-98429", + "CVE-2026-98430", + "CVE-2026-98431", + "CVE-2026-98432", + "CVE-2026-98433", + "CVE-2026-98434", + "CVE-2026-98435", + "CVE-2026-98436", + "CVE-2026-98437", + "CVE-2026-98439", + "CVE-2026-98440", + "CVE-2026-98441", + "CVE-2026-98442", + "CVE-2026-98443", + "CVE-2026-98444", + "CVE-2026-98445", + "CVE-2026-98446", + "CVE-2026-98447", + "CVE-2026-98448", + "CVE-2026-98449", + "CVE-2026-98450", + "CVE-2026-98451", + "CVE-2026-98452", + "CVE-2026-98453", + "CVE-2026-98454", + "CVE-2026-98455", + "CVE-2026-98456", + "CVE-2026-98457", + "CVE-2026-98458", + "CVE-2026-98459", + "CVE-2026-98460", + "CVE-2026-98461", + "CVE-2026-98462", + "CVE-2026-98463", + "CVE-2026-98464", + "CVE-2026-98465", + "CVE-2026-98466", + "CVE-2026-98467", + "CVE-2026-98468", + "CVE-2026-98469", + "CVE-2026-98470", + "CVE-2026-98471", + "CVE-2026-98472", + "CVE-2026-98473", + "CVE-2026-98474", + "CVE-2026-98475", + "CVE-2026-98476", + "CVE-2026-98477", + "CVE-2026-98478", + "CVE-2026-98479", + "CVE-2026-98480", + "CVE-2026-98481", + "CVE-2026-98482", + "CVE-2026-98483", + "CVE-2026-98484", + "CVE-2026-98485", + "CVE-2026-98486", + "CVE-2026-98487", + "CVE-2026-98488", + "CVE-2026-98489", + "CVE-2026-98490", + "CVE-2026-98491", + "CVE-2026-98492", + "CVE-2026-98493", + "CVE-2026-98494", + "CVE-2026-98495", + "CVE-2026-98496", + "CVE-2026-98497", + "CVE-2026-98498", + "CVE-2026-98499", + "CVE-2026-98501", + "CVE-2026-98502", + "CVE-2026-98503", + "CVE-2026-98504", + "CVE-2026-98505", + "CVE-2026-98506", + "CVE-2026-98507", + "CVE-2026-98508", + "CVE-2026-98509", + "CVE-2026-98510", + "CVE-2026-98511", + "CVE-2026-98512", + "CVE-2026-98513", + "CVE-2026-98514", + "CVE-2026-98515", + "CVE-2026-98516", + "CVE-2026-98517", + "CVE-2026-98518", + "CVE-2026-98519", + "CVE-2026-98521", + "CVE-2026-98522", + "CVE-2026-98523", + "CVE-2026-98524", + "CVE-2026-98525", + "CVE-2026-98526", + "CVE-2026-98527", + "CVE-2026-98528", + "CVE-2026-98529", + "CVE-2026-98530", + "CVE-2026-98531", + "CVE-2026-98532", + "CVE-2026-98533", + "CVE-2026-98534", + "CVE-2026-98535", + "CVE-2026-98536", + "CVE-2026-98537", + "CVE-2026-98538", + "CVE-2026-98539", + "CVE-2026-98541", + "CVE-2026-98542", + "CVE-2026-98543", + "CVE-2026-98544", + "CVE-2026-98545", + "CVE-2026-98546", + "CVE-2026-98547", + "CVE-2026-98548", + "CVE-2026-98549", + "CVE-2026-98550", + "CVE-2026-98551", + "CVE-2026-98552", + "CVE-2026-98553", + "CVE-2026-98554", + "CVE-2026-98555", + "CVE-2026-98556", + "CVE-2026-98558", + "CVE-2026-98559", + "CVE-2026-98560", + "CVE-2026-98561", + "CVE-2026-98562", + "CVE-2026-98563", + "CVE-2026-98564", + "CVE-2026-98565", + "CVE-2026-98566", + "CVE-2026-98567", + "CVE-2026-98568", + "CVE-2026-98569", + "CVE-2026-98570", + "CVE-2026-98571", + "CVE-2026-98572", + "CVE-2026-98573", + "CVE-2026-98574", + "CVE-2026-98575", + "CVE-2026-98576", + "CVE-2026-98577", + "CVE-2026-98578", + "CVE-2026-98579", + "CVE-2026-98580", + "CVE-2026-98581", + "CVE-2026-98582", + "CVE-2026-98583", + "CVE-2026-98584", + "CVE-2026-98585", + "CVE-2026-98586", + "CVE-2026-98588", + "CVE-2026-98589", + "CVE-2026-98590", + "CVE-2026-98591", + "CVE-2026-98592", + "CVE-2026-98593", + "CVE-2026-98594", + "CVE-2026-98595", + "CVE-2026-98596", + "CVE-2026-98597", + "CVE-2026-98598", + "CVE-2026-98599", + "CVE-2026-98601", + "CVE-2026-98602", + "CVE-2026-98603", + "CVE-2026-98604", + "CVE-2026-98605", + "CVE-2026-98606", + "CVE-2026-98607", + "CVE-2026-98608", + "CVE-2026-98609", + "CVE-2026-98610", + "CVE-2026-98611", + "CVE-2026-98612", + "CVE-2026-98613", + "CVE-2026-98614", + "CVE-2026-98615", + "CVE-2026-98616", + "CVE-2026-98617", + "CVE-2026-98618", + "CVE-2026-98620", + "CVE-2026-98621", + "CVE-2026-98622", + "CVE-2026-98623", + "CVE-2026-98624", + "CVE-2026-98625", + "CVE-2026-98626", + "CVE-2026-98628", + "CVE-2026-98629", + "CVE-2026-98630", + "CVE-2026-98631", + "CVE-2026-98632", + "CVE-2026-98633", + "CVE-2026-98634", + "CVE-2026-98635", + "CVE-2026-98636", + "CVE-2026-98637", + "CVE-2026-98638", + "CVE-2026-98639", + "CVE-2026-98640", + "CVE-2026-98641", + "CVE-2026-98642", + "CVE-2026-98643", + "CVE-2026-98644", + "CVE-2026-98646", + "CVE-2026-98647", + "CVE-2026-98648", + "CVE-2026-98649", + "CVE-2026-98650", + "CVE-2026-98651", + "CVE-2026-98652", + "CVE-2026-98653", + "CVE-2026-98655", + "CVE-2026-98656", + "CVE-2026-98657", + "CVE-2026-98658", + "CVE-2026-98659", + "CVE-2026-98660", + "CVE-2026-98661", + "CVE-2026-98662", + "CVE-2026-98663", + "CVE-2026-98664", + "CVE-2026-98665", + "CVE-2026-98666", + "CVE-2026-98667", + "CVE-2026-98668", + "CVE-2026-98669", + "CVE-2026-98670", + "CVE-2026-98671", + "CVE-2026-98672", + "CVE-2026-98673", + "CVE-2026-98674", + "CVE-2026-98675", + "CVE-2026-98676", + "CVE-2026-98677", + "CVE-2026-98678", + "CVE-2026-98679", + "CVE-2026-98680", + "CVE-2026-98681", + "CVE-2026-98682", + "CVE-2026-98683", + "CVE-2026-98684", + "CVE-2026-98685", + "CVE-2026-98686", + "CVE-2026-98687", + "CVE-2026-98689", + "CVE-2026-98690", + "CVE-2026-98691", + "CVE-2026-98692", + "CVE-2026-98693", + "CVE-2026-98694", + "CVE-2026-98695", + "CVE-2026-98696", + "CVE-2026-98697", + "CVE-2026-98698", + "CVE-2026-98699", + "CVE-2026-98700", + "CVE-2026-98701", + "CVE-2026-98702", + "CVE-2026-98703", + "CVE-2026-98704", + "CVE-2026-98705", + "CVE-2026-98706", + "CVE-2026-98707", + "CVE-2026-98708", + "CVE-2026-98709", + "CVE-2026-98710", + "CVE-2026-98711", + "CVE-2026-98712", + "CVE-2026-98713", + "CVE-2026-98714", + "CVE-2026-98715", + "CVE-2026-98716", + "CVE-2026-98717", + "CVE-2026-98718", + "CVE-2026-98719", + "CVE-2026-98720", + "CVE-2026-98721", + "CVE-2026-98722", + "CVE-2026-98723", + "CVE-2026-98724", + "CVE-2026-98725", + "CVE-2026-98726", + "CVE-2026-98727", + "CVE-2026-98728", + "CVE-2026-98729", + "CVE-2026-98730", + "CVE-2026-98731", + "CVE-2026-98732", + "CVE-2026-98733", + "CVE-2026-98734", + "CVE-2026-98735", + "CVE-2026-98736", + "CVE-2026-98737", + "CVE-2026-98738", + "CVE-2026-98739", + "CVE-2026-98740", + "CVE-2026-98741", + "CVE-2026-98742", + "CVE-2026-98743", + "CVE-2026-98744", + "CVE-2026-98745", + "CVE-2026-98746", + "CVE-2026-98747", + "CVE-2026-98748", + "CVE-2026-98749", + "CVE-2026-98750", + "CVE-2026-98751", + "CVE-2026-98752", + "CVE-2026-98753", + "CVE-2026-98754", + "CVE-2026-98755", + "CVE-2026-98756", + "CVE-2026-98757", + "CVE-2026-98758", + "CVE-2026-98759", + "CVE-2026-98760", + "CVE-2026-98761", + "CVE-2026-98762", + "CVE-2026-98763", + "CVE-2026-98764", + "CVE-2026-98765", + "CVE-2026-98766", + "CVE-2026-98767", + "CVE-2026-98768", + "CVE-2026-98769", + "CVE-2026-98770", + "CVE-2026-98771", + "CVE-2026-98772", + "CVE-2026-98773", + "CVE-2026-98774", + "CVE-2026-98775", + "CVE-2026-98776", + "CVE-2026-98777", + "CVE-2026-98778", + "CVE-2026-98779", + "CVE-2026-98780", + "CVE-2026-98781", + "CVE-2026-98782", + "CVE-2026-98783", + "CVE-2026-98784", + "CVE-2026-98785", + "CVE-2026-98786", + "CVE-2026-98788", + "CVE-2026-98789", + "CVE-2026-98790", + "CVE-2026-98791", + "CVE-2026-98792", + "CVE-2026-98793", + "CVE-2026-98794", + "CVE-2026-98795", + "CVE-2026-98796", + "CVE-2026-98797", + "CVE-2026-98798", + "CVE-2026-98799", + "CVE-2026-98800", + "CVE-2026-98801", + "CVE-2026-98802", + "CVE-2026-98803", + "CVE-2026-98804", + "CVE-2026-98805", + "CVE-2026-98806", + "CVE-2026-98807", + "CVE-2026-98808", + "CVE-2026-98809", + "CVE-2026-98810", + "CVE-2026-98811", + "CVE-2026-98812", + "CVE-2026-98813", + "CVE-2026-98814", + "CVE-2026-98815", + "CVE-2026-98816", + "CVE-2026-98817", + "CVE-2026-98818", + "CVE-2026-98819", + "CVE-2026-98820", + "CVE-2026-98821", + "CVE-2026-98822", + "CVE-2026-98823", + "CVE-2026-98824", + "CVE-2026-98825", + "CVE-2026-98826", + "CVE-2026-98827", + "CVE-2026-98828", + "CVE-2026-98829", + "CVE-2026-98830", + "CVE-2026-98831", + "CVE-2026-98833", + "CVE-2026-98834", + "CVE-2026-98835", + "CVE-2026-98836", + "CVE-2026-98837", + "CVE-2026-98838", + "CVE-2026-98839", + "CVE-2026-98840", + "CVE-2026-98841", + "CVE-2026-98842", + "CVE-2026-98843", + "CVE-2026-98844", + "CVE-2026-98845", + "CVE-2026-98846", + "CVE-2026-98847", + "CVE-2026-98848", + "CVE-2026-98849", + "CVE-2026-98850", + "CVE-2026-98851", + "CVE-2026-98852", + "CVE-2026-98853", + "CVE-2026-98854", + "CVE-2026-98855", + "CVE-2026-98856", + "CVE-2026-98857", + "CVE-2026-98858", + "CVE-2026-98859", + "CVE-2026-98860", + "CVE-2026-98861", + "CVE-2026-98862", + "CVE-2026-98863", + "CVE-2026-98867", + "CVE-2026-98868", + "CVE-2026-98869", + "CVE-2026-99999" + ] +} diff --git a/.github/dapper-unfixed.json b/.github/dapper-unfixed.json new file mode 100644 index 00000000..2b21bc26 --- /dev/null +++ b/.github/dapper-unfixed.json @@ -0,0 +1,830 @@ +{ + "repository": "PastureStack/node-agent", + "unfixed": [ + { + "package": "binutils", + "purl": "pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "binutils-common", + "purl": "pkg:deb/ubuntu/binutils-common@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "binutils-x86-64-linux-gnu", + "purl": "pkg:deb/ubuntu/binutils-x86-64-linux-gnu@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "busybox-static", + "purl": "pkg:deb/ubuntu/busybox-static@1.37.0-7ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2023-42366", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_busybox: needed; no official fixed package available.", + "version": "1:1.37.0-7ubuntu1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2023-42366" + }, + { + "package": "busybox-static", + "purl": "pkg:deb/ubuntu/busybox-static@1.37.0-7ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2024-58251", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_busybox: needed; no official fixed package available.", + "version": "1:1.37.0-7ubuntu1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-58251" + }, + { + "package": "busybox-static", + "purl": "pkg:deb/ubuntu/busybox-static@1.37.0-7ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2025-46394", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_busybox: needed; no official fixed package available.", + "version": "1:1.37.0-7ubuntu1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-46394" + }, + { + "package": "busybox-static", + "purl": "pkg:deb/ubuntu/busybox-static@1.37.0-7ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2025-60876", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_busybox: needed; no official fixed package available.", + "version": "1:1.37.0-7ubuntu1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-60876" + }, + { + "package": "containerd", + "purl": "pkg:deb/ubuntu/containerd@2.2.2-0ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-46680", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_containerd: needed; no official fixed package available.", + "version": "2.2.2-0ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-46680" + }, + { + "package": "dash", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-102473", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "0.5.12-12ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102473" + }, + { + "package": "dash", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-102474", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "0.5.12-12ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102474" + }, + { + "package": "git", + "purl": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2024-52005", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_git: deferred. No official resolute fixed package is available; keep tracking.", + "version": "1:2.53.0-1ubuntu1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-52005" + }, + { + "package": "git-man", + "purl": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2024-52005", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_git: deferred. No official resolute fixed package is available; keep tracking.", + "version": "1:2.53.0-1ubuntu1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-52005" + }, + { + "package": "libbinutils", + "purl": "pkg:deb/ubuntu/libbinutils@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "libc-bin", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18374", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374" + }, + { + "package": "libc-bin", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89092", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092" + }, + { + "package": "libc-dev-bin", + "purl": "pkg:deb/ubuntu/libc-dev-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18374", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374" + }, + { + "package": "libc-dev-bin", + "purl": "pkg:deb/ubuntu/libc-dev-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89092", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092" + }, + { + "package": "libc-gconv-modules-extra", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18374", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374" + }, + { + "package": "libc-gconv-modules-extra", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89092", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092" + }, + { + "package": "libc6", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18374", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374" + }, + { + "package": "libc6", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89092", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092" + }, + { + "package": "libc6-dev", + "purl": "pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18374", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374" + }, + { + "package": "libc6-dev", + "purl": "pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89092", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "version": "2.43-2ubuntu2.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092" + }, + { + "package": "libctf-nobfd0", + "purl": "pkg:deb/ubuntu/libctf-nobfd0@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "libctf0", + "purl": "pkg:deb/ubuntu/libctf0@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "libelf1t64", + "purl": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2025-1352", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_elfutils: needed; no official fixed package available.", + "version": "0.194-4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-1352" + }, + { + "package": "libelf1t64", + "purl": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2025-1376", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 official tracker: resolute_elfutils: needed; no official fixed package available.", + "version": "0.194-4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-1376" + }, + { + "package": "libexpat1", + "purl": "pkg:deb/ubuntu/libexpat1@2.7.4-1ubuntu0.2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2025-66382", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_expat: deferred (2026-09-28). No official resolute fixed package is available; keep tracking.", + "version": "2.7.4-1ubuntu0.2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-66382" + }, + { + "package": "libgnutls30t64", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-67693", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "3.8.12-2ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-67693" + }, + { + "package": "libgnutls30t64", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-88647", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "3.8.12-2ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88647" + }, + { + "package": "libgnutls30t64", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-88648", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "3.8.12-2ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88648" + }, + { + "package": "libgnutls30t64", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-95184", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "3.8.12-2ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95184" + }, + { + "package": "libgnutls30t64", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-95209", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "3.8.12-2ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95209" + }, + { + "package": "libgnutls30t64", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-95210", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "version": "3.8.12-2ubuntu1.1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95210" + }, + { + "package": "libgprofng0", + "purl": "pkg:deb/ubuntu/libgprofng0@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "libp11-kit0", + "purl": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-13757", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_p11-kit: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.26.2-2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-13757" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-103111", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-103111" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-86145", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-86145" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89156", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89156" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89157", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89157" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89158", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89158" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89160", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89160" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89161", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89161" + }, + { + "package": "libpcre2-8-0", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-89162", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "version": "10.46-1build1", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89162" + }, + { + "package": "libsasl2-2", + "purl": "pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-107161", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "version": "2.1.28+dfsg1-9ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161" + }, + { + "package": "libsasl2-modules-db", + "purl": "pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-107161", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "version": "2.1.28+dfsg1-9ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161" + }, + { + "package": "libsframe3", + "purl": "pkg:deb/ubuntu/libsframe3@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2017-13716", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "version": "2.46-3ubuntu2", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716" + }, + { + "package": "libsystemd0", + "purl": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-40228", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "version": "259.5-0ubuntu3.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228" + }, + { + "package": "libudev1", + "purl": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-40228", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "version": "259.5-0ubuntu3.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228" + }, + { + "package": "login.defs", + "purl": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2024-56433", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "version": "1:4.17.4-2ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433" + }, + { + "package": "passwd", + "purl": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2024-56433", + "severity": "LOW", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "version": "1:4.17.4-2ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35341", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35341" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35344", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35344" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35345", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35345" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35348", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35348" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35350", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35350" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35351", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35351" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35352", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35352" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35354", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35354" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35357", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35357" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35359", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35359" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35360", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35360" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35363", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35363" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35364", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35364" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35367", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35367" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35368", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35368" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35370", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35370" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35371", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35371" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35373", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35373" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35374", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35374" + }, + { + "package": "rust-coreutils", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-35377", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "version": "0.8.0-0ubuntu3", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35377" + }, + { + "package": "tar", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18477", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "version": "1.35+dfsg-4ubuntu0.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18477" + }, + { + "package": "tar", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "checkedAt": "2026-10-23", + "status": "no_official_fix", + "id": "CVE-2026-18508", + "severity": "MEDIUM", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "version": "1.35+dfsg-4ubuntu0.4", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18508" + }, + { + "severity": "LOW", + "purl": "pkg:deb/ubuntu/libsystemd-shared@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "id": "CVE-2026-40228", + "package": "libsystemd-shared", + "version": "259.5-0ubuntu3.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 official tracker marks resolute_systemd as deferred (2026-06-05). No official fixed package is available; retain the exact installed package/version boundary.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "purl": "pkg:deb/ubuntu/systemd@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "id": "CVE-2026-40228", + "package": "systemd", + "version": "259.5-0ubuntu3.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 official tracker marks resolute_systemd as deferred (2026-06-05). No official fixed package is available; retain the exact installed package/version boundary.", + "checkedAt": "2026-10-23" + } + ] +} diff --git a/.github/scripts/check-builder-header-boundary.sh b/.github/scripts/check-builder-header-boundary.sh new file mode 100644 index 00000000..bc0edf87 --- /dev/null +++ b/.github/scripts/check-builder-header-boundary.sh @@ -0,0 +1,28 @@ +#!/usr/bin/env bash +set -euo pipefail +test "$#" -eq 1 +if ! docker run --rm --entrypoint sh "$1" -ec 'dpkg-query -W -f="\${Status}" linux-libc-dev 2>/dev/null | grep -Fxq "install ok installed"'; then + printf '%s\n' '{"package":null}' + exit 0 +fi +docker run --rm --entrypoint sh "$1" -ec ' + test "$(dpkg-query -W -f="\${Version}" linux-libc-dev)" = 7.0.0-38.38 + if dpkg-query -W -f="\${db:Status-Abbrev} \${binary:Package}\\n" | + awk "\$1 == \"ii\" {print \$2}" | grep -Eq "^linux-(image|modules)([-:]|$)"; then + echo "Unexpected kernel runtime package" >&2; exit 1 + fi + for directory in /boot /lib/modules /usr/lib/modules; do + if test -d "$directory" && test -n "$(find "$directory" -type f -print -quit)"; then + echo "Unexpected kernel runtime file" >&2; exit 1 + fi + done + dpkg-query -L linux-libc-dev | while IFS= read -r path; do + if test -f "$path"; then + case "$path" in + /usr/include/*|/usr/share/doc/linux-libc-dev/*|/usr/share/lintian/overrides/linux-libc-dev) ;; + *) echo "Unexpected linux-libc-dev payload: $path" >&2; exit 1 ;; + esac + fi + done +' +printf '%s\n' '{"package":"linux-libc-dev","version":"7.0.0-38.38","kernel_images":false,"kernel_modules":false}' diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py index b952eee1..248c6486 100644 --- a/.github/scripts/enforce-runtime-vulnerabilities.py +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -46,12 +46,131 @@ def violations(report, ledger, repository): return errors + +def builder_violations(report, ledger, repository, header_boundary, header_ledger, + package_graphs=None, docker_proof=None, node_proof=None): + # The complete raw scan is required; never infer safety from missing analysis. + if not isinstance(report, dict) or report.get("SchemaVersion") != 2: + raise ValueError("malformed complete builder report") + results = report.get("Results") + if not isinstance(results, list) or not results: + raise ValueError("missing builder analysis") + expected = ["usr/local/go/bin/go"] + if repository == "PastureStack/ecr-credential-sync": + expected += ["usr/bin/docker", "usr/libexec/docker/cli-plugins/docker-buildx"] + if repository == "PastureStack/kubernetes-authentication-bridge": + expected += ["usr/bin/docker", "usr/local/libexec/docker/cli-plugins/docker-buildx"] + binaries = {r.get("Target"): r for r in results if r.get("Type") == "gobinary"} + for target in expected: + if not binaries.get(target, {}).get("Packages"): + raise ValueError("missing nonempty binary analysis: " + target) + if any(not result.get("Packages") for result in binaries.values()): + raise ValueError("incomplete Go binary package analysis") + has_headers = any(f.get("PkgName") == "linux-libc-dev" for r in results for f in (r.get("Vulnerabilities") or [])) + if has_headers and header_boundary != {"package": "linux-libc-dev", "version": "7.0.0-38.38", + "kernel_images": False, "kernel_modules": False}: + raise ValueError("missing exact installed-header boundary proof") + if header_ledger.get("repository") != repository: + raise ValueError("header review repository mismatch") + if (header_ledger.get("package") != "linux-libc-dev" + or header_ledger.get("version") != "7.0.0-38.38" + or header_ledger.get("purl") != "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04"): + raise ValueError("changed header review boundary") + header_keys = {(identifier, header_ledger["package"], header_ledger["version"], header_ledger["purl"]) + for identifier in header_ledger.get("ids", [])} + expected_purl = "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04" + openpgp_absent = False + if package_graphs: + if repository not in ("PastureStack/kubernetes-authentication-bridge", "PastureStack/ecr-credential-sync"): + raise ValueError("unexpected OpenPGP proof consumer") + expected_roots = {"buildx": "github.com/docker/buildx/cmd/buildx"} + if repository == "PastureStack/ecr-credential-sync": + expected_roots["docker"] = "github.com/docker/cli/cmd/docker" + if set(package_graphs) != set(expected_roots): + raise ValueError("unexpected source package graph set") + for name, root in expected_roots.items(): + packages = set(package_graphs[name].splitlines()) + if root not in packages or any( + p == "golang.org/x/crypto/openpgp" or + p.startswith("golang.org/x/crypto/openpgp/") for p in packages): + raise ValueError("OpenPGP package boundary not proved") + openpgp_absent = True + retained = [] + for result in results: + copied = dict(result) + copied["Vulnerabilities"] = [] + for finding in result.get("Vulnerabilities") or []: + key = (finding.get("VulnerabilityID"), finding.get("PkgName"), + finding.get("InstalledVersion"), + (finding.get("PkgIdentifier") or {}).get("PURL", "")) + is_header = (key in header_keys and key[1] == "linux-libc-dev" + and key[2] == "7.0.0-38.38" and key[3] == expected_purl) + unfixed = not str(finding.get("FixedVersion") or "").strip() + if is_header and unfixed: + continue + if (unfixed and openpgp_absent and key == ( + "GO-2026-5932", "golang.org/x/crypto", "v0.57.0", + "pkg:golang/golang.org/x/crypto@v0.57.0")): + continue + if (unfixed and repository == "PastureStack/ecr-credential-sync" + and key == ("CVE-2026-85747", "github.com/docker/distribution", + "v2.8.3+incompatible", + "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible") + and docker_proof and len(docker_proof.get("cases", [])) == 7 + and all(c.get("passed") is True for c in docker_proof["cases"]) + and {c.get("case") for c in docker_proof["cases"]} == { + "valid_schema2", "forged_schema2", "valid_oci", "forged_oci", + "valid_list", "forged_list_parent", "forged_list_child"} + and docker_proof.get("sourceCommit") == "a7dcaa6fdb6ed04aacbfdc76357fdae01605609e" + and len(docker_proof.get("binarySha256", "")) == 64): + continue + if (unfixed and repository == "PastureStack/node-agent" and node_proof): + if (key == ("CVE-2025-54388", "docker.io", "29.1.3-0ubuntu4.1", + "pkg:deb/ubuntu/docker.io@29.1.3-0ubuntu4.1?arch=amd64&distro=ubuntu-26.04") + and "Docker version 29.1.3," in node_proof.get("dockerdVersion", "")): + continue + pip = node_proof.get("pip", {}) + if (key[0] in ("CVE-2025-66418", "CVE-2025-66471", "CVE-2026-21441", "CVE-2026-1703") + and key[1] == "python3-pip-whl" and key[2] == "25.1.1+dfsg-1ubuntu2" + and key[3] == "pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04" + and pip.get("verifiedWheelSha256") == "be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a" + and pip.get("pip") == "26.2.2+pasturestack.1" + and pip.get("urllib3") == "2.8.0" and pip.get("vendorFilesByteCompared") == 299): + continue + copied["Vulnerabilities"].append(finding) + retained.append(copied) + return violations(dict(report, Results=retained), ledger, repository) + if __name__ == "__main__": parser = argparse.ArgumentParser() parser.add_argument("--repository", required=True) + parser.add_argument("--scope", choices=("runtime", "builder"), default="runtime") args = parser.parse_args() - failures = violations(json.load(sys.stdin), - json.loads((Path(__file__).resolve().parents[1] / "runtime-unfixed.json").read_text(encoding="utf-8")), args.repository) + repo_root = Path(__file__).resolve().parents[2] + report = json.load(sys.stdin) + ledger_name = "runtime-unfixed.json" if args.scope == "runtime" else "dapper-unfixed.json" + ledger = json.loads((repo_root / ".github" / ledger_name).read_text(encoding="utf-8")) + if args.scope == "runtime": + failures = violations(report, ledger, args.repository) + else: + evidence_dir = "dist" if args.repository in ( + "PastureStack/kubernetes-agent", + "PastureStack/kubernetes-authentication-bridge") else "evidence" + boundary = json.loads((repo_root / evidence_dir / "dapper-header-boundary.json").read_text(encoding="utf-8")) + headers = json.loads((repo_root / ".github" / "dapper-headers.json").read_text(encoding="utf-8")) + graphs = None + docker_proof = None + if args.repository in ("PastureStack/kubernetes-authentication-bridge", + "PastureStack/ecr-credential-sync"): + graphs = {"buildx": (repo_root / evidence_dir / "buildx-package-graph.txt").read_text(encoding="utf-8")} + if args.repository == "PastureStack/ecr-credential-sync": + graphs["docker"] = (repo_root / evidence_dir / "docker-package-graph.txt").read_text(encoding="utf-8") + docker_proof = json.loads((repo_root / evidence_dir / "docker-manifest-digest-proof.json").read_text(encoding="utf-8")) + node_proof = None + if args.repository == "PastureStack/node-agent": + node_proof = {"pip": json.loads((repo_root / evidence_dir / "pip-vendor-proof.json").read_text(encoding="utf-8")), + "dockerdVersion": (repo_root / evidence_dir / "dockerd-version.txt").read_text(encoding="utf-8")} + failures = builder_violations(report, ledger, args.repository, boundary, headers, graphs, docker_proof, node_proof) if failures: raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/.github/scripts/test_builder_vulnerability_policy.py b/.github/scripts/test_builder_vulnerability_policy.py new file mode 100644 index 00000000..e614ad89 --- /dev/null +++ b/.github/scripts/test_builder_vulnerability_policy.py @@ -0,0 +1,70 @@ +import copy +import importlib.util +from pathlib import Path +import unittest + +spec = importlib.util.spec_from_file_location("policy", Path(__file__).with_name("enforce-runtime-vulnerabilities.py")) +policy = importlib.util.module_from_spec(spec) +spec.loader.exec_module(policy) +REPO = "PastureStack/authentication-service" +PURL = "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04" + +class BuilderPolicy(unittest.TestCase): + def setUp(self): + self.report = {"SchemaVersion": 2, "Results": [ + {"Target": "usr/local/go/bin/go", "Type": "gobinary", "Packages": [{"Name": "stdlib", "Version": "v1.27.3"}]}, + {"Target": "os", "Vulnerabilities": []}]} + self.ledger = {"repository": REPO, "unfixed": []} + self.boundary = {"package": "linux-libc-dev", "version": "7.0.0-38.38", "kernel_images": False, "kernel_modules": False} + self.headers = {"repository": REPO, "package": "linux-libc-dev", "version": "7.0.0-38.38", "purl": PURL, "ids": ["HEADER-1"]} + def check(self): + return policy.builder_violations(self.report, self.ledger, REPO, self.boundary, self.headers) + def finding(self, severity="LOW", fixed=""): + item = {"VulnerabilityID": "HEADER-1", "PkgName": "linux-libc-dev", "InstalledVersion": "7.0.0-38.38", + "PkgIdentifier": {"PURL": PURL}, "Severity": severity, "FixedVersion": fixed} + self.report["Results"][1]["Vulnerabilities"] = [item] + return item + def test_complete_clean_scan(self): + self.assertEqual(self.check(), []) + def test_missing_expected_binary(self): + self.report["Results"] = self.report["Results"][1:] + with self.assertRaises(ValueError): self.check() + def test_empty_binary_packages(self): + self.report["Results"][0]["Packages"] = [] + with self.assertRaises(ValueError): self.check() + def test_other_binary_missing_analysis(self): + self.report["Results"].append({"Target":"other", "Type":"gobinary"}) + with self.assertRaises(ValueError): self.check() + def test_exact_nonexecuted_header(self): + self.finding("HIGH") + self.assertEqual(self.check(), []) + def test_fixed_header_is_never_exempt(self): + self.finding("LOW", "7.0.0-99") + self.assertTrue(self.check()) + def test_new_header_advisory_blocks(self): + self.finding()["VulnerabilityID"] = "HEADER-NEW" + self.assertTrue(self.check()) + def test_header_purl_drift_blocks(self): + self.finding()["PkgIdentifier"]["PURL"] += "-different" + self.assertTrue(self.check()) + def test_missing_header_boundary_blocks(self): + self.finding() + self.boundary = {} + with self.assertRaises(ValueError): self.check() + def test_unregistered_low_medium_unknown_block(self): + for severity in ("LOW", "MEDIUM", "HIGH", "CRITICAL", "UNKNOWN"): + self.finding(severity)["PkgName"] = "other" + self.assertTrue(self.check()) + def test_secrets_block(self): + self.report["Results"][1]["Secrets"] = [{"RuleID": "test"}] + self.assertTrue(self.check()) + def test_nofix_ledger_does_not_exempt_fixed_finding(self): + finding = self.finding("LOW", "2") + finding.update(PkgName="test", InstalledVersion="1", PkgIdentifier={"PURL":"pkg:test/test@1"}) + self.ledger["unfixed"] = [{"id":"HEADER-1", "package":"test", "version":"1", "purl":"pkg:test/test@1", + "severity":"LOW", "status":"no_official_fix", "officialEvidence":"https://fixture.invalid/test", + "reason":"test", "checkedAt":"2026-10-23"}] + self.assertTrue(self.check()) + +if __name__ == "__main__": + unittest.main() diff --git a/.github/scripts/test_node_builder_vex.py b/.github/scripts/test_node_builder_vex.py new file mode 100644 index 00000000..549ef98e --- /dev/null +++ b/.github/scripts/test_node_builder_vex.py @@ -0,0 +1,35 @@ +import copy +import importlib.util +from pathlib import Path +import unittest + +spec=importlib.util.spec_from_file_location("gate",Path(__file__).with_name("enforce-runtime-vulnerabilities.py")) +gate=importlib.util.module_from_spec(spec);spec.loader.exec_module(gate) +REPO="PastureStack/node-agent" +class MetadataVex(unittest.TestCase): + def setUp(self): + self.finding={"VulnerabilityID":"CVE-2025-54388","PkgName":"docker.io","InstalledVersion":"29.1.3-0ubuntu4.1","Severity":"MEDIUM","FixedVersion":"","PkgIdentifier":{"PURL":"pkg:deb/ubuntu/docker.io@29.1.3-0ubuntu4.1?arch=amd64&distro=ubuntu-26.04"}} + self.report={"SchemaVersion":2,"Results":[{"Target":"usr/local/go/bin/go","Type":"gobinary","Packages":[{"Name":"stdlib"}]},{"Target":"os","Vulnerabilities":[self.finding]}]} + self.ledger={"repository":REPO,"unfixed":[]} + self.headers={"repository":REPO,"package":"linux-libc-dev","version":"7.0.0-38.38","purl":"pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04","ids":[]} + self.proof={"dockerdVersion":"Docker version 29.1.3, build fixture","pip":{"verifiedWheelSha256":"be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a","pip":"26.2.2+pasturestack.1","urllib3":"2.8.0","vendorFilesByteCompared":299}} + def check(self): + return gate.builder_violations(self.report,self.ledger,REPO,{},self.headers,node_proof=self.proof) + def test_exact_daemon_outside_affected_range(self): + self.assertEqual(self.check(),[]) + def test_changed_daemon_blocks(self): + self.proof["dockerdVersion"]="Docker version 28.3.2, build fixture" + self.assertTrue(self.check()) + def test_changed_package_blocks(self): + self.finding["InstalledVersion"]="28.3.2" + self.assertTrue(self.check()) + def test_available_fix_never_exempt(self): + self.finding["FixedVersion"]="30" + self.assertTrue(self.check()) + def test_complete_patched_seed(self): + self.finding.update(VulnerabilityID="CVE-2025-66418",PkgName="python3-pip-whl",InstalledVersion="25.1.1+dfsg-1ubuntu2",PkgIdentifier={"PURL":"pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04"}) + self.assertEqual(self.check(),[]) + self.proof["pip"]["verifiedWheelSha256"]="0"*64 + self.assertTrue(self.check()) + +if __name__=="__main__": unittest.main() diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index b5ca7dab..7bbb9c25 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -125,6 +125,7 @@ jobs: docker run --rm --entrypoint python3 "$DAPPER_IMAGE" \ /opt/python-security/scripts/check-pip-vendor-slice.py \ > evidence/pip-vendor-proof.json + docker run --rm --entrypoint dockerd "$DAPPER_IMAGE" --version > evidence/dockerd-version.txt python3 scripts/pip-security/test-pip-vex.py python3 scripts/pip-security/filter-pip-vendor-findings.py \ --raw evidence/dapper-security-raw.json --proof evidence/pip-vendor-proof.json \ @@ -255,6 +256,11 @@ jobs: - name: Enforce full runtime vulnerability policy run: | + bash .github/scripts/check-builder-header-boundary.sh "$DAPPER_IMAGE" > evidence/dapper-header-boundary.json + python3 .github/scripts/test_builder_vulnerability_policy.py + python3 .github/scripts/test_node_builder_vex.py + cp security/dapper-runtime-metadata.openvex.json evidence/ + python3 .github/scripts/enforce-runtime-vulnerabilities.py --scope builder --repository PastureStack/node-agent < evidence/dapper-security.json python3 .github/scripts/test_runtime_vulnerability_policy.py python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/node-agent < evidence/runtime-security.json python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/node-agent < evidence/product-security.json diff --git a/README.md b/README.md index 7bac36c7..df21506c 100644 --- a/README.md +++ b/README.md @@ -76,3 +76,6 @@ The full-severity runtime gate rejects every finding with an official fix, including LOW, MEDIUM and UNKNOWN. Only exact reviewed LOW/MEDIUM no-fix entries may pass. Existing v0.13.32 remains published for provenance, but is not the fully patched candidate. +### Complete build-environment gate + +The Dapper scan retains all severities and requires nonempty package analysis for the expected Go binaries. Any available fixed version fails, including Low, Medium and Unknown findings. Other Low/Medium findings require an exact package/version/PURL entry backed by the official vendor tracker. The pinned userspace kernel-header exception additionally requires the reviewed CVE set, actual header payload paths, and absence of kernel images/modules; it never permits an available fix. Unknown module findings require the separately verified exact source package graph, not a generic severity exemption. diff --git a/scripts/package-image b/scripts/package-image index 477bde87..1ab8d43b 100755 --- a/scripts/package-image +++ b/scripts/package-image @@ -49,7 +49,7 @@ curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ printf '%s %s\n' 51cf418571059831096abd40e0bd5debaa1ae48a6f8d87d9e4e5f7f12aa4db52 \ "$tmpdir/openssl-provider-legacy.deb" | sha256sum --check -DOCKER_BUILDKIT="${DOCKER_BUILDKIT:-1}" docker build \ +docker build \ --network="${DOCKER_BUILD_NETWORK:-default}" \ --build-arg PASTURESTACK_IMAGE_VERSION="${tag}" \ -t "${image_name}:${tag}" \ diff --git a/security/dapper-runtime-metadata.openvex.json b/security/dapper-runtime-metadata.openvex.json new file mode 100644 index 00000000..6ccde49d --- /dev/null +++ b/security/dapper-runtime-metadata.openvex.json @@ -0,0 +1,94 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/PastureStack/node-agent/security/dapper-runtime-metadata/2026-10-23", + "author": "PastureStack contributors", + "timestamp": "2026-10-23T14:55:00Z", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-54388" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/docker.io@29.1.3-0ubuntu4.1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The official Moby advisory GHSA-x4rx-4gw3-53p4 limits affected versions to 28.2.x through 28.3.2, fixed in 28.3.3. The exact installed Ubuntu package is 29.1.3-0ubuntu4.1, and CI additionally requires the actual dockerd --version output to be 29.1.3. Neither an unverified package version nor a different daemon can use this statement.", + "references": [ + "https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4", + "https://ubuntu.com/security/CVE-2025-54388" + ] + }, + { + "vulnerability": { + "name": "CVE-2025-66418" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The original pip seed wheel is removed and replaced with pip 26.2.2+pasturestack.1, complete wheel SHA256 be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a, containing urllib3 2.8.0. The dpkg source-package version is retained for ABI dependency compatibility, not used as proof. CI verifies the actual ensurepip seed and live pip bytes, 299 vendored files, pip/urllib3 versions, and new venv/virtualenv installations. The statement fails closed for a changed wheel or an available FixedVersion.", + "references": [ + "https://github.com/pypa/pip/releases/tag/26.2.2", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0" + ] + }, + { + "vulnerability": { + "name": "CVE-2025-66471" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The original pip seed wheel is removed and replaced with pip 26.2.2+pasturestack.1, complete wheel SHA256 be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a, containing urllib3 2.8.0. The dpkg source-package version is retained for ABI dependency compatibility, not used as proof. CI verifies the actual ensurepip seed and live pip bytes, 299 vendored files, pip/urllib3 versions, and new venv/virtualenv installations. The statement fails closed for a changed wheel or an available FixedVersion.", + "references": [ + "https://github.com/pypa/pip/releases/tag/26.2.2", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0" + ] + }, + { + "vulnerability": { + "name": "CVE-2026-21441" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The original pip seed wheel is removed and replaced with pip 26.2.2+pasturestack.1, complete wheel SHA256 be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a, containing urllib3 2.8.0. The dpkg source-package version is retained for ABI dependency compatibility, not used as proof. CI verifies the actual ensurepip seed and live pip bytes, 299 vendored files, pip/urllib3 versions, and new venv/virtualenv installations. The statement fails closed for a changed wheel or an available FixedVersion.", + "references": [ + "https://github.com/pypa/pip/releases/tag/26.2.2", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0" + ] + }, + { + "vulnerability": { + "name": "CVE-2026-1703" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The original pip seed wheel is removed and replaced with pip 26.2.2+pasturestack.1, complete wheel SHA256 be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a, containing urllib3 2.8.0. The dpkg source-package version is retained for ABI dependency compatibility, not used as proof. CI verifies the actual ensurepip seed and live pip bytes, 299 vendored files, pip/urllib3 versions, and new venv/virtualenv installations. The statement fails closed for a changed wheel or an available FixedVersion.", + "references": [ + "https://github.com/pypa/pip/releases/tag/26.2.2", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0" + ] + } + ] +} From 4edc9d0b79fb9e4b3c586901221708efd01583bd Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:27:09 +0800 Subject: [PATCH 05/10] security: repair builder container tools and require explicit ELF coverage --- .github/dapper-unfixed.json | 12 +-- .../enforce-runtime-vulnerabilities.py | 35 +++++++- .../scripts/scan-dapper-container-binaries.sh | 45 ++++++++++ .github/scripts/test_node_builder_vex.py | 44 ++++++--- .github/workflows/security-release-gate.yml | 3 +- Dockerfile.dapper | 7 +- README.md | 19 ++++ scripts/install-dapper-container-tools | 89 +++++++++++++++++++ security/dapper-runtime-metadata.openvex.json | 17 ---- 9 files changed, 227 insertions(+), 44 deletions(-) create mode 100644 .github/scripts/scan-dapper-container-binaries.sh create mode 100644 scripts/install-dapper-container-tools diff --git a/.github/dapper-unfixed.json b/.github/dapper-unfixed.json index 2b21bc26..0dbe640d 100644 --- a/.github/dapper-unfixed.json +++ b/.github/dapper-unfixed.json @@ -79,15 +79,15 @@ "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-60876" }, { - "package": "containerd", - "purl": "pkg:deb/ubuntu/containerd@2.2.2-0ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "package": "github.com/docker/distribution", + "purl": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible", "checkedAt": "2026-10-23", "status": "no_official_fix", - "id": "CVE-2026-46680", + "id": "CVE-2026-85747", "severity": "MEDIUM", - "reason": "Canonical Ubuntu 26.04 official tracker: resolute_containerd: needed; no official fixed package available.", - "version": "2.2.2-0ubuntu1.1", - "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-46680" + "reason": "The official advisory lists all docker/distribution v2 releases through v2.8.3 as affected and no patched v2 release. The released v3.1.2 fix uses a different import major. The daemon metadata API is reachable and is not covered by the CLI digest-check mitigation. Retain the raw Medium finding; do not use unpublished commits or a not-affected VEX. Any future FixedVersion fails the gate.", + "version": "v2.8.3+incompatible", + "officialEvidence": "https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3" }, { "package": "dash", diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py index 248c6486..16c3bdae 100644 --- a/.github/scripts/enforce-runtime-vulnerabilities.py +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -60,12 +60,26 @@ def builder_violations(report, ledger, repository, header_boundary, header_ledge expected += ["usr/bin/docker", "usr/libexec/docker/cli-plugins/docker-buildx"] if repository == "PastureStack/kubernetes-authentication-bridge": expected += ["usr/bin/docker", "usr/local/libexec/docker/cli-plugins/docker-buildx"] + if repository == "PastureStack/node-agent": + expected += ["usr/bin/" + name for name in ( + "docker", "dockerd", "docker-proxy", "containerd", + "containerd-shim-runc-v2", "ctr", "runc")] binaries = {r.get("Target"): r for r in results if r.get("Type") == "gobinary"} for target in expected: if not binaries.get(target, {}).get("Packages"): raise ValueError("missing nonempty binary analysis: " + target) if any(not result.get("Packages") for result in binaries.values()): raise ValueError("incomplete Go binary package analysis") + if repository == "PastureStack/node-agent" and node_proof: + graphs = node_proof.get("containerGraphs", {}) + roots = {name: "github.com/containerd/containerd/v2/cmd/" + name + for name in ("containerd", "ctr", "containerd-shim-runc-v2")} + roots["runc"] = "github.com/opencontainers/runc" + if set(graphs) != set(roots) or any( + root not in graphs[name].splitlines() or any( + p == "golang.org/x/crypto/openpgp" or p.startswith("golang.org/x/crypto/openpgp/") + for p in graphs[name].splitlines()) for name, root in roots.items()): + raise ValueError("missing exact container-tool package graphs") has_headers = any(f.get("PkgName") == "linux-libc-dev" for r in results for f in (r.get("Vulnerabilities") or [])) if has_headers and header_boundary != {"package": "linux-libc-dev", "version": "7.0.0-38.38", "kernel_images": False, "kernel_modules": False}: @@ -125,9 +139,21 @@ def builder_violations(report, ledger, repository, header_boundary, header_ledge and len(docker_proof.get("binarySha256", "")) == 64): continue if (unfixed and repository == "PastureStack/node-agent" and node_proof): - if (key == ("CVE-2025-54388", "docker.io", "29.1.3-0ubuntu4.1", - "pkg:deb/ubuntu/docker.io@29.1.3-0ubuntu4.1?arch=amd64&distro=ubuntu-26.04") - and "Docker version 29.1.3," in node_proof.get("dockerdVersion", "")): + daemon = node_proof.get("dockerdOpenpgp", {}) + if (key == ("GO-2026-5932", "golang.org/x/crypto", "v0.58.0", + "pkg:golang/golang.org/x/crypto@v0.58.0") + and result.get("Target") == "usr/bin/dockerd" + and daemon.get("binarySha256") == "3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0" + and daemon.get("sourceCommit") == "0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c" + and daemon.get("cryptoSymbols", 0) > 0 + and daemon.get("openpgpSymbols") == 0): + continue + graphs = node_proof.get("containerGraphs", {}) + if (key == ("GO-2026-5932", "golang.org/x/crypto", "v0.57.0", + "pkg:golang/golang.org/x/crypto@v0.57.0") + and result.get("Target") in ("usr/bin/containerd", "usr/bin/ctr", "usr/bin/containerd-shim-runc-v2") + and set(graphs) == {"containerd", "ctr", "containerd-shim-runc-v2", "runc"} + and all(graph and not any(p == "golang.org/x/crypto/openpgp" or p.startswith("golang.org/x/crypto/openpgp/") for p in graph.splitlines()) for graph in graphs.values())): continue pip = node_proof.get("pip", {}) if (key[0] in ("CVE-2025-66418", "CVE-2025-66471", "CVE-2026-21441", "CVE-2026-1703") @@ -169,7 +195,8 @@ def builder_violations(report, ledger, repository, header_boundary, header_ledge node_proof = None if args.repository == "PastureStack/node-agent": node_proof = {"pip": json.loads((repo_root / evidence_dir / "pip-vendor-proof.json").read_text(encoding="utf-8")), - "dockerdVersion": (repo_root / evidence_dir / "dockerd-version.txt").read_text(encoding="utf-8")} + "dockerdOpenpgp": json.loads((repo_root / evidence_dir / "dockerd-openpgp-proof.json").read_text(encoding="utf-8")), + "containerGraphs": {name: (repo_root / evidence_dir / "container-tools" / (name + "-package-graph.txt")).read_text(encoding="utf-8") for name in ("containerd", "ctr", "containerd-shim-runc-v2", "runc")}} failures = builder_violations(report, ledger, args.repository, boundary, headers, graphs, docker_proof, node_proof) if failures: raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) diff --git a/.github/scripts/scan-dapper-container-binaries.sh b/.github/scripts/scan-dapper-container-binaries.sh new file mode 100644 index 00000000..92ee5b12 --- /dev/null +++ b/.github/scripts/scan-dapper-container-binaries.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +# OS-package ownership must never suppress the executable dependency scan. +set -euo pipefail +test "$#" -eq 3 +image=$1 scanner=$2 cache=$3 +root=$(mktemp -d) +container=$(docker create "$image") +trap 'docker rm -f "$container" >/dev/null 2>&1 || true; rm -rf -- "$root"' EXIT +mkdir -p "$root/usr/bin" evidence/container-tools +for tool in docker dockerd docker-proxy containerd containerd-shim-runc-v2 ctr runc; do + docker cp "$container:/usr/bin/$tool" "$root/usr/bin/$tool" + test -s "$root/usr/bin/$tool" +done +docker cp "$container:/licenses/container-tools/." evidence/container-tools/ +sha256sum "$root/usr/bin/dockerd" | awk '{print $1}' > evidence/dockerd.sha256 +docker run --rm --entrypoint go "$image" tool nm /usr/bin/dockerd > evidence/dockerd-symbols.txt +python3 - <<'PY' +import json +from pathlib import Path +lines=Path('evidence/dockerd-symbols.txt').read_text().splitlines() +crypto=[line for line in lines if 'golang.org/x/crypto/' in line] +openpgp=[line for line in crypto if 'golang.org/x/crypto/openpgp' in line] +sha=Path('evidence/dockerd.sha256').read_text().strip() +assert sha=='3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0' +assert len(crypto)>0 and not openpgp +Path('evidence/dockerd-openpgp-proof.json').write_text(json.dumps({ + 'binarySha256':sha,'sourceCommit':'0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c', + 'cryptoSymbols':len(crypto),'openpgpSymbols':len(openpgp)})) +PY +docker run --rm --network none -v "$root:/scan:ro" -v "$PWD/evidence:/evidence" \ + -v "$cache:/root/.cache/trivy" "$scanner" rootfs --skip-db-update --offline-scan \ + --scanners vuln,secret --list-all-pkgs --format json \ + --output /evidence/container-tools-security.json /scan +python3 - <<'PY' +import json +from pathlib import Path +report=json.loads(Path('evidence/container-tools-security.json').read_text()) +results={r['Target']:r for r in report['Results'] if r.get('Type')=='gobinary'} +expected={'usr/bin/'+name for name in ('docker','dockerd','docker-proxy','containerd','containerd-shim-runc-v2','ctr','runc')} +assert set(results)==expected +assert all(results[target].get('Packages') for target in expected) +image=json.loads(Path('evidence/dapper-security-image.json').read_text()) +image['Results']+=report['Results'] +Path('evidence/dapper-security-raw.json').write_text(json.dumps(image)) +PY diff --git a/.github/scripts/test_node_builder_vex.py b/.github/scripts/test_node_builder_vex.py index 549ef98e..a69ad872 100644 --- a/.github/scripts/test_node_builder_vex.py +++ b/.github/scripts/test_node_builder_vex.py @@ -1,4 +1,3 @@ -import copy import importlib.util from pathlib import Path import unittest @@ -8,26 +7,45 @@ REPO="PastureStack/node-agent" class MetadataVex(unittest.TestCase): def setUp(self): - self.finding={"VulnerabilityID":"CVE-2025-54388","PkgName":"docker.io","InstalledVersion":"29.1.3-0ubuntu4.1","Severity":"MEDIUM","FixedVersion":"","PkgIdentifier":{"PURL":"pkg:deb/ubuntu/docker.io@29.1.3-0ubuntu4.1?arch=amd64&distro=ubuntu-26.04"}} - self.report={"SchemaVersion":2,"Results":[{"Target":"usr/local/go/bin/go","Type":"gobinary","Packages":[{"Name":"stdlib"}]},{"Target":"os","Vulnerabilities":[self.finding]}]} + self.finding={"VulnerabilityID":"GO-2026-5932","PkgName":"golang.org/x/crypto","InstalledVersion":"v0.58.0","Severity":"UNKNOWN","FixedVersion":"","PkgIdentifier":{"PURL":"pkg:golang/golang.org/x/crypto@v0.58.0"}} + tools=('docker','dockerd','docker-proxy','containerd','containerd-shim-runc-v2','ctr','runc') + self.report={"SchemaVersion":2,"Results":[{"Target":"usr/local/go/bin/go","Type":"gobinary","Packages":[{"Name":"stdlib"}]}]+[ + {"Target":"usr/bin/"+name,"Type":"gobinary","Packages":[{"Name":"stdlib"}],"Vulnerabilities":[self.finding] if name=='dockerd' else []} for name in tools]} self.ledger={"repository":REPO,"unfixed":[]} self.headers={"repository":REPO,"package":"linux-libc-dev","version":"7.0.0-38.38","purl":"pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04","ids":[]} - self.proof={"dockerdVersion":"Docker version 29.1.3, build fixture","pip":{"verifiedWheelSha256":"be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a","pip":"26.2.2+pasturestack.1","urllib3":"2.8.0","vendorFilesByteCompared":299}} + graphs={name:'github.com/containerd/containerd/v2/cmd/'+name for name in ('containerd','ctr','containerd-shim-runc-v2')} + graphs['runc']='github.com/opencontainers/runc' + self.proof={"dockerdOpenpgp":{"binarySha256":"3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0","sourceCommit":"0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c","cryptoSymbols":779,"openpgpSymbols":0},"containerGraphs":graphs, + "pip":{"verifiedWheelSha256":"be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a","pip":"26.2.2+pasturestack.1","urllib3":"2.8.0","vendorFilesByteCompared":299}} def check(self): return gate.builder_violations(self.report,self.ledger,REPO,{},self.headers,node_proof=self.proof) - def test_exact_daemon_outside_affected_range(self): - self.assertEqual(self.check(),[]) - def test_changed_daemon_blocks(self): - self.proof["dockerdVersion"]="Docker version 28.3.2, build fixture" + def test_exact_daemon_openpgp_absent(self): self.assertEqual(self.check(),[]) + def test_changed_binary_blocks(self): + self.proof['dockerdOpenpgp']['binarySha256']='0'*64 + self.assertTrue(self.check()) + def test_missing_positive_control_blocks(self): + self.proof['dockerdOpenpgp']['cryptoSymbols']=0 + self.assertTrue(self.check()) + def test_present_openpgp_blocks(self): + self.proof['dockerdOpenpgp']['openpgpSymbols']=1 self.assertTrue(self.check()) - def test_changed_package_blocks(self): - self.finding["InstalledVersion"]="28.3.2" + def test_new_fixed_version_blocks(self): + self.finding['FixedVersion']='0.59' self.assertTrue(self.check()) - def test_available_fix_never_exempt(self): - self.finding["FixedVersion"]="30" + def test_missing_actual_daemon_analysis_blocks(self): + self.report['Results']=[r for r in self.report['Results'] if r['Target']!='usr/bin/dockerd'] + with self.assertRaises(ValueError): self.check() + def test_missing_graph_root_blocks(self): + self.proof['containerGraphs']['containerd']='fixture' + with self.assertRaises(ValueError): self.check() + def test_reachable_openpgp_graph_blocks(self): + self.proof['containerGraphs']['runc']+='\ngolang.org/x/crypto/openpgp' + with self.assertRaises(ValueError): self.check() + def test_distribution_daemon_is_not_cli_exempt(self): + self.finding.update(VulnerabilityID='CVE-2026-85747',PkgName='github.com/docker/distribution',InstalledVersion='v2.8.3+incompatible',Severity='MEDIUM',PkgIdentifier={'PURL':'pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible'}) self.assertTrue(self.check()) def test_complete_patched_seed(self): - self.finding.update(VulnerabilityID="CVE-2025-66418",PkgName="python3-pip-whl",InstalledVersion="25.1.1+dfsg-1ubuntu2",PkgIdentifier={"PURL":"pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04"}) + self.finding.update(VulnerabilityID="CVE-2025-66418",PkgName="python3-pip-whl",InstalledVersion="25.1.1+dfsg-1ubuntu2",Severity='MEDIUM',PkgIdentifier={"PURL":"pkg:deb/ubuntu/python3-pip-whl@25.1.1%2Bdfsg-1ubuntu2?arch=all&distro=ubuntu-26.04"}) self.assertEqual(self.check(),[]) self.proof["pip"]["verifiedWheelSha256"]="0"*64 self.assertTrue(self.check()) diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 7bbb9c25..92ad9d9b 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -121,7 +121,8 @@ jobs: docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \ --skip-db-update --offline-scan --scanners vuln,secret --list-all-pkgs --format json \ - --output /work/evidence/dapper-security-raw.json "$DAPPER_IMAGE" + --output /work/evidence/dapper-security-image.json "$DAPPER_IMAGE" + bash .github/scripts/scan-dapper-container-binaries.sh "$DAPPER_IMAGE" "$TRIVY_IMAGE" "$cache" docker run --rm --entrypoint python3 "$DAPPER_IMAGE" \ /opt/python-security/scripts/check-pip-vendor-slice.py \ > evidence/pip-vendor-proof.json diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 10ae9a31..f06ef179 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -46,20 +46,19 @@ RUN set -eux; \ bash \ busybox-static \ ca-certificates \ - containerd \ curl \ - docker.io \ file \ gcc \ git \ iproute2 \ iptables \ libc6-dev \ + libseccomp-dev \ make \ + pkg-config \ python3 \ python3-pip \ python3-venv \ - runc \ tar \ util-linux \ uuid-runtime \ @@ -110,6 +109,7 @@ RUN python3 /opt/python-security/scripts/build-pip-overlay.py --work /tmp/pip-ov rm -rf /tmp/pip-overlay-build ADD --checksum=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl /opt/python-security/certifi-2026.10.19-py3-none-any.whl COPY scripts/install-python-security-tools /usr/local/bin/install-python-security-tools +COPY scripts/install-dapper-container-tools /usr/local/bin/install-dapper-container-tools ENV VIRTUALENV_PIP=26.2.2+pasturestack.1 VIRTUALENV_EXTRA_SEARCH_DIR=/usr/share/python-wheels VIRTUALENV_NO_PERIODIC_UPDATE=1 ENV GOLANG_ARCH_amd64=amd64 GOLANG_ARCH_arm=armv6l GOLANG_ARCH=GOLANG_ARCH_${ARCH} \ GO_SHA256=GO_SHA256_${ARCH} \ @@ -121,6 +121,7 @@ RUN curl -fsSL -o /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-${!GOLANG tar -C /usr/local -xzf /tmp/go.tgz && \ rm -f /tmp/go.tgz && \ bash /usr/local/bin/install-python-security-tools && \ + bash /usr/local/bin/install-dapper-container-tools && \ python3 -m venv /opt/tox && \ /opt/tox/bin/pip install --no-cache-dir --upgrade \ "setuptools==${SETUPTOOLS_VERSION}" \ diff --git a/README.md b/README.md index df21506c..5aa4870e 100644 --- a/README.md +++ b/README.md @@ -79,3 +79,22 @@ patched candidate. ### Complete build-environment gate The Dapper scan retains all severities and requires nonempty package analysis for the expected Go binaries. Any available fixed version fails, including Low, Medium and Unknown findings. Other Low/Medium findings require an exact package/version/PURL entry backed by the official vendor tracker. The pinned userspace kernel-header exception additionally requires the reviewed CVE set, actual header payload paths, and absence of kernel images/modules; it never permits an available fix. Unknown module findings require the separately verified exact source package graph, not a generic severity exemption. + +The disposable builder uses official Docker 29.9.2 CLI/daemon bytes, with its +supported Go 1.26.10 compiler, rather than Ubuntu's outdated embedded Go tools. +Containerd stays on the 2.2 compatibility branch at 2.2.10 and runc stays on 1.4 +at 1.4.3; both are rebuilt from SHA-pinned released sources using Go 1.27.3 and +released security-fixed dependencies. Runc retains seccomp. Containerd's build +omits the unused Btrfs snapshotter; the actual test daemon uses overlay2/vfs. +These are builder-only changes, not a host Docker upgrade or a new deployment +recipe. CI exercises the real inner daemon and package-image build, independently +scans all seven container-tool ELF files, and fails if any expected analysis is +missing. Complete raw image and standalone ELF reports are retained. + +The daemon's reachable distribution metadata API retains CVE-2026-85747 as an +exact reviewed Medium no-fix finding: the official advisory has no released +docker/distribution v2 fix. The v3.1.2 fix is a different module major; neither an +unpublished v2 commit nor the CLI's digest mitigation is substituted. Future +official fixed-version findings remain blocking. The exact official daemon's +OpenPGP absence is separately checked against its SHA and nonempty crypto symbol +control; it does not exempt the distribution finding. diff --git a/scripts/install-dapper-container-tools b/scripts/install-dapper-container-tools new file mode 100644 index 00000000..69d26ce7 --- /dev/null +++ b/scripts/install-dapper-container-tools @@ -0,0 +1,89 @@ +#!/usr/bin/env bash +# Build-only tools: keep containerd 2.2 and runc 1.4 compatibility branches. +set -euo pipefail +test "$(go env GOVERSION)" = go1.27.3 +test "$HOST_ARCH" = amd64 +work=$(mktemp -d /tmp/node-container-tools.XXXXXX) +trap 'rm -rf -- "$work"' EXIT +export GOTOOLCHAIN=local GOPROXY=https://proxy.golang.org GOSUMDB=sum.golang.org +export GOFLAGS=-mod=mod GOCACHE="$work/cache" GOMODCACHE="$work/modules" +proof=/licenses/container-tools +mkdir -p "$proof" "$work/containerd" "$work/runc" +fetch() { + curl --fail --silent --show-error --location --retry 5 "$1" -o "$2" + printf '%s %s\n' "$3" "$2" | sha256sum -c - +} +fetch https://raw.githubusercontent.com/moby/moby/0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c/LICENSE \ + "$proof/docker-LICENSE" 3f0cfdfd5c7ab8cfc8169a57384e297e60f4fe4e8d1060ec4c21c11435d89564 +fetch https://raw.githubusercontent.com/moby/moby/0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c/NOTICE \ + "$proof/moby-NOTICE" 4bb4a5457d22fe492c9fdc6d97fd03047380f36e83c3afb6f3730cccb6d8d0c9 +fetch https://raw.githubusercontent.com/docker/cli/a82e528901260c8df6073311379eac65f92db204/NOTICE \ + "$proof/docker-cli-NOTICE" a6dc343629353d41f43fa5398e05594b47eca9b404c0ebb839610a50910fd230 +fetch https://download.docker.com/linux/static/stable/x86_64/docker-29.9.2.tgz \ + "$work/docker.tgz" 9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb +tar -xzf "$work/docker.tgz" -C "$work" docker/docker docker/dockerd docker/docker-proxy docker/docker-init +for tool in docker dockerd docker-proxy docker-init; do + install -m 0755 "$work/docker/$tool" "/usr/bin/$tool" +done +echo '3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0 /usr/bin/dockerd' | sha256sum -c - +echo '6c71cfe71faff949a602946a4df4799b563232e79d0b8b6fd343d0ef081c9621 /usr/bin/docker' | sha256sum -c - +fetch https://codeload.github.com/containerd/containerd/tar.gz/991ca6a8ca58b47346a42093210099e090bc6c1f \ + "$work/containerd.tgz" 0962ede134cea36107b0cec0ce152bcf47f1bfbd8945bc3b839a2456a389b077 +fetch https://codeload.github.com/opencontainers/runc/tar.gz/bb14dabeb7185bb72c8c86735d090dcb20f36587 \ + "$work/runc.tgz" 0128f07fa8bd2ce25d3debf7b52961a2cdc7fbd5fa2da6e76f460d280641fb1b +tar -xzf "$work/containerd.tgz" --strip-components=1 -C "$work/containerd" +tar -xzf "$work/runc.tgz" --strip-components=1 -C "$work/runc" +( + cd "$work/containerd" + go get github.com/cilium/ebpf@v0.22.0 github.com/klauspost/compress@v1.18.7 \ + github.com/moby/sys/user@v0.4.1 golang.org/x/net@v0.60.0 \ + golang.org/x/crypto@v0.57.0 golang.org/x/mod@v0.41.0 golang.org/x/text@v0.42.0 \ + google.golang.org/grpc@v1.83.2 \ + go.opentelemetry.io/otel@v1.45.0 go.opentelemetry.io/otel/sdk@v1.45.0 \ + go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 \ + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \ + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 + go mod download + export CGO_ENABLED=0 + tags='no_btrfs netgo osusergo urfave_cli_no_docs' + for tool in containerd ctr containerd-shim-runc-v2; do + go list -tags "$tags" -deps "./cmd/$tool" > "$proof/$tool-package-graph.txt" + done + go mod verify + export GOPROXY=off GOSUMDB=off + for tool in containerd ctr containerd-shim-runc-v2; do + go list -tags "$tags" -deps "./cmd/$tool" >/dev/null + go build -trimpath -buildvcs=false -tags "$tags" \ + -ldflags '-s -w -X github.com/containerd/containerd/v2/version.Version=v2.2.10 -X github.com/containerd/containerd/v2/version.Revision=991ca6a8ca58b47346a42093210099e090bc6c1f' \ + -o "/usr/bin/$tool" "./cmd/$tool" + done + cp go.mod "$proof/containerd.go.mod" + cp go.sum "$proof/containerd.go.sum" + cp LICENSE "$proof/containerd-LICENSE" +) +( + cd "$work/runc" + go get github.com/cilium/ebpf@v0.22.0 github.com/moby/sys/user@v0.4.1 \ + golang.org/x/net@v0.60.0 golang.org/x/sys@v0.46.0 + go mod download + CGO_ENABLED=1 go list -tags 'seccomp urfave_cli_no_docs' -deps . > "$proof/runc-package-graph.txt" + go mod verify + export GOPROXY=off GOSUMDB=off + make runc COMMIT=bb14dabeb7185bb72c8c86735d090dcb20f36587 + install -m 0755 runc /usr/bin/runc + cp go.mod "$proof/runc.go.mod" + cp go.sum "$proof/runc.go.sum" + cp LICENSE "$proof/runc-LICENSE" +) +for tool in docker dockerd docker-proxy containerd containerd-shim-runc-v2 ctr runc; do + go version -m "/usr/bin/$tool" > "$proof/$tool-buildinfo.txt" + sha256sum "/usr/bin/$tool" +done > "$proof/binaries.sha256" +if grep -E '^golang.org/x/crypto/openpgp($|/)' "$proof"/*-package-graph.txt; then + echo 'Unexpected OpenPGP dependency in rebuilt container tools' >&2 + exit 1 +fi +docker --version | grep -F '29.9.2' +dockerd --version | grep -F '29.9.2' +containerd --version | grep -F 'v2.2.10' +runc --version | grep -F '1.4.3' diff --git a/security/dapper-runtime-metadata.openvex.json b/security/dapper-runtime-metadata.openvex.json index 6ccde49d..80209172 100644 --- a/security/dapper-runtime-metadata.openvex.json +++ b/security/dapper-runtime-metadata.openvex.json @@ -5,23 +5,6 @@ "timestamp": "2026-10-23T14:55:00Z", "version": 1, "statements": [ - { - "vulnerability": { - "name": "CVE-2025-54388" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/docker.io@29.1.3-0ubuntu4.1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The official Moby advisory GHSA-x4rx-4gw3-53p4 limits affected versions to 28.2.x through 28.3.2, fixed in 28.3.3. The exact installed Ubuntu package is 29.1.3-0ubuntu4.1, and CI additionally requires the actual dockerd --version output to be 29.1.3. Neither an unverified package version nor a different daemon can use this statement.", - "references": [ - "https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4", - "https://ubuntu.com/security/CVE-2025-54388" - ] - }, { "vulnerability": { "name": "CVE-2025-66418" From ae13b1979c370ec1708f17828bba8779558fe57f Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:28:39 +0800 Subject: [PATCH 06/10] security: bind daemon exception to exact source import graph --- .../enforce-runtime-vulnerabilities.py | 1 + .../scripts/scan-dapper-container-binaries.sh | 12 +- .github/scripts/test_node_builder_vex.py | 1 + README.md | 10 +- security/docker-daemon-package-graph.txt | 2078 +++++++++++++++++ 5 files changed, 2098 insertions(+), 4 deletions(-) create mode 100644 security/docker-daemon-package-graph.txt diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py index 16c3bdae..86444b12 100644 --- a/.github/scripts/enforce-runtime-vulnerabilities.py +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -145,6 +145,7 @@ def builder_violations(report, ledger, repository, header_boundary, header_ledge and result.get("Target") == "usr/bin/dockerd" and daemon.get("binarySha256") == "3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0" and daemon.get("sourceCommit") == "0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c" + and daemon.get("sourcePackageGraphSha256") == "5b64dcb5265f1d7345e94688a0ee0700887000359cd25cc8f184d88835e79fd4" and daemon.get("cryptoSymbols", 0) > 0 and daemon.get("openpgpSymbols") == 0): continue diff --git a/.github/scripts/scan-dapper-container-binaries.sh b/.github/scripts/scan-dapper-container-binaries.sh index 92ee5b12..948831a4 100644 --- a/.github/scripts/scan-dapper-container-binaries.sh +++ b/.github/scripts/scan-dapper-container-binaries.sh @@ -15,17 +15,25 @@ docker cp "$container:/licenses/container-tools/." evidence/container-tools/ sha256sum "$root/usr/bin/dockerd" | awk '{print $1}' > evidence/dockerd.sha256 docker run --rm --entrypoint go "$image" tool nm /usr/bin/dockerd > evidence/dockerd-symbols.txt python3 - <<'PY' -import json +import hashlib, json from pathlib import Path lines=Path('evidence/dockerd-symbols.txt').read_text().splitlines() crypto=[line for line in lines if 'golang.org/x/crypto/' in line] openpgp=[line for line in crypto if 'golang.org/x/crypto/openpgp' in line] sha=Path('evidence/dockerd.sha256').read_text().strip() +graph=Path('security/docker-daemon-package-graph.txt').read_bytes() +graph_sha=hashlib.sha256(graph).hexdigest() +assert graph_sha=='5b64dcb5265f1d7345e94688a0ee0700887000359cd25cc8f184d88835e79fd4' +packages=graph.decode().splitlines() +assert len(packages)==2078 and 'github.com/moby/moby/v2/cmd/dockerd' in packages +assert not any(p=='golang.org/x/crypto/openpgp' or p.startswith('golang.org/x/crypto/openpgp/') for p in packages) assert sha=='3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0' assert len(crypto)>0 and not openpgp Path('evidence/dockerd-openpgp-proof.json').write_text(json.dumps({ 'binarySha256':sha,'sourceCommit':'0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c', - 'cryptoSymbols':len(crypto),'openpgpSymbols':len(openpgp)})) + 'cryptoSymbols':len(crypto),'openpgpSymbols':len(openpgp), + 'sourcePackageGraphSha256':graph_sha})) +Path('evidence/container-tools/docker-daemon-package-graph.txt').write_bytes(graph) PY docker run --rm --network none -v "$root:/scan:ro" -v "$PWD/evidence:/evidence" \ -v "$cache:/root/.cache/trivy" "$scanner" rootfs --skip-db-update --offline-scan \ diff --git a/.github/scripts/test_node_builder_vex.py b/.github/scripts/test_node_builder_vex.py index a69ad872..939b2d60 100644 --- a/.github/scripts/test_node_builder_vex.py +++ b/.github/scripts/test_node_builder_vex.py @@ -17,6 +17,7 @@ def setUp(self): graphs['runc']='github.com/opencontainers/runc' self.proof={"dockerdOpenpgp":{"binarySha256":"3a6132d4d99c1437e3422599f802207a3def9ba4de00ec1004a8e40d2740b9b0","sourceCommit":"0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c","cryptoSymbols":779,"openpgpSymbols":0},"containerGraphs":graphs, "pip":{"verifiedWheelSha256":"be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a","pip":"26.2.2+pasturestack.1","urllib3":"2.8.0","vendorFilesByteCompared":299}} + self.proof['dockerdOpenpgp']['sourcePackageGraphSha256']='5b64dcb5265f1d7345e94688a0ee0700887000359cd25cc8f184d88835e79fd4' def check(self): return gate.builder_violations(self.report,self.ledger,REPO,{},self.headers,node_proof=self.proof) def test_exact_daemon_openpgp_absent(self): self.assertEqual(self.check(),[]) diff --git a/README.md b/README.md index 5aa4870e..f62ceb90 100644 --- a/README.md +++ b/README.md @@ -96,5 +96,11 @@ exact reviewed Medium no-fix finding: the official advisory has no released docker/distribution v2 fix. The v3.1.2 fix is a different module major; neither an unpublished v2 commit nor the CLI's digest mitigation is substituted. Future official fixed-version findings remain blocking. The exact official daemon's -OpenPGP absence is separately checked against its SHA and nonempty crypto symbol -control; it does not exempt the distribution finding. +`golang.org/x/crypto/openpgp` absence is separately checked against its SHA and +nonempty crypto symbol control; it does not exempt the distribution finding. +The retained 2,078-package daemon source graph is from official commit +`0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c`, Linux/amd64, CGO=1 and official tags +`netgo,osusergo,static_build,nri_no_wasm,journald`, resolved offline from the +official vendor tree using Go 1.27.3. That analysis compiler is not the official +binary's Go 1.26.10 compiler. The graph includes ProtonMail's distinct OpenPGP +implementation; no claim is made that all OpenPGP code is absent. diff --git a/security/docker-daemon-package-graph.txt b/security/docker-daemon-package-graph.txt new file mode 100644 index 00000000..d908431d --- /dev/null +++ b/security/docker-daemon-package-graph.txt @@ -0,0 +1,2078 @@ +internal/goarch +unsafe +internal/abi +internal/unsafeheader +internal/cpu +internal/bytealg +internal/byteorder +internal/chacha8rand +internal/coverage/rtcov +internal/godebugs +internal/goexperiment +internal/goos +internal/profilerecord +internal/runtime/atomic +internal/runtime/syscall/linux +math/bits +internal/strconv +internal/runtime/cgroup +internal/runtime/exithook +internal/runtime/gc +internal/runtime/sys +internal/runtime/gc/scan +internal/asan +internal/msan +internal/race +internal/runtime/math +internal/runtime/maps +internal/runtime/pprof/label +internal/stringslite +internal/trace/tracev2 +runtime +internal/reflectlite +errors +sync/atomic +internal/sync +internal/synctest +sync +internal/oserror +cmp +iter +slices +syscall +time +context +math +unicode/utf8 +strconv +unicode +reflect +internal/fmtsort +io +path +io/fs +internal/filepathlite +internal/syscall/unix +internal/poll +internal/syscall/execenv +internal/testlog +os +fmt +bytes +container/list +hash +crypto +internal/bisect +internal/godebug +crypto/internal/fips140deps/godebug +strings +crypto/internal/fips140 +crypto/internal/fips140/alias +crypto/internal/fips140deps/byteorder +crypto/internal/fips140deps/cpu +crypto/internal/impl +crypto/internal/fips140/sha256 +crypto/internal/constanttime +crypto/internal/fips140/subtle +crypto/internal/fips140/sha3 +crypto/internal/fips140/sha512 +crypto/internal/fips140/hmac +crypto/internal/fips140/check +crypto/internal/fips140/aes +crypto/internal/fips140deps/time +crypto/internal/entropy/v1.0.0 +crypto/internal/sysrand +crypto/internal/fips140/drbg +crypto/internal/fips140/aes/gcm +crypto/fips140 +crypto/internal/fips140only +crypto/subtle +crypto/cipher +crypto/internal/boring/sig +crypto/internal/boring +crypto/aes +crypto/des +crypto/internal/fips140/nistec/fiat +crypto/internal/fips140/nistec +crypto/internal/fips140/ecdh +crypto/internal/fips140/edwards25519/field +math/rand/v2 +crypto/internal/randutil +crypto/internal/rand +crypto/ecdh +math/rand +math/big +crypto/elliptic +crypto/internal/boring/bbig +crypto/internal/fips140/bigmod +crypto/internal/fips140/ecdsa +weak +crypto/internal/fips140cache +crypto/sha3 +crypto/internal/fips140hash +crypto/sha512 +internal/saferio +unicode/utf16 +encoding/asn1 +vendor/golang.org/x/crypto/cryptobyte/asn1 +vendor/golang.org/x/crypto/cryptobyte +crypto/ecdsa +crypto/internal/fips140/edwards25519 +crypto/internal/fips140/ed25519 +crypto/rand +crypto/ed25519 +crypto/internal/fips140/hkdf +crypto/hkdf +crypto/hmac +crypto/internal/fips140/mlkem +crypto/mlkem +crypto/sha256 +encoding/binary +vendor/golang.org/x/crypto/internal/alias +vendor/golang.org/x/crypto/chacha20 +vendor/golang.org/x/crypto/internal/poly1305 +vendor/golang.org/x/sys/cpu +vendor/golang.org/x/crypto/chacha20poly1305 +crypto/hpke +crypto/internal/fips140/tls12 +crypto/internal/fips140/tls13 +crypto/md5 +crypto/internal/fips140/mldsa +crypto/mldsa +crypto/rc4 +crypto/internal/fips140/rsa +crypto/rsa +crypto/sha1 +crypto/tls/internal/fips140tls +crypto/dsa +encoding/hex +crypto/x509/pkix +encoding/base64 +encoding/pem +maps +vendor/golang.org/x/net/dns/dnsmessage +internal/nettrace +internal/singleflight +unique +net/netip +net +net/url +path/filepath +crypto/x509 +sort +crypto/tls +encoding +encoding/json/internal +encoding/json/internal/jsonflags +encoding/json/internal/jsonopts +encoding/json/internal/jsonwire +encoding/json/jsontext +encoding/base32 +encoding/json/v2 +encoding/json +bufio +github.com/moby/sys/userns +golang.org/x/sys/unix +github.com/containerd/cgroups/v3 +github.com/containerd/containerd/v2/defaults +log/internal +log +github.com/sirupsen/logrus +log/slog/internal +log/slog/internal/buffer +log/slog +github.com/sirupsen/logrus/hooks/slog +github.com/containerd/log +go.opentelemetry.io/otel/attribute/internal +github.com/cespare/xxhash/v2 +go.opentelemetry.io/otel/attribute/internal/xxhash +go.opentelemetry.io/otel/attribute +go.opentelemetry.io/otel/codes +go.opentelemetry.io/otel/semconv/v1.43.0 +go.opentelemetry.io/otel/trace/embedded +go.opentelemetry.io/otel/trace/internal/telemetry +go.opentelemetry.io/otel/trace +github.com/containerd/log/otel +github.com/coreos/go-systemd/v22/daemon +github.com/docker/go-connections/tlsconfig +compress/flate +hash/crc32 +compress/gzip +vendor/golang.org/x/text/transform +vendor/golang.org/x/text/unicode/bidi +vendor/golang.org/x/text/secure/bidirule +vendor/golang.org/x/text/unicode/norm +vendor/golang.org/x/net/idna +net/textproto +vendor/golang.org/x/net/http/httpguts +vendor/golang.org/x/net/http/httpproxy +mime +mime/quotedprintable +mime/multipart +net/http/httptrace +net/http/internal +net/http/internal/ascii +vendor/golang.org/x/net/http2/hpack +net/http/internal/httpcommon +net/http/internal/httpsfv +net/http/internal/http2 +net/http +expvar +github.com/beorn7/perks/quantile +hash/fnv +google.golang.org/protobuf/internal/detrand +google.golang.org/protobuf/internal/errors +google.golang.org/protobuf/encoding/protowire +google.golang.org/protobuf/internal/pragma +google.golang.org/protobuf/reflect/protoreflect +google.golang.org/protobuf/internal/descfmt +google.golang.org/protobuf/internal/descopts +embed +google.golang.org/protobuf/internal/editiondefaults +google.golang.org/protobuf/internal/flags +go/token +google.golang.org/protobuf/internal/strs +google.golang.org/protobuf/internal/encoding/text +google.golang.org/protobuf/internal/encoding/defval +google.golang.org/protobuf/internal/encoding/messageset +google.golang.org/protobuf/internal/genid +google.golang.org/protobuf/internal/order +google.golang.org/protobuf/reflect/protoregistry +google.golang.org/protobuf/runtime/protoiface +google.golang.org/protobuf/proto +google.golang.org/protobuf/internal/filedesc +google.golang.org/protobuf/internal/set +google.golang.org/protobuf/encoding/prototext +google.golang.org/protobuf/internal/encoding/tag +google.golang.org/protobuf/internal/protolazy +google.golang.org/protobuf/internal/impl +google.golang.org/protobuf/internal/filetype +google.golang.org/protobuf/internal/version +google.golang.org/protobuf/runtime/protoimpl +google.golang.org/protobuf/types/known/timestamppb +github.com/prometheus/client_model/go +regexp/syntax +regexp +github.com/prometheus/common/model +runtime/metrics +github.com/prometheus/client_golang/prometheus/internal +github.com/munnerz/goautoneg +google.golang.org/protobuf/encoding/protodelim +github.com/prometheus/common/expfmt +github.com/prometheus/procfs/internal/fs +github.com/prometheus/procfs/internal/util +github.com/prometheus/procfs +runtime/debug +github.com/prometheus/client_golang/prometheus +github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil/header +github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil +github.com/prometheus/client_golang/prometheus/promhttp/internal +github.com/prometheus/client_golang/prometheus/promhttp +github.com/docker/go-metrics +github.com/moby/buildkit/identity +github.com/moby/buildkit/util/bklog +google.golang.org/protobuf/types/known/anypb +github.com/containerd/typeurl/v2 +github.com/moby/buildkit/errdefs +github.com/pkg/errors +github.com/planetscale/vtprotobuf/protohelpers +github.com/moby/buildkit/util/stack +google.golang.org/genproto/googleapis/rpc/status +golang.org/x/net/internal/timeseries +html +text/template/parse +text/template +html/template +text/tabwriter +golang.org/x/net/trace +google.golang.org/grpc/backoff +google.golang.org/grpc/grpclog/internal +google.golang.org/grpc/grpclog +google.golang.org/grpc/connectivity +google.golang.org/grpc/attributes +google.golang.org/grpc/internal/credentials +google.golang.org/grpc/internal/envconfig +google.golang.org/grpc/credentials +google.golang.org/grpc/serviceconfig +google.golang.org/grpc/internal +google.golang.org/grpc/internal/channelz +google.golang.org/grpc/channelz +google.golang.org/grpc/metadata +google.golang.org/grpc/stats +google.golang.org/grpc/experimental/stats +google.golang.org/grpc/resolver +google.golang.org/grpc/balancer +google.golang.org/grpc/balancer/base +google.golang.org/grpc/balancer/pickfirst/internal +google.golang.org/grpc/experimental/balancer/weight +google.golang.org/grpc/internal/grpclog +google.golang.org/protobuf/internal/encoding/json +google.golang.org/protobuf/encoding/protojson +google.golang.org/protobuf/protoadapt +google.golang.org/grpc/internal/pretty +google.golang.org/grpc/balancer/pickfirst +google.golang.org/grpc/balancer/endpointsharding +google.golang.org/grpc/balancer/roundrobin +google.golang.org/grpc/codes +google.golang.org/grpc/credentials/insecure +google.golang.org/grpc/encoding/internal +google.golang.org/grpc/internal/grpcutil +google.golang.org/grpc/internal/mem +google.golang.org/grpc/mem +google.golang.org/grpc/encoding +google.golang.org/grpc/encoding/proto +google.golang.org/grpc/internal/backoff +google.golang.org/grpc/internal/balancer/gracefulswitch +google.golang.org/grpc/internal/balancerload +google.golang.org/protobuf/types/known/durationpb +google.golang.org/grpc/binarylog/grpc_binarylog_v1 +google.golang.org/grpc/internal/status +google.golang.org/grpc/status +google.golang.org/grpc/internal/binarylog +google.golang.org/grpc/internal/buffer +google.golang.org/grpc/internal/grpcsync +google.golang.org/grpc/internal/idle +google.golang.org/grpc/internal/metadata +google.golang.org/grpc/internal/serviceconfig +google.golang.org/grpc/internal/resolver +google.golang.org/grpc/internal/proxyattributes +golang.org/x/text/transform +golang.org/x/text/unicode/bidi +golang.org/x/text/secure/bidirule +golang.org/x/text/unicode/norm +golang.org/x/net/idna +golang.org/x/net/http/httpguts +golang.org/x/net/http2/hpack +golang.org/x/net/internal/httpcommon +golang.org/x/net/internal/httpsfv +golang.org/x/net/http2 +google.golang.org/grpc/internal/stats +google.golang.org/grpc/internal/syscall +google.golang.org/grpc/internal/transport/internal +google.golang.org/grpc/internal/transport/networktype +google.golang.org/grpc/internal/transport/readyreader +google.golang.org/grpc/keepalive +google.golang.org/grpc/peer +google.golang.org/grpc/tap +net/http/httputil +google.golang.org/grpc/internal/transport +google.golang.org/grpc/internal/resolver/delegatingresolver +google.golang.org/grpc/internal/resolver/passthrough +google.golang.org/grpc/internal/resolver/unix +google.golang.org/grpc/balancer/grpclb/state +google.golang.org/grpc/internal/resolver/dns/internal +google.golang.org/grpc/internal/resolver/dns +google.golang.org/grpc/resolver/dns +runtime/pprof +google.golang.org/grpc +github.com/moby/buildkit/util/grpcerrors +go.opentelemetry.io/otel/semconv/v1.37.0 +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal +github.com/go-logr/logr +github.com/go-logr/logr/funcr +github.com/go-logr/stdr +go.opentelemetry.io/auto/sdk/internal/telemetry +go.opentelemetry.io/otel/trace/noop +go.opentelemetry.io/auto/sdk +go.opentelemetry.io/otel/internal/errorhandler +go.opentelemetry.io/otel/metric/embedded +go.opentelemetry.io/otel/metric +go.opentelemetry.io/otel/internal/baggage +go.opentelemetry.io/otel/baggage +go.opentelemetry.io/otel/propagation +go.opentelemetry.io/otel/internal/global +go.opentelemetry.io/otel +go.opentelemetry.io/otel/metric/noop +go.opentelemetry.io/otel/semconv/v1.37.0/rpcconv +go.opentelemetry.io/otel/semconv/internal/metricpool +go.opentelemetry.io/otel/semconv/v1.43.0/rpcconv +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc +go.opentelemetry.io/otel/semconv/v1.43.0/httpconv +go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace/internal/semconv +go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace +github.com/felixge/httpsnoop +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp +go.opentelemetry.io/otel/sdk/instrumentation +go.opentelemetry.io/otel/sdk/internal/attrnorm +database/sql/internal +uuid +database/sql/driver +github.com/google/uuid +go.opentelemetry.io/otel/sdk +go.opentelemetry.io/otel/sdk/internal/x +os/user +go.opentelemetry.io/otel/sdk/resource +go.opentelemetry.io/otel/sdk/trace/internal/env +go.opentelemetry.io/otel/semconv/v1.43.0/otelconv +go.opentelemetry.io/otel/sdk/trace/internal/observ +runtime/trace +go.opentelemetry.io/otel/sdk/trace +github.com/moby/buildkit/util/tracing +google.golang.org/grpc/health/grpc_health_v1 +google.golang.org/grpc/health +github.com/moby/buildkit/session +github.com/moby/buildkit/util/apicaps/pb +github.com/moby/buildkit/util/apicaps +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/counter +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x +go.opentelemetry.io/proto/otlp/common/v1 +go.opentelemetry.io/proto/otlp/resource/v1 +go.opentelemetry.io/proto/otlp/metrics/v1 +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/observ +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/envconfig +github.com/cenkalti/backoff/v5 +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/retry +go.opentelemetry.io/otel/sdk/metric/internal/reservoir +go.opentelemetry.io/otel/sdk/metric/exemplar +go.opentelemetry.io/otel/sdk/metric/internal +go.opentelemetry.io/otel/sdk/metric/metricdata +go.opentelemetry.io/otel/sdk/metric/internal/aggregate +go.opentelemetry.io/otel/sdk/metric/internal/attrnorm +go.opentelemetry.io/otel/sdk/metric/internal/observ +go.opentelemetry.io/otel/sdk/metric/internal/x +go.opentelemetry.io/otel/sdk/metric +google.golang.org/grpc/encoding/gzip +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/oconf +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/transform +flag +github.com/grpc-ecosystem/grpc-gateway/v2/utilities +github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule +google.golang.org/genproto/googleapis/api/httpbody +google.golang.org/protobuf/types/known/fieldmaskpb +google.golang.org/protobuf/types/known/structpb +google.golang.org/protobuf/types/known/wrapperspb +github.com/grpc-ecosystem/grpc-gateway/v2/runtime +go.opentelemetry.io/proto/otlp/collector/metrics/v1 +google.golang.org/genproto/googleapis/rpc/errdetails +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/counter +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/observ +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/envconfig +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/retry +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/oconf +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/transform +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp +go.opentelemetry.io/proto/otlp/trace/v1 +go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform +go.opentelemetry.io/otel/exporters/otlp/otlptrace +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig +go.opentelemetry.io/proto/otlp/collector/trace/v1 +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpjson +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp +go.opentelemetry.io/otel/sdk/trace/tracetest +golang.org/x/sync/semaphore +github.com/moby/buildkit/util/tracing/detect +github.com/moby/extensions/grpcproxy +github.com/containerd/cgroups/v3/cgroup1/stats +github.com/containerd/cgroups/v3/cgroup2/stats +github.com/containerd/containerd/api/types/runc/options +archive/tar +github.com/containerd/ttrpc +google.golang.org/protobuf/types/known/emptypb +github.com/containerd/containerd/api/services/containers/v1 +github.com/opencontainers/go-digest +github.com/opencontainers/image-spec/specs-go +github.com/opencontainers/image-spec/specs-go/v1 +google.golang.org/protobuf/types/descriptorpb +github.com/containerd/containerd/api/types +github.com/containerd/containerd/api/services/diff/v1 +github.com/containerd/containerd/api/services/events/v1 +github.com/containerd/containerd/api/services/images/v1 +github.com/containerd/containerd/api/services/leases/v1 +github.com/containerd/containerd/api/services/namespaces/v1 +github.com/containerd/containerd/api/services/sandbox/v1 +github.com/containerd/containerd/api/services/snapshots/v1 +github.com/containerd/containerd/api/types/task +github.com/containerd/containerd/api/services/tasks/v1 +github.com/containerd/containerd/api/services/transfer/v1 +github.com/containerd/containerd/api/services/version/v1 +github.com/containerd/containerd/v2/core/containers +github.com/containerd/containerd/v2/internal/randutil +github.com/containerd/errdefs +github.com/containerd/containerd/v2/pkg/filters +github.com/containerd/containerd/v2/core/content +github.com/containerd/containerd/api/services/content/v1 +github.com/containerd/containerd/v2/pkg/protobuf +github.com/containerd/containerd/v2/pkg/protobuf/types +github.com/containerd/errdefs/pkg/internal/cause +github.com/containerd/errdefs/pkg/internal/types +github.com/containerd/errdefs/pkg/errgrpc +github.com/containerd/containerd/v2/core/content/proxy +github.com/klauspost/compress/internal/le +github.com/klauspost/compress/internal/regmask +github.com/klauspost/compress/flate +github.com/klauspost/compress/gzip +github.com/klauspost/compress +github.com/klauspost/compress/fse +github.com/klauspost/compress/internal/cpuinfo +github.com/klauspost/compress/huff0 +github.com/klauspost/compress/internal/snapref +github.com/klauspost/compress/zstd/internal/xxhash +github.com/klauspost/compress/zstd +os/exec +github.com/containerd/containerd/v2/pkg/archive/compression +github.com/containerd/containerd/v2/pkg/labels +github.com/containerd/platforms +golang.org/x/sync/errgroup +github.com/containerd/containerd/v2/core/images +github.com/containerd/containerd/v2/pkg/kernelversion +github.com/containerd/containerd/v2/pkg/sys +github.com/containerd/continuity/devices +github.com/containerd/continuity/sysx +github.com/containerd/continuity/fs +github.com/moby/sys/mountinfo +github.com/containerd/containerd/v2/core/mount +github.com/containerd/containerd/v2/pkg/protobuf/proto +github.com/containerd/containerd/v2/core/diff +github.com/containerd/containerd/v2/pkg/epoch +github.com/containerd/containerd/v2/core/snapshots +github.com/containerd/containerd/v2/internal/fsview +github.com/containerd/containerd/v2/pkg/cap +github.com/containerd/containerd/v2/internal/lazyregexp +github.com/containerd/containerd/v2/pkg/identifiers +github.com/containerd/containerd/v2/pkg/namespaces +github.com/moby/sys/user +github.com/opencontainers/runtime-spec/specs-go +github.com/containerd/containerd/v2/pkg/oci +github.com/containerd/containerd/v2/core/diff/proxy +github.com/containerd/containerd/v2/core/events +github.com/containerd/containerd/v2/core/events/proxy +github.com/containerd/containerd/v2/pkg/reference +github.com/distribution/reference +github.com/containerd/containerd/v2/core/images/archive +github.com/containerd/containerd/v2/core/images/usage +github.com/containerd/containerd/api/services/introspection/v1 +github.com/containerd/containerd/v2/core/introspection +github.com/containerd/containerd/v2/core/introspection/proxy +github.com/containerd/containerd/v2/core/leases +github.com/containerd/containerd/v2/core/leases/proxy +github.com/containerd/containerd/api/services/mounts/v1 +github.com/containerd/containerd/v2/core/mount/proxy +github.com/containerd/containerd/v2/core/transfer +github.com/containerd/containerd/v2/core/remotes +github.com/containerd/containerd/v2/core/remotes/errors +github.com/containerd/containerd/v2/pkg/tracing +github.com/containerd/containerd/v2/version +github.com/containerd/containerd/v2/core/remotes/docker/auth +github.com/moby/locker +github.com/containerd/containerd/v2/core/remotes/docker +github.com/containerd/containerd/api/runtime/sandbox/v1 +github.com/containerd/containerd/v2/core/sandbox +github.com/containerd/containerd/v2/core/sandbox/proxy +github.com/containerd/containerd/v2/core/snapshots/proxy +github.com/containerd/containerd/v2/core/streaming +github.com/containerd/containerd/api/services/streaming/v1 +github.com/containerd/containerd/v2/core/streaming/proxy +github.com/containerd/containerd/api/types/transfer +github.com/containerd/containerd/v2/core/transfer/streaming +github.com/containerd/containerd/v2/core/transfer/proxy +github.com/containerd/containerd/v2/internal/cleanup +github.com/containerd/containerd/v2/internal/kmutex +github.com/opencontainers/image-spec/identity +github.com/containerd/containerd/v2/core/unpack +github.com/containerd/containerd/v2/internal/userns +github.com/containerd/containerd/v2/pkg/archive/tarheader +github.com/containerd/containerd/v2/pkg/archive +github.com/containerd/fifo +github.com/containerd/containerd/v2/pkg/cio +github.com/containerd/containerd/v2/pkg/dialer +github.com/containerd/containerd/v2/pkg/rootfs +github.com/containerd/plugin +github.com/containerd/containerd/v2/plugins +github.com/containerd/containerd/v2/plugins/services +os/signal +github.com/moby/sys/signal +github.com/opencontainers/runtime-spec/specs-go/features +github.com/containerd/containerd/v2/client +github.com/containerd/containerd/api/events +go.etcd.io/bbolt/errors +go.etcd.io/bbolt/internal/common +go.etcd.io/bbolt/internal/freelist +go.etcd.io/bbolt +github.com/containerd/containerd/v2/core/metadata/boltutil +github.com/containerd/containerd/v2/pkg/gc +github.com/containerd/containerd/v2/core/metadata +github.com/pelletier/go-toml/v2/internal/parserbridge +github.com/pelletier/go-toml/v2/unstable +github.com/pelletier/go-toml/v2/internal/tracker +github.com/pelletier/go-toml/v2 +github.com/containerd/containerd/v2/core/remotes/docker/config +github.com/containerd/containerd/v2/pkg/apparmor +github.com/containerd/containerd/v2/internal/fsverity +github.com/containerd/containerd/v2/plugins/content/local +github.com/docker/distribution +github.com/docker/go-units +github.com/gogo/protobuf/proto +github.com/gogo/protobuf/sortkeys +github.com/gogo/protobuf/types +github.com/mitchellh/reflectwalk +github.com/mitchellh/copystructure +github.com/moby/extensions +github.com/moby/extensions/clientpoint +github.com/moby/extensions/extpoints/service/v0 +github.com/moby/extensions/internal/broker +github.com/moby/extensions/sdk/sdkapi +github.com/moby/extensions/internal/extensiondecl +github.com/moby/extensions/sdk/internal/dependencyresolver +github.com/moby/extensions/sdk/sdkapi/protogen +github.com/moby/extensions/serverpoint +github.com/moby/extensions/sdk +github.com/moby/extensions/internal/launcher +github.com/moby/extensions/servicegrpc +github.com/moby/extensions/host +compress/bzip2 +github.com/moby/go-archive/compression +github.com/moby/go-archive/internal/archiveoptions +github.com/moby/go-archive/tarheader +text/scanner +github.com/moby/patternmatcher +github.com/moby/sys/sequential +github.com/moby/go-archive +github.com/moby/sys/mount +github.com/moby/go-archive/internal/mounttree +github.com/moby/go-archive/internal/unshare +github.com/moby/go-archive/chrootarchive +github.com/moby/moby/api/pkg/stdcopy +github.com/moby/moby/api/types/blkiodev +github.com/moby/moby/api/types/checkpoint +github.com/moby/docker-image-spec/specs-go/v1 +github.com/moby/moby/api/types/common +github.com/moby/moby/api/types/mount +github.com/moby/moby/api/types/network +github.com/moby/moby/api/types/storage +github.com/moby/moby/api/types/container +github.com/moby/moby/api/types/events +github.com/moby/moby/api/types/image +github.com/moby/moby/api/types/registry +github.com/moby/moby/api/types/swarm +github.com/moby/moby/api/types/build +github.com/moby/moby/api/types/volume +github.com/moby/moby/api/types/system +github.com/hashicorp/golang-lru/simplelru +github.com/hashicorp/go-immutable-radix +github.com/hashicorp/go-memdb +github.com/moby/moby/v2/pkg/ioutils +hash/crc64 +github.com/vbatts/tar-split/tar/storage +github.com/moby/moby/v2/daemon/graphdriver +github.com/moby/moby/v2/daemon/internal/stringid +github.com/moby/sys/atomicwriter +github.com/vbatts/tar-split/archive/tar +github.com/vbatts/tar-split/tar/asm +github.com/moby/moby/v2/daemon/internal/layer +github.com/moby/moby/v2/errdefs +github.com/opencontainers/go-digest/digestset +github.com/moby/moby/v2/daemon/internal/image +github.com/moby/moby/v2/daemon/internal/libcontainerd/types +github.com/moby/moby/v2/daemon/internal/restartmanager +github.com/moby/moby/v2/daemon/internal/stream/bytespipe +github.com/moby/moby/v2/pkg/pools +github.com/moby/term +github.com/moby/moby/v2/daemon/internal/stream +github.com/moby/moby/v2/daemon/logger/internal/logdriver +github.com/moby/moby/v2/daemon/internal/filters +github.com/moby/moby/v2/daemon/server/backend +github.com/docker/go-connections/sockets +github.com/moby/moby/v2/pkg/homedir +github.com/moby/moby/v2/pkg/plugins/transport +github.com/moby/moby/v2/pkg/plugins +github.com/moby/moby/v2/pkg/plugingetter +golang.org/x/time/rate +github.com/moby/moby/v2/daemon/logger +github.com/moby/moby/v2/daemon/logger/jsonfilelog/jsonlog +github.com/moby/moby/v2/daemon/logger/templates +github.com/moby/moby/v2/daemon/logger/loggerutils +github.com/moby/moby/v2/pkg/tailfile +github.com/moby/moby/v2/daemon/logger/jsonfilelog +github.com/moby/moby/v2/daemon/logger/local +github.com/moby/moby/v2/daemon/logger/loggerutils/cache +github.com/moby/moby/v2/daemon/cluster/provider +github.com/moby/moby/v2/daemon/internal/timestamp +github.com/moby/moby/v2/daemon/network +github.com/moby/moby/v2/daemon/internal/lazyregexp +github.com/moby/moby/v2/daemon/internal/platform +github.com/moby/moby/v2/daemon/pkg/oci/caps +github.com/moby/moby/v2/daemon/pkg/oci +github.com/moby/moby/v2/daemon/volume +github.com/moby/moby/v2/daemon/internal/idtools +github.com/moby/moby/v2/daemon/internal/unix_noeintr +github.com/moby/moby/v2/daemon/volume/safepath +github.com/cyphar/filepath-securejoin/internal/consts +github.com/cyphar/filepath-securejoin/pathrs-lite/internal +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/gocompat +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/fd +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/kernelversion +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/linux +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/assert +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/procfs +github.com/cyphar/filepath-securejoin/pathrs-lite/procfs +github.com/cyphar/filepath-securejoin/pathrs-lite/internal/gopathrs +github.com/cyphar/filepath-securejoin/pathrs-lite +github.com/opencontainers/selinux/pkg/pwalkdir +github.com/opencontainers/selinux/go-selinux +github.com/opencontainers/selinux/go-selinux/label +github.com/moby/moby/v2/daemon/volume/mounts +github.com/docker/go-events +io/ioutil +github.com/gogo/protobuf/protoc-gen-gogo/descriptor +github.com/gogo/protobuf/gogoproto +github.com/moby/swarmkit/v2/api/deepcopy +github.com/moby/swarmkit/v2/manager/raftselector +github.com/moby/swarmkit/v2/protobuf/plugin +google.golang.org/protobuf/internal/editionssupport +google.golang.org/protobuf/types/gofeaturespb +google.golang.org/protobuf/reflect/protodesc +github.com/golang/protobuf/proto +go.etcd.io/raft/v3/raftpb +github.com/moby/swarmkit/v2/api +github.com/moby/swarmkit/v2/api/equality +github.com/moby/swarmkit/v2/log +github.com/moby/swarmkit/v2/protobuf/ptypes +github.com/moby/swarmkit/v2/agent/exec +github.com/moby/sys/symlink +github.com/moby/moby/v2/daemon/container +github.com/moby/moby/v2/daemon/server/buildbackend +github.com/moby/moby/v2/daemon/builder +github.com/moby/buildkit/frontend/dockerfile/command +github.com/moby/buildkit/frontend/dockerfile/shell +github.com/moby/buildkit/frontend/dockerfile/parser +github.com/moby/buildkit/frontend/dockerfile/linter +github.com/agext/levenshtein +github.com/moby/buildkit/util/suggest +encoding/csv +github.com/tonistiigi/go-csvvalue +github.com/moby/buildkit/frontend/dockerfile/instructions +github.com/moby/moby/api/types/jsonstream +github.com/containerd/continuity/driver +github.com/moby/moby/v2/daemon/builder/remotecontext/git +github.com/moby/moby/v2/daemon/builder/remotecontext/internal/tarsum +github.com/moby/moby/v2/daemon/builder/remotecontext/urlutil +github.com/moby/moby/v2/pkg/longpath +github.com/moby/patternmatcher/ignorefile +github.com/moby/moby/v2/daemon/builder/remotecontext +github.com/moby/moby/v2/daemon/libnetwork/internal/uint128 +github.com/moby/moby/v2/daemon/libnetwork/ipbits +github.com/moby/moby/v2/daemon/internal/netiputil +github.com/moby/moby/v2/daemon/internal/progress +github.com/moby/moby/v2/daemon/internal/compat +github.com/moby/moby/v2/daemon/internal/streamformatter +github.com/moby/moby/v2/daemon/internal/system +golang.org/x/sync/syncmap +github.com/moby/moby/v2/daemon/builder/dockerfile +golang.org/x/net/bpf +golang.org/x/net/internal/iana +golang.org/x/net/internal/socket +golang.org/x/net/ipv4 +golang.org/x/net/ipv6 +github.com/miekg/dns +github.com/vishvananda/netns +github.com/vishvananda/netlink/nl +github.com/moby/ipvs +go.opentelemetry.io/otel/log/embedded +go.opentelemetry.io/otel/log +go.opentelemetry.io/otel/log/noop +go.opentelemetry.io/otel/sdk/log/internal/attrnorm +go.opentelemetry.io/otel/sdk/log/internal/counter +go.opentelemetry.io/otel/sdk/log/internal/x +go.opentelemetry.io/otel/sdk/log/internal/observ +go.opentelemetry.io/otel/sdk/log +go.opentelemetry.io/contrib/processors/baggagecopy +github.com/moby/moby/v2/daemon/internal/otelutil +github.com/moby/moby/v2/daemon/libnetwork/cluster +github.com/moby/moby/v2/daemon/internal/rootless +github.com/moby/moby/v2/daemon/libnetwork/kvstore +github.com/ishidawataru/sctp +github.com/moby/moby/v2/daemon/libnetwork/types +github.com/moby/moby/v2/daemon/libnetwork/datastore +github.com/moby/moby/v2/daemon/libnetwork/options +github.com/moby/moby/v2/internal/iterutil +github.com/moby/moby/v2/daemon/libnetwork/driverapi +github.com/moby/moby/v2/daemon/libnetwork/drivers/bridge/internal/firewaller +github.com/moby/moby/v2/daemon/libnetwork/internal/modprobe +github.com/godbus/dbus/v5 +github.com/vishvananda/netlink +github.com/moby/moby/v2/daemon/libnetwork/nlwrap +github.com/moby/moby/v2/daemon/libnetwork/iptables +github.com/moby/moby/v2/daemon/libnetwork/drivers/bridge/internal/iptabler +github.com/moby/moby/v2/daemon/libnetwork/internal/nftables +github.com/moby/moby/v2/daemon/libnetwork/drivers/bridge/internal/nftabler +github.com/moby/moby/v2/daemon/libnetwork/ipamapi +github.com/moby/moby/v2/daemon/libnetwork/portmapperapi +github.com/moby/moby/v2/daemon/libnetwork/drvregistry +github.com/moby/moby/v2/daemon/libnetwork/netlabel +github.com/moby/moby/v2/daemon/libnetwork/internal/resolvconf +internal/sysinfo +testing +github.com/moby/moby/v2/daemon/libnetwork/ns +github.com/moby/moby/v2/daemon/libnetwork/netutils +github.com/moby/moby/v2/daemon/libnetwork/portallocator +github.com/moby/moby/v2/daemon/libnetwork/portmapper +github.com/moby/moby/v2/daemon/libnetwork/scope +github.com/moby/moby/v2/internal/sliceutil +github.com/moby/moby/v2/daemon/libnetwork/drivers/bridge +github.com/moby/moby/v2/daemon/libnetwork/ipamutils +github.com/moby/moby/v2/daemon/internal/unshare +github.com/moby/moby/v2/daemon/libnetwork/internal/l2disco +github.com/moby/moby/v2/daemon/libnetwork/osl/kernel +github.com/moby/moby/v2/daemon/libnetwork/osl +github.com/moby/moby/v2/daemon/libnetwork/config +github.com/moby/moby/v2/daemon/libnetwork/internal/caller +github.com/moby/moby/v2/daemon/libnetwork/diagnostic +github.com/moby/moby/v2/daemon/libnetwork/discoverapi +github.com/moby/moby/v2/daemon/libnetwork/drivers/host +github.com/moby/moby/v2/pkg/parsers/kernel +github.com/moby/moby/v2/daemon/libnetwork/drivers/ipvlan +github.com/moby/moby/v2/daemon/libnetwork/drivers/macvlan +github.com/moby/moby/v2/daemon/libnetwork/drivers/null +github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay/overlayutils +github.com/moby/moby/v2/daemon/libnetwork/internal/countmap +github.com/moby/moby/v2/daemon/libnetwork/internal/hashable +github.com/moby/moby/v2/daemon/libnetwork/internal/setmatrix +github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay +github.com/moby/moby/v2/daemon/libnetwork/drivers/remote/api +github.com/moby/moby/v2/daemon/libnetwork/drivers/remote +github.com/moby/moby/v2/daemon/libnetwork/etchosts +github.com/moby/moby/v2/daemon/libnetwork/internal/maputil +github.com/rootless-containers/rootlesskit/v3/pkg/api +github.com/rootless-containers/rootlesskit/v3/pkg/httputil +github.com/rootless-containers/rootlesskit/v3/pkg/port +github.com/rootless-containers/rootlesskit/v3/pkg/api/client +github.com/moby/moby/v2/daemon/libnetwork/internal/rlkclient +github.com/moby/moby/v2/daemon/libnetwork/bitmap +github.com/moby/moby/v2/daemon/libnetwork/internal/addrset +github.com/moby/moby/v2/daemon/libnetwork/ipams/defaultipam +github.com/moby/moby/v2/daemon/libnetwork/ipams/null +github.com/moby/moby/v2/daemon/libnetwork/ipams/remote/api +github.com/moby/moby/v2/daemon/libnetwork/ipams/remote +github.com/moby/moby/v2/daemon/libnetwork/ipams/windowsipam +github.com/moby/moby/v2/daemon/libnetwork/ipams +github.com/moby/moby/v2/daemon/libnetwork/kvstore/memstore +github.com/hashicorp/golang-lru/v2/internal +github.com/hashicorp/golang-lru/v2/simplelru +github.com/hashicorp/go-immutable-radix/v2 +compress/lzw +github.com/google/btree +github.com/hashicorp/go-metrics +go/scanner +go/ast +go/build/constraint +go/parser +go/doc/comment +go/printer +go/format +encoding/gob +net/rpc +github.com/hashicorp/go-msgpack/v2/codec +github.com/hashicorp/errwrap +github.com/hashicorp/go-multierror +github.com/hashicorp/go-sockaddr +github.com/sean-/seed +github.com/hashicorp/memberlist +github.com/moby/moby/v2/daemon/libnetwork/internal/lamport +github.com/moby/moby/v2/daemon/libnetwork/networkdb +github.com/moby/moby/v2/daemon/libnetwork/portmappers/nat +github.com/moby/moby/v2/daemon/libnetwork/portmappers/routed +github.com/moby/sys/reexec +github.com/moby/moby/v2/daemon/libnetwork +github.com/moby/moby/api/types/plugin +github.com/moby/moby/v2/daemon/initlayer +github.com/moby/moby/v2/daemon/internal/containerfs +github.com/moby/moby/v2/daemon/internal/distribution/utils +github.com/moby/moby/v2/daemon/internal/rootless/mountopts +github.com/moby/moby/v2/daemon/internal/rootless/specconv +github.com/moby/moby/v2/daemon/pkg/plugin/v2 +github.com/docker/distribution/registry/api/errcode +github.com/gorilla/mux +github.com/docker/distribution/registry/api/v2 +github.com/docker/distribution/registry/client/auth/challenge +github.com/docker/distribution/registry/client/transport +github.com/docker/distribution/metrics +github.com/docker/distribution/registry/storage/cache +github.com/docker/distribution/registry/storage/cache/memory +github.com/docker/distribution/registry/client +github.com/docker/distribution/registry/client/auth +net/http/cookiejar +github.com/moby/moby/v2/daemon/pkg/registry +github.com/moby/moby/v2/pkg/useragent +github.com/moby/moby/v2/dockerversion +github.com/moby/moby/v2/pkg/authorization +github.com/moby/pubsub +github.com/moby/moby/v2/daemon/pkg/plugin +github.com/moby/moby/v2/daemon/server/imagebackend +github.com/moby/moby/v2/daemon/volume/service/opts +github.com/moby/moby/v2/daemon/cluster/executor +github.com/moby/moby/v2/daemon/command/debug +dario.cat/mergo +golang.org/x/crypto/internal/alias +golang.org/x/crypto/internal/poly1305 +golang.org/x/crypto/salsa20/salsa +golang.org/x/crypto/nacl/secretbox +crypto/internal/fips140/pbkdf2 +crypto/pbkdf2 +golang.org/x/crypto/pbkdf2 +golang.org/x/crypto/scrypt +github.com/secure-systems-lab/go-securesystemslib/encrypted +github.com/youmark/pkcs8 +golang.org/x/term +github.com/sigstore/sigstore/pkg/cryptoutils +github.com/sigstore/sigstore-go/pkg/fulcio/certificate +github.com/moby/buildkit/cache/remotecache/gha/ghatypes +github.com/moby/buildkit/util/db +github.com/moby/buildkit/util/db/compaction +github.com/moby/buildkit/util/disk +github.com/moby/buildkit/util/resolver/config +github.com/moby/buildkit/cmd/buildkitd/config +github.com/moby/moby/v2/daemon/cluster/convert/netextra +github.com/moby/moby/v2/daemon/cluster/internal/runtime +github.com/moby/moby/v2/daemon/internal/netipstringer +github.com/moby/swarmkit/v2/api/genericresource +github.com/cloudflare/cfssl/errors +github.com/cloudflare/cfssl/log +github.com/cloudflare/cfssl/api +github.com/cloudflare/cfssl/auth +github.com/cloudflare/cfssl/crypto/pkcs7 +github.com/cloudflare/cfssl/helpers/derhelpers +github.com/google/certificate-transparency-go/asn1 +github.com/google/certificate-transparency-go/tls +github.com/google/certificate-transparency-go/x509/pkix +golang.org/x/crypto/cryptobyte/asn1 +golang.org/x/crypto/cryptobyte +golang.org/x/crypto/ed25519 +github.com/google/certificate-transparency-go/x509 +github.com/google/certificate-transparency-go +golang.org/x/crypto/ocsp +golang.org/x/crypto/pkcs12/internal/rc2 +golang.org/x/crypto/pkcs12 +github.com/cloudflare/cfssl/helpers +github.com/cloudflare/cfssl/ocsp/config +github.com/weppos/publicsuffix-go/publicsuffix +github.com/zmap/zcrypto/cryptobyte/asn1 +github.com/zmap/zcrypto/encoding/asn1 +github.com/zmap/zcrypto/cryptobyte +github.com/zmap/zcrypto/internal/randutil +github.com/zmap/zcrypto/dsa +github.com/zmap/zcrypto/json +github.com/zmap/zcrypto/util +github.com/zmap/zcrypto/x509/ct +github.com/zmap/zcrypto/x509/pkix +github.com/zmap/zcrypto/x509 +github.com/pelletier/go-toml +github.com/zmap/zlint/v3/util +github.com/zmap/zlint/v3/lint +github.com/zmap/zlint/v3/lints/apple +github.com/zmap/zlint/v3/lints/cabf_br +github.com/zmap/zlint/v3/lints/cabf_ev +github.com/zmap/zlint/v3/lints/community +github.com/zmap/zlint/v3/lints/etsi +github.com/zmap/zlint/v3/lints/mozilla +github.com/zmap/zlint/v3/lints/rfc +github.com/zmap/zlint/v3 +github.com/cloudflare/cfssl/config +net/mail +github.com/cloudflare/cfssl/csr +database/sql +github.com/jmoiron/sqlx/types +github.com/cloudflare/cfssl/certdb +github.com/cloudflare/cfssl/info +github.com/cloudflare/cfssl/signer +github.com/google/certificate-transparency-go/client/configpb +github.com/google/certificate-transparency-go/jsonclient +github.com/google/certificate-transparency-go/client +github.com/cloudflare/cfssl/signer/local +github.com/cloudflare/cfssl/initca +github.com/moby/swarmkit/v2/ca/pkcs8 +github.com/moby/swarmkit/v2/ca/keyutils +golang.org/x/net/context +github.com/grpc-ecosystem/go-grpc-prometheus +github.com/moby/swarmkit/v2/remotes +github.com/moby/swarmkit/v2/connectionbroker +github.com/moby/swarmkit/v2/identity +github.com/moby/swarmkit/v2/ioutils +github.com/moby/swarmkit/v2/api/naming +github.com/moby/swarmkit/v2/watch/queue +github.com/moby/swarmkit/v2/watch +github.com/moby/swarmkit/v2/manager/state +github.com/moby/swarmkit/v2/manager/state/store +golang.org/x/net/context/ctxhttp +github.com/moby/swarmkit/v2/ca +github.com/moby/swarmkit/v2/node/plugin +github.com/moby/moby/v2/daemon/cluster/convert +github.com/moby/moby/v2/daemon/pkg/opts +github.com/moby/moby/v2/daemon/internal/opts +github.com/moby/moby/v2/daemon/internal/versions +github.com/spf13/pflag +golang.org/x/text/encoding/internal/identifier +golang.org/x/text/encoding +golang.org/x/text/encoding/internal +golang.org/x/text/internal/utf8internal +golang.org/x/text/runes +golang.org/x/text/encoding/unicode +github.com/moby/moby/v2/daemon/config +github.com/containerd/containerd/v2/pkg/snapshotters +github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common +github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2 +github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v1 +github.com/moby/buildkit/util/attestation +github.com/moby/moby/api/types/auxprogress +github.com/moby/moby/v2/daemon/containerd/identitycache +github.com/moby/moby/v2/daemon/internal/metrics +github.com/moby/moby/v2/daemon/events +github.com/docker/distribution/manifest +github.com/docker/distribution/manifest/manifestlist +github.com/docker/distribution/manifest/ocischema +github.com/docker/distribution/manifest/schema2 +github.com/moby/moby/v2/daemon/internal/distribution/metadata +github.com/moby/moby/v2/daemon/internal/distribution/xfer +github.com/moby/moby/v2/daemon/internal/refstore +github.com/tonistiigi/go-archvariant +github.com/moby/moby/v2/daemon/internal/distribution +github.com/moby/moby/v2/daemon/internal/image/cache +github.com/moby/moby/v2/daemon/internal/image/v1 +github.com/moby/moby/v2/daemon/internal/ioutils +github.com/moby/moby/v2/daemon/internal/image/tarexport +github.com/moby/moby/v2/daemon/images +github.com/containerd/accelerated-container-image/pkg/label +github.com/containerd/accelerated-container-image/pkg/types +github.com/containerd/accelerated-container-image/pkg/utils +github.com/containerd/containerd/v2/plugins/diff/walking +github.com/containerd/stargz-snapshotter/estargz/errorutil +github.com/containerd/stargz-snapshotter/estargz +github.com/moby/buildkit/util/archiveutil +github.com/moby/buildkit/util/iohelper +github.com/moby/buildkit/util/compression +github.com/moby/buildkit/cache/config +github.com/moby/buildkit/util/db/boltutil +github.com/moby/buildkit/cache/metadata +github.com/gofrs/flock +github.com/moby/buildkit/solver/pb +github.com/moby/buildkit/api/types +github.com/moby/buildkit/util/gogo/proto +github.com/moby/buildkit/sourcepolicy/pb +github.com/planetscale/vtprotobuf/types/known/timestamppb +github.com/moby/buildkit/api/services/control +github.com/moby/buildkit/client/buildid +github.com/moby/buildkit/client/connhelper +github.com/google/shlex +github.com/in-toto/attestation/go/v1 +github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.1 +github.com/secure-systems-lab/go-securesystemslib/cjson +golang.org/x/crypto/chacha20 +golang.org/x/crypto/curve25519 +golang.org/x/crypto/blowfish +golang.org/x/crypto/ssh/internal/bcrypt_pbkdf +golang.org/x/crypto/ssh +github.com/secure-systems-lab/go-securesystemslib/dsse +github.com/secure-systems-lab/go-securesystemslib/signerverifier +github.com/shibumi/go-pathspec +github.com/in-toto/in-toto-golang/in_toto +github.com/moby/buildkit/source/types +github.com/moby/buildkit/util/bkmaps +github.com/moby/buildkit/util/resolver/limited +github.com/moby/buildkit/util/resolver/retryhandler +github.com/moby/buildkit/version +github.com/moby/buildkit/util/contentutil +github.com/moby/buildkit/util/leaseutil +github.com/moby/buildkit/util/imageutil +github.com/moby/buildkit/client/llb/sourceresolver +github.com/moby/buildkit/util/progress +github.com/moby/buildkit/util/flightcontrol +github.com/moby/buildkit/util/sshutil +github.com/moby/buildkit/util/gitutil +github.com/moby/buildkit/util/system +github.com/moby/buildkit/client/llb +github.com/moby/buildkit/client/ociindex +github.com/moby/buildkit/exporter/exptypes +github.com/planetscale/vtprotobuf/vtproto +github.com/tonistiigi/fsutil/types +github.com/moby/buildkit/frontend/gateway/pb +github.com/moby/buildkit/solver/result +github.com/moby/buildkit/exporter/containerimage/exptypes +github.com/moby/buildkit/frontend/gateway/client +github.com/moby/buildkit/frontend/gateway/grpcclient +github.com/containerd/containerd/v2/plugins/services/content/contentserver +github.com/moby/buildkit/session/content +github.com/tonistiigi/fsutil +github.com/moby/buildkit/session/filesync +github.com/moby/buildkit/session/grpchijack +github.com/moby/buildkit/util/appdefaults +github.com/moby/buildkit/util/tracing/otlptracegrpc +github.com/moby/buildkit/client +github.com/containerd/containerd/v2/plugins/snapshots/overlay/overlayutils +github.com/moby/buildkit/executor/resources/types +github.com/moby/buildkit/util/network +github.com/moby/buildkit/util/openfile +github.com/moby/buildkit/executor +github.com/moby/buildkit/util/pools +github.com/moby/buildkit/util/overlay +github.com/moby/buildkit/util/bkslices +github.com/moby/buildkit/util/rootless/mountopts +github.com/moby/buildkit/snapshot +github.com/moby/buildkit/solver/errdefs +github.com/moby/buildkit/solver/internal/pipe +github.com/moby/buildkit/solver/llbsolver/compat +github.com/moby/buildkit/util/cachedigest +github.com/moby/buildkit/util/cond +github.com/moby/buildkit/util/progress/controller +github.com/moby/buildkit/solver +github.com/containerd/containerd/v2/core/images/converter +github.com/moby/buildkit/util/converter/tarconverter +github.com/moby/buildkit/util/converter +github.com/armon/circbuf +github.com/tonistiigi/units +github.com/moby/buildkit/util/progress/logs +github.com/moby/buildkit/util/pull/pullprogress +github.com/moby/buildkit/util/winlayers +github.com/moby/buildkit/cache +github.com/moby/buildkit/exporter +github.com/moby/moby/v2/daemon/internal/builder-next/exporter/overrides +github.com/moby/moby/v2/daemon/internal/builder-next/exporter +github.com/moby/moby/v2/daemon/internal/multierror +github.com/moby/moby/v2/daemon/internal/mountref +github.com/moby/moby/v2/daemon/snapshotter +github.com/moby/policy-helpers/image +google.golang.org/genproto/googleapis/api +google.golang.org/genproto/googleapis/api/annotations +github.com/sigstore/protobuf-specs/gen/pb-go/common/v1 +github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1 +github.com/sigstore/sigstore-go/pkg/util +github.com/google/go-containerregistry/pkg/name +github.com/sigstore/sigstore/pkg/signature/options +github.com/sigstore/sigstore/pkg/signature/payload +github.com/sigstore/sigstore/pkg/signature +github.com/theupdateframework/go-tuf/v2/metadata +github.com/theupdateframework/go-tuf/v2/metadata/fetcher +github.com/theupdateframework/go-tuf/v2/metadata/config +github.com/theupdateframework/go-tuf/v2/metadata/trustedmetadata +github.com/theupdateframework/go-tuf/v2/metadata/updater +github.com/sigstore/sigstore-go/pkg/tuf +github.com/digitorus/pkcs7 +github.com/digitorus/timestamp +github.com/sigstore/timestamp-authority/v2/pkg/verification +github.com/sigstore/sigstore-go/pkg/root +github.com/moby/policy-helpers/roots +github.com/moby/policy-helpers/roots/dhi +github.com/moby/policy-helpers/types +github.com/sigstore/protobuf-specs/gen/pb-go/dsse +github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1 +github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1 +github.com/sigstore/sigstore-go/internal/certificate +github.com/sigstore/sigstore-go/internal/limits +github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer +encoding/xml +github.com/go-openapi/errors +github.com/go-openapi/strfmt/internal/bsonlite +github.com/go-openapi/strfmt/internal/countries +github.com/go-viper/mapstructure/v2/internal/errors +github.com/go-viper/mapstructure/v2 +github.com/oklog/ulid/v2 +golang.org/x/text/internal/tag +golang.org/x/text/internal/language +golang.org/x/text/internal/language/compact +golang.org/x/text/language +golang.org/x/text/internal/format +golang.org/x/text/internal/stringset +golang.org/x/text/internal/number +golang.org/x/text/currency +github.com/go-openapi/strfmt +github.com/go-openapi/swag/fileutils +github.com/go-openapi/swag/jsonutils/adapters/ifaces +github.com/go-openapi/swag/conv +github.com/go-openapi/swag/pools +github.com/go-openapi/swag/typeutils +github.com/go-openapi/swag/jsonutils/adapters/stdlib/json +github.com/go-openapi/swag/jsonutils/adapters +github.com/go-openapi/swag/jsonutils +github.com/go-openapi/swag/stringutils +github.com/go-openapi/runtime +github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options +github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf +golang.org/x/mod/sumdb/note +github.com/sigstore/rekor-tiles/v2/pkg/note +github.com/sigstore/rekor-tiles/v2/pkg/types/verifier +github.com/sigstore/rekor-tiles/v2/internal/safeint +github.com/transparency-dev/formats/log +github.com/transparency-dev/merkle +github.com/transparency-dev/merkle/compact +github.com/transparency-dev/merkle/proof +github.com/transparency-dev/merkle/rfc6962 +github.com/sigstore/rekor-tiles/v2/pkg/verify +github.com/go-openapi/jsonpointer/jsonname +github.com/go-openapi/swag/cmdutils +go.yaml.in/yaml/v3 +github.com/go-openapi/swag/yamlutils +github.com/go-openapi/swag/loading +github.com/go-openapi/swag/mangling +github.com/go-openapi/swag/netutils +github.com/go-openapi/swag +github.com/go-openapi/analysis/internal/debug +github.com/go-openapi/jsonpointer +github.com/go-openapi/jsonreference/internal +github.com/go-openapi/jsonreference +github.com/go-openapi/spec +github.com/go-openapi/analysis/internal/flatten/normalize +github.com/go-openapi/analysis/internal/flatten/operations +github.com/go-openapi/analysis/internal/flatten/replace +github.com/go-openapi/analysis/internal/flatten/schutils +github.com/go-openapi/analysis/internal/flatten/sortref +github.com/go-openapi/analysis +github.com/go-openapi/loads +github.com/go-openapi/validate +github.com/sigstore/rekor/pkg/generated/models +github.com/blang/semver +github.com/sigstore/rekor/pkg/internal/log +github.com/sigstore/rekor/pkg/pki/identity +github.com/sigstore/rekor/pkg/pki/pkitypes +github.com/sigstore/rekor/pkg/types +github.com/asaskevich/govalidator +github.com/sigstore/rekor/pkg/pki/x509 +github.com/sigstore/rekor/pkg/types/dsse +github.com/sigstore/sigstore/pkg/signature/dsse +github.com/sigstore/rekor/pkg/types/dsse/v0.0.1 +github.com/sigstore/rekor/pkg/types/hashedrekord +github.com/sigstore/rekor/pkg/util +github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1 +github.com/sigstore/rekor/pkg/types/intoto +github.com/sigstore/rekor/pkg/types/intoto/v0.0.2 +github.com/go-openapi/runtime/client/internal/request +github.com/go-openapi/runtime/logger +github.com/go-openapi/runtime/middleware/denco +github.com/go-openapi/runtime/middleware/untyped +github.com/go-openapi/runtime/security +github.com/go-openapi/runtime/server-middleware/docui +github.com/go-openapi/runtime/server-middleware/mediatype +github.com/go-openapi/runtime/server-middleware/negotiate/header +github.com/go-openapi/runtime/server-middleware/negotiate +github.com/go-openapi/runtime/middleware +github.com/go-openapi/runtime/yamlpc +github.com/go-openapi/runtime/client +github.com/sigstore/rekor/pkg/generated/client/entries +github.com/sigstore/rekor/pkg/generated/client/index +github.com/sigstore/rekor/pkg/generated/client/pubkey +github.com/sigstore/rekor/pkg/generated/client/tlog +github.com/sigstore/rekor/pkg/generated/client +github.com/sigstore/rekor/pkg/verify +github.com/sigstore/sigstore-go/pkg/tlog +github.com/google/certificate-transparency-go/gossip/minimal/x509ext +github.com/google/certificate-transparency-go/x509util +k8s.io/klog/v2/internal/severity +k8s.io/klog/v2/internal/buffer +k8s.io/klog/v2/internal/clock +k8s.io/klog/v2/internal/dbg +k8s.io/klog/v2/internal/serialize +k8s.io/klog/v2/internal/sloghandler +k8s.io/klog/v2 +github.com/google/certificate-transparency-go/loglist3 +github.com/google/certificate-transparency-go/ctutil +github.com/sigstore/rekor-tiles/v2/internal/algorithmregistry +github.com/sigstore/rekor-tiles/v2/pkg/verifier/identity +github.com/sigstore/rekor-tiles/v2/pkg/verifier +github.com/sigstore/rekor-tiles/v2/pkg/verifier/certificate +github.com/sigstore/rekor-tiles/v2/pkg/verifier/publickey +github.com/sigstore/rekor-tiles/v2/pkg/types/hashedrekord +github.com/sigstore/sigstore-go/pkg/verify +golang.org/x/mod/semver +github.com/sigstore/sigstore-go/pkg/bundle +golang.org/x/sync/singleflight +github.com/moby/policy-helpers +github.com/moby/moby/v2/daemon/containerd +github.com/moby/moby/v2/daemon/containerd/migration +github.com/moby/moby/v2/daemon/internal/fstype +runtime/cgo +github.com/moby/moby/v2/daemon/graphdriver/btrfs +github.com/moby/moby/v2/daemon/graphdriver/overlayutils +github.com/moby/moby/v2/daemon/internal/directory +github.com/moby/moby/v2/daemon/graphdriver/fuse-overlayfs +github.com/moby/moby/v2/daemon/internal/quota +github.com/moby/moby/v2/daemon/graphdriver/overlay2 +github.com/moby/moby/v2/daemon/graphdriver/copy +github.com/moby/moby/v2/daemon/graphdriver/vfs +github.com/mistifyio/go-zfs/v4 +github.com/moby/moby/v2/daemon/graphdriver/zfs +github.com/moby/moby/v2/daemon/graphdriver/register +github.com/moby/moby/v2/daemon/internal/capabilities +github.com/moby/moby/v2/daemon/internal/cleanups +github.com/moby/moby/v2/extpoints/daemonconfig/v0 +github.com/moby/moby/v2/daemon/internal/extensionconfig +github.com/moby/moby/v2/extpoints/storage/kv/v0 +github.com/moby/moby/v2/daemon/internal/extensionstorage/bbolt +github.com/moby/moby/v2/daemon/internal/filedescriptors +github.com/moby/moby/v2/daemon/internal/libcontainerd/queue +github.com/moby/moby/v2/daemon/internal/libcontainerd/remote +github.com/moby/moby/v2/daemon/internal/libcontainerd +github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options +github.com/containerd/containerd/api/types/runtimeoptions/v1 +github.com/moby/moby/v2/daemon/internal/libcontainerd/shimopts +github.com/moby/moby/v2/daemon/internal/mod +github.com/moby/moby/v2/daemon/internal/mounttree +github.com/containerd/nri/pkg/version +github.com/tetratelabs/wazero/internal/internalapi +github.com/tetratelabs/wazero/api +github.com/knqyf263/go-plugin/wasm +github.com/tetratelabs/wazero/internal/expctxkeys +github.com/tetratelabs/wazero/experimental +github.com/tetratelabs/wazero/sys +github.com/tetratelabs/wazero/experimental/sys +github.com/tetratelabs/wazero/internal/filecache +github.com/tetratelabs/wazero/internal/leb128 +github.com/tetratelabs/wazero/internal/moremath +github.com/tetratelabs/wazero/internal/ieee754 +github.com/tetratelabs/wazero/internal/descriptor +github.com/tetratelabs/wazero/internal/fsapi +golang.org/x/sys/cpu +github.com/tetratelabs/wazero/internal/platform +github.com/tetratelabs/wazero/internal/sock +github.com/tetratelabs/wazero/internal/sysfs +github.com/tetratelabs/wazero/internal/sys +debug/dwarf +github.com/tetratelabs/wazero/internal/wasmruntime +github.com/tetratelabs/wazero/internal/wasmdebug +github.com/tetratelabs/wazero/internal/wasm +github.com/tetratelabs/wazero/internal/engine/interpreter +github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi +github.com/tetratelabs/wazero/internal/engine/wazevo/ssa +github.com/tetratelabs/wazero/internal/engine/wazevo/backend/regalloc +github.com/tetratelabs/wazero/internal/engine/wazevo/backend +github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64 +github.com/tetratelabs/wazero/internal/engine/wazevo/frontend +github.com/tetratelabs/wazero/internal/u32 +github.com/tetratelabs/wazero/internal/u64 +github.com/tetratelabs/wazero/internal/version +github.com/tetratelabs/wazero/internal/engine/wazevo +github.com/tetratelabs/wazero/internal/wasm/binary +github.com/tetratelabs/wazero +github.com/tetratelabs/wazero/internal/wasip1 +github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1 +github.com/containerd/nri/pkg/api +github.com/containerd/nri/pkg/adaptation/builtin +github.com/containerd/nri/pkg/log +github.com/containerd/nri/pkg/net +github.com/containerd/nri/pkg/net/multiplex +github.com/containerd/nri/pkg/plugin +github.com/containerd/nri/plugins/default-validator +github.com/containerd/nri/plugins/default-validator/builtin +github.com/containerd/nri/pkg/adaptation +github.com/moby/moby/v2/daemon/internal/nri +github.com/moby/moby/v2/daemon/internal/plugin/executor/containerd +github.com/moby/moby/v2/daemon/internal/stack +github.com/moby/moby/v2/daemon/internal/stdcopymux +github.com/moby/moby/v2/daemon/internal/usergroup +github.com/moby/moby/v2/daemon/libnetwork/kvstore/boltdb +github.com/moby/moby/v2/daemon/libnetwork/resolvconf +github.com/moby/moby/v2/daemon/links +github.com/aws/aws-sdk-go-v2/internal/rand +github.com/aws/aws-sdk-go-v2/internal/sdk +github.com/aws/aws-sdk-go-v2/internal/sync/singleflight +github.com/aws/smithy-go/context +github.com/aws/smithy-go/internal/sync/singleflight +github.com/aws/smithy-go/logging +github.com/aws/smithy-go/middleware +github.com/aws/smithy-go/document +github.com/aws/smithy-go +github.com/aws/smithy-go/auth +github.com/aws/smithy-go/traits +github.com/aws/smithy-go/eventstream +github.com/aws/smithy-go/metrics +github.com/aws/smithy-go/sync +github.com/aws/smithy-go/time +github.com/aws/smithy-go/tracing +github.com/aws/smithy-go/transport/http/internal/io +github.com/aws/smithy-go/transport/http +github.com/aws/smithy-go/auth/bearer +github.com/aws/smithy-go/ptr +github.com/aws/aws-sdk-go-v2/aws +github.com/aws/smithy-go/rand +github.com/aws/aws-sdk-go-v2/aws/middleware +github.com/aws/aws-sdk-go-v2/aws/transport/http +github.com/aws/aws-sdk-go-v2/config/internal/ini +github.com/aws/aws-sdk-go-v2/credentials +github.com/aws/aws-sdk-go-v2/aws/ratelimit +github.com/aws/aws-sdk-go-v2/internal/context +github.com/aws/aws-sdk-go-v2/internal/timeconv +github.com/aws/aws-sdk-go-v2/aws/retry +github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config +github.com/aws/smithy-go/io +github.com/aws/aws-sdk-go-v2/feature/ec2/imds +github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds +github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client +github.com/aws/aws-sdk-go-v2/credentials/endpointcreds +github.com/aws/aws-sdk-go-v2/internal/shareddefaults +github.com/aws/aws-sdk-go-v2/aws/defaults +github.com/aws/aws-sdk-go-v2/aws/protocol/restjson +github.com/aws/aws-sdk-go-v2/internal/strings +github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4 +github.com/aws/aws-sdk-go-v2/internal/auth +github.com/aws/smithy-go/encoding/httpbinding +github.com/aws/aws-sdk-go-v2/aws/signer/v4 +github.com/aws/aws-sdk-go-v2/internal/auth/smithy +github.com/aws/aws-sdk-go-v2/internal/configsources +github.com/aws/aws-sdk-go-v2/internal/endpoints +github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn +github.com/aws/aws-sdk-go-v2/internal/timeouts +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 +github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints +github.com/aws/aws-sdk-go-v2/service/signin/types +github.com/aws/smithy-go/encoding +github.com/aws/smithy-go/encoding/json +github.com/aws/smithy-go/endpoints +github.com/aws/smithy-go/endpoints/private/bdd +github.com/aws/smithy-go/endpoints/private/rulesfn +github.com/aws/aws-sdk-go-v2/service/signin +github.com/aws/aws-sdk-go-v2/credentials/logincreds +github.com/aws/aws-sdk-go-v2/internal/sdkio +github.com/aws/aws-sdk-go-v2/credentials/processcreds +github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints +github.com/aws/aws-sdk-go-v2/service/sso/types +github.com/aws/aws-sdk-go-v2/service/sso +github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints +github.com/aws/aws-sdk-go-v2/service/ssooidc/types +github.com/aws/aws-sdk-go-v2/service/ssooidc +github.com/aws/aws-sdk-go-v2/credentials/ssocreds +github.com/aws/aws-sdk-go-v2/aws/protocol/query +github.com/aws/aws-sdk-go-v2/aws/protocol/xml +github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto +github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4 +github.com/aws/aws-sdk-go-v2/internal/v4a +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url +github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints +github.com/aws/aws-sdk-go-v2/service/sts/types +github.com/aws/smithy-go/encoding/xml +github.com/aws/aws-sdk-go-v2/service/sts +github.com/aws/aws-sdk-go-v2/credentials/stscreds +github.com/aws/smithy-go/private/requestcompression +github.com/aws/aws-sdk-go-v2/config +github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream +github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/eventstreamapi +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs/internal/endpoints +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs/types +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs +github.com/moby/moby/v2/daemon/logger/awslogs +github.com/philhofer/fwd +github.com/tinylib/msgp/msgp +github.com/fluent/fluent-logger-golang/fluent +github.com/moby/moby/v2/daemon/logger/fluentd +cloud.google.com/go/compute/metadata +cloud.google.com/go/longrunning/autogen/longrunningpb +google.golang.org/genproto/googleapis/api/distribution +google.golang.org/genproto/googleapis/api/label +google.golang.org/genproto/googleapis/api/metric +google.golang.org/genproto/googleapis/api/monitoredres +google.golang.org/genproto/googleapis/logging/type +cloud.google.com/go/logging/apiv2/loggingpb +cloud.google.com/go/logging/internal +cloud.google.com/go/longrunning/internal +google.golang.org/genproto/googleapis/rpc/code +github.com/googleapis/gax-go/v2/apierror/internal/proto +google.golang.org/api/internal/third_party/uritemplates +google.golang.org/api/googleapi +github.com/googleapis/gax-go/v2/apierror +github.com/googleapis/gax-go/v2/callctx +github.com/googleapis/gax-go/v2/internal +github.com/googleapis/gax-go/v2 +github.com/googleapis/gax-go/v2/internallog/internal +github.com/googleapis/gax-go/v2/internallog +github.com/googleapis/gax-go/v2/internallog/grpclog +google.golang.org/api/iterator +github.com/googleapis/gax-go/v2/iterator +cloud.google.com/go/auth/internal +cloud.google.com/go/auth/internal/jwt +cloud.google.com/go/auth +golang.org/x/oauth2/internal +golang.org/x/oauth2 +golang.org/x/oauth2/authhandler +golang.org/x/oauth2/google/internal/impersonate +golang.org/x/oauth2/google/internal/stsexchange +golang.org/x/oauth2/google/externalaccount +golang.org/x/oauth2/google/internal/externalaccountauthorizeduser +golang.org/x/oauth2/jws +golang.org/x/oauth2/jwt +golang.org/x/oauth2/google +cloud.google.com/go/auth/internal/transport/headers +cloud.google.com/go/auth/credentials/internal/impersonate +cloud.google.com/go/auth/credentials/internal/stsexchange +cloud.google.com/go/auth/internal/credsfile +github.com/googleapis/enterprise-certificate-proxy/client/util +github.com/googleapis/enterprise-certificate-proxy/client +cloud.google.com/go/auth/internal/transport/cert +cloud.google.com/go/auth/credentials/internal/externalaccount +cloud.google.com/go/auth/credentials/internal/externalaccountuser +cloud.google.com/go/auth/credentials/internal/gdch +cloud.google.com/go/auth/internal/retry +cloud.google.com/go/auth/internal/trustboundary +cloud.google.com/go/auth/credentials +cloud.google.com/go/auth/oauth2adapt +github.com/google/s2a-go/fallback +github.com/google/s2a-go/internal/proto/common_go_proto +github.com/google/s2a-go/internal/proto/s2a_context_go_proto +github.com/google/s2a-go/internal/proto/s2a_go_proto +github.com/google/s2a-go/internal/authinfo +github.com/google/s2a-go/internal/handshaker/service +golang.org/x/crypto/chacha20poly1305 +github.com/google/s2a-go/internal/record/internal/aeadcrypter +golang.org/x/crypto/hkdf +github.com/google/s2a-go/internal/record/internal/halfconn +github.com/google/s2a-go/internal/proto/v2/common_go_proto +github.com/google/s2a-go/internal/tokenmanager +github.com/google/s2a-go/internal/record +github.com/google/s2a-go/internal/handshaker +github.com/google/s2a-go/internal/proto/v2/s2a_context_go_proto +github.com/google/s2a-go/internal/proto/v2/s2a_go_proto +github.com/google/s2a-go/stream +github.com/google/s2a-go/internal/v2/certverifier +github.com/google/s2a-go/internal/v2/remotesigner +github.com/google/s2a-go/internal/v2/tlsconfigstore +github.com/google/s2a-go/retry +github.com/google/s2a-go/internal/v2 +github.com/google/s2a-go +google.golang.org/api/internal/cert +google.golang.org/api/internal/credentialstype +google.golang.org/api/internal/impersonate +google.golang.org/api/internal +google.golang.org/api/option +google.golang.org/api/option/internaloption +cloud.google.com/go/auth/internal/compute +cloud.google.com/go/auth/internal/transport +cloud.google.com/go/auth/httptransport +cloud.google.com/go/auth/credentials/impersonate +cloud.google.com/go/auth/credentials/idtoken +google.golang.org/grpc/credentials/alts/internal +google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp +google.golang.org/grpc/credentials/alts/internal/authinfo +google.golang.org/grpc/credentials/alts/internal/conn +google.golang.org/grpc/credentials/alts/internal/handshaker +google.golang.org/grpc/credentials/alts/internal/handshaker/service +google.golang.org/grpc/internal/googlecloud +google.golang.org/grpc/credentials/alts +google.golang.org/grpc/credentials/google/internal +google.golang.org/grpc/credentials/oauth +google.golang.org/grpc/internal/xds/clients +google.golang.org/grpc/internal/xds +google.golang.org/grpc/credentials/google +cloud.google.com/go/auth/grpctransport +google.golang.org/grpc/balancer/grpclb/grpc_lb_v1 +google.golang.org/grpc/resolver/manual +google.golang.org/grpc/balancer/grpclb +google.golang.org/api/transport/grpc +google.golang.org/api/googleapi/transport +google.golang.org/api/transport/http +cloud.google.com/go/longrunning/autogen +cloud.google.com/go/longrunning +cloud.google.com/go/logging/apiv2 +google.golang.org/api/support/bundler +cloud.google.com/go/logging +github.com/moby/moby/v2/daemon/logger/gcplogs +hash/adler32 +compress/zlib +github.com/Graylog2/go-gelf/gelf +github.com/moby/moby/v2/daemon/logger/gelf +github.com/coreos/go-systemd/v22/journal +github.com/moby/moby/v2/daemon/logger/journald +github.com/moby/moby/v2/daemon/logger/splunk +github.com/RackSec/srslog +github.com/moby/moby/v2/daemon/logger/syslog +github.com/moby/moby/v2/daemon/names +github.com/moby/moby/v2/daemon/stats +github.com/moby/moby/v2/daemon/volume/drivers +github.com/moby/moby/v2/daemon/volume/local +github.com/moby/moby/v2/daemon/volume/service +github.com/moby/moby/v2/extpoints/internal/namesgenerator +github.com/moby/moby/v2/extpoints/containernamegenerator/v0 +github.com/moby/moby/v2/extpoints/containernamegenerator/v0/protogen +github.com/moby/moby/v2/extpoints/daemonconfig/v0/protogen +github.com/moby/moby/v2/extpoints/servicegrpc/v0 +github.com/moby/moby/v2/extpoints/servicenamegenerator/v0 +github.com/moby/moby/v2/extpoints/servicenamegenerator/v0/protogen +github.com/moby/moby/v2/extpoints/storage/kv/v0/protogen +github.com/moby/moby/v2/internal/namesgenerator/legacy +github.com/moby/moby/v2/pkg/meminfo +github.com/moby/moby/v2/pkg/parsers/operatingsystem +github.com/moby/moby/v2/pkg/process +github.com/coreos/go-systemd/v22/dbus +github.com/containerd/cgroups/v3/cgroup1 +internal/zstd +debug/elf +github.com/cilium/ebpf/internal/platform +github.com/cilium/ebpf/internal +github.com/cilium/ebpf/internal/unix +github.com/cilium/ebpf/internal/linux +github.com/cilium/ebpf/internal/mountinfo +github.com/cilium/ebpf/internal/testutils/testmain +structs +github.com/cilium/ebpf/internal/sys +github.com/cilium/ebpf/asm +hash/maphash +github.com/cilium/ebpf/btf +github.com/cilium/ebpf/internal/kallsyms +github.com/cilium/ebpf/internal/kconfig +github.com/cilium/ebpf/internal/sysenc +github.com/cilium/ebpf/internal/tracefs +github.com/cilium/ebpf +github.com/cilium/ebpf/features +github.com/cilium/ebpf/link +github.com/containerd/cgroups/v3/cgroup2 +github.com/containerd/containerd/v2/pkg/seccomp +github.com/moby/moby/v2/pkg/sysinfo +github.com/moby/profiles/apparmor +github.com/moby/profiles/seccomp +github.com/cyphar/filepath-securejoin +github.com/opencontainers/cgroups/devices/config +github.com/opencontainers/cgroups +resenje.org/singleflight +github.com/fsnotify/fsnotify/internal +github.com/fsnotify/fsnotify +tags.cncf.io/container-device-interface/internal/ociedit +tags.cncf.io/container-device-interface/internal/validation/k8s +tags.cncf.io/container-device-interface/internal/validation +tags.cncf.io/container-device-interface/pkg/parser +tags.cncf.io/container-device-interface/specs-go +tags.cncf.io/container-device-interface/pkg/cdi +github.com/moby/moby/v2/daemon +github.com/moby/buildkit/cache/remotecache/v1/types +github.com/moby/buildkit/frontend +github.com/moby/buildkit/snapshot/containerd +github.com/moby/buildkit/solver/llbsolver/cdidevices +github.com/moby/buildkit/frontend/dockerfile/dfgitutil +github.com/moby/buildkit/solver/llbsolver/provenance/types +github.com/package-url/packageurl-go +github.com/moby/buildkit/util/purl +github.com/moby/buildkit/util/urlutil +github.com/moby/buildkit/solver/llbsolver/provenance +github.com/moby/buildkit/source +github.com/moby/buildkit/worker +github.com/moby/buildkit/cache/remotecache/v1 +github.com/moby/buildkit/util/errutil +github.com/moby/buildkit/cache/remotecache +github.com/Azure/azure-sdk-for-go/sdk/internal/log +github.com/Azure/azure-sdk-for-go/sdk/azcore/log +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/log +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared +github.com/Azure/azure-sdk-for-go/sdk/internal/exported +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported +github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud +github.com/Azure/azure-sdk-for-go/sdk/azcore/tracing +github.com/Azure/azure-sdk-for-go/sdk/azcore/policy +github.com/Azure/azure-sdk-for-go/sdk/internal/poller +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/pollers +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/pollers/async +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/pollers/body +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/pollers/fake +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/pollers/loc +github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/pollers/op +github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming +github.com/Azure/azure-sdk-for-go/sdk/internal/diag +github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo +github.com/Azure/azure-sdk-for-go/sdk/internal/temporal +github.com/Azure/azure-sdk-for-go/sdk/internal/uuid +github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime +github.com/Azure/azure-sdk-for-go/sdk/azcore +github.com/Azure/azure-sdk-for-go/sdk/azcore/to +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/internal/generated +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/bloberror +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/internal/shared +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/internal/exported +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/internal/base +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/sas +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob +github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blockblob +github.com/dimchansky/utfbom +github.com/golang-jwt/jwt/v5 +github.com/tonistiigi/go-actions-cache +github.com/moby/buildkit/cache/remotecache/gha +github.com/moby/buildkit/cache/remotecache/inline +github.com/moby/buildkit/cache/remotecache/local +github.com/moby/buildkit/util/estargz +golang.org/x/crypto/nacl/sign +github.com/moby/buildkit/session/auth +github.com/moby/buildkit/util/resolver +github.com/moby/buildkit/util/push +github.com/moby/buildkit/cache/remotecache/registry +github.com/gohugoio/hashstructure +github.com/moby/buildkit/cache/util +github.com/moby/buildkit/frontend/attestations +github.com/moby/buildkit/frontend/subrequests +github.com/moby/buildkit/frontend/subrequests/convertllb +github.com/moby/buildkit/frontend/subrequests/lint +github.com/moby/buildkit/frontend/subrequests/outline +github.com/moby/buildkit/frontend/subrequests/targets +github.com/moby/buildkit/util/cpuset +github.com/moby/buildkit/util/gitutil/gitobject +github.com/moby/buildkit/frontend/dockerui +github.com/moby/buildkit/session/secrets +github.com/moby/buildkit/session/sshforward +github.com/moby/buildkit/solver/llbsolver/mounts +github.com/moby/buildkit/frontend/gateway/container +github.com/moby/buildkit/solver/llbsolver/errdefs +github.com/moby/buildkit/frontend/gateway/forwarder +github.com/moby/buildkit/frontend/gateway +github.com/moby/buildkit/util/registrar +github.com/moby/buildkit/control/gateway +github.com/moby/buildkit/exporter/util/epoch +github.com/moby/buildkit/frontend/dockerfile/version +github.com/moby/buildkit/solver/bboltcachestorage +github.com/moby/buildkit/executor/resources +github.com/moby/buildkit/exporter/attestation +github.com/anchore/go-struct-converter +github.com/spdx/tools-golang/spdx/common +github.com/spdx/tools-golang/json/marshal +github.com/spdx/tools-golang/spdx/v2/common +github.com/spdx/tools-golang/spdx/v2/v2_1 +github.com/spdx/tools-golang/spdx/v2/v2_2 +github.com/spdx/tools-golang/spdx/v2/v2_3 +github.com/spdx/tools-golang/convert +github.com/spdx/tools-golang/spdx +github.com/spdx/tools-golang/json +github.com/moby/buildkit/exporter/containerimage +github.com/moby/buildkit/exporter/verifier +github.com/moby/buildkit/session/exporter +github.com/moby/buildkit/solver/llbsolver/history +github.com/moby/buildkit/solver/llbsolver/linuxresources +github.com/moby/buildkit/solver/llbsolver/ops/fileoptypes +github.com/tonistiigi/dchapes-mode +github.com/tonistiigi/fsutil/copy +github.com/moby/buildkit/solver/llbsolver/file +github.com/moby/buildkit/cache/contenthash +github.com/moby/buildkit/solver/llbsolver/ops/opsutils +github.com/moby/buildkit/util/archutil +github.com/moby/buildkit/solver/llbsolver/ops +github.com/moby/buildkit/util/wildcard +github.com/moby/buildkit/sourcepolicy +github.com/moby/buildkit/sourcepolicy/policysession +github.com/moby/buildkit/util/entitlements +github.com/moby/buildkit/solver/llbsolver +github.com/moby/buildkit/frontend/attestations/sbom +github.com/moby/buildkit/solver/llbsolver/proc +github.com/moby/buildkit/util/throttle +github.com/moby/buildkit/util/tracing/forwarder +github.com/moby/buildkit/util/tracing/transform +github.com/moby/buildkit/control +github.com/moby/buildkit/util/entitlements/security +github.com/moby/buildkit/util/resolvconf +github.com/moby/buildkit/util/appcontext +github.com/moby/buildkit/util/tracing/childprocess +github.com/moby/buildkit/executor/oci +github.com/containerd/console +github.com/containerd/go-runc +github.com/moby/buildkit/util/rootless/specconv +github.com/moby/buildkit/executor/runcexecutor +github.com/moby/buildkit/client/llb/imagemetaresolver +github.com/moby/buildkit/frontend/dockerfile/dockerfile2llb +github.com/moby/buildkit/frontend/dockerfile/builder +github.com/containernetworking/cni/pkg/types +github.com/containernetworking/cni/pkg/types/internal +github.com/containernetworking/cni/pkg/types/020 +github.com/containernetworking/cni/pkg/types/040 +github.com/containernetworking/cni/pkg/types/100 +github.com/containernetworking/cni/pkg/types/create +github.com/containernetworking/cni/pkg/version +github.com/containernetworking/cni/pkg/invoke +github.com/containernetworking/cni/pkg/utils +github.com/containernetworking/cni/libcni +github.com/containerd/go-cni +github.com/containernetworking/plugins/pkg/ns +github.com/moby/buildkit/util/network/netpool +github.com/moby/buildkit/util/network/cniprovider +github.com/moby/buildkit/util/network/proxyprovider +github.com/moby/buildkit/util/network/netproviders +github.com/moby/buildkit/executor/containerdexecutor +github.com/moby/buildkit/util/staticfs +github.com/moby/buildkit/exporter/local +github.com/moby/buildkit/exporter/oci +github.com/moby/buildkit/exporter/tar +github.com/moby/buildkit/snapshot/imagerefchecker +github.com/moby/buildkit/source/containerblob/blobfetch +github.com/moby/buildkit/source/util/pathutil +github.com/moby/buildkit/source/containerblob +github.com/moby/buildkit/util/pull +github.com/moby/buildkit/source/containerimage +github.com/ProtonMail/go-crypto/openpgp/aes/keywrap +github.com/ProtonMail/go-crypto/internal/byteutil +github.com/ProtonMail/go-crypto/eax +github.com/ProtonMail/go-crypto/ocb +golang.org/x/crypto/cast5 +github.com/ProtonMail/go-crypto/openpgp/internal/algorithm +github.com/ProtonMail/go-crypto/bitcurves +github.com/ProtonMail/go-crypto/brainpool +github.com/ProtonMail/go-crypto/openpgp/errors +github.com/ProtonMail/go-crypto/openpgp/internal/encoding +github.com/cloudflare/circl/internal/conv +github.com/cloudflare/circl/math/fp25519 +github.com/cloudflare/circl/dh/x25519 +github.com/cloudflare/circl/math/fp448 +github.com/cloudflare/circl/dh/x448 +github.com/cloudflare/circl/math +github.com/cloudflare/circl/sign +github.com/cloudflare/circl/sign/ed25519 +github.com/cloudflare/circl/math/mlsbset +github.com/cloudflare/circl/ecc/goldilocks +github.com/cloudflare/circl/internal/sha3 +github.com/cloudflare/circl/sign/ed448 +github.com/ProtonMail/go-crypto/openpgp/internal/ecc +github.com/ProtonMail/go-crypto/openpgp/ecdh +github.com/ProtonMail/go-crypto/openpgp/ecdsa +github.com/ProtonMail/go-crypto/openpgp/ed25519 +github.com/ProtonMail/go-crypto/openpgp/ed448 +github.com/ProtonMail/go-crypto/openpgp/eddsa +github.com/ProtonMail/go-crypto/openpgp/elgamal +golang.org/x/crypto/blake2b +golang.org/x/crypto/argon2 +github.com/ProtonMail/go-crypto/openpgp/s2k +github.com/ProtonMail/go-crypto/openpgp/x25519 +github.com/ProtonMail/go-crypto/openpgp/x448 +image/color +image +image/internal/imageutil +image/jpeg +github.com/ProtonMail/go-crypto/openpgp/packet +github.com/hiddeco/sshsig +github.com/ProtonMail/go-crypto/openpgp/armor +golang.org/x/crypto/sha3 +github.com/ProtonMail/go-crypto/openpgp +github.com/moby/buildkit/util/pgpsign +github.com/moby/buildkit/util/gitutil/gitsign +github.com/moby/buildkit/source/git +github.com/moby/buildkit/session/upload +github.com/moby/buildkit/source/http +github.com/moby/buildkit/source/local +github.com/moby/buildkit/worker/base +github.com/moby/buildkit/worker/label +github.com/moby/buildkit/worker/containerd +github.com/moby/moby/v2/daemon/internal/builder-next/adapters/containerimage +github.com/moby/moby/v2/daemon/internal/builder-next/adapters/localinlinecache +github.com/moby/moby/v2/daemon/internal/builder-next/adapters/snapshot +github.com/moby/moby/v2/daemon/internal/builder-next/exporter/mobyexporter +github.com/moby/moby/v2/daemon/internal/builder-next/imagerefchecker +github.com/moby/moby/v2/daemon/internal/builder-next/worker +github.com/moby/moby/v2/daemon/internal/builder-next/worker/label +github.com/moby/moby/v2/daemon/internal/builder-next +github.com/moby/moby/v2/daemon/builder/backend +github.com/moby/moby/api/pkg/authconfig +github.com/moby/moby/v2/daemon/cluster/controllers/plugin +github.com/moby/swarmkit/v2/agent/configs +github.com/container-storage-interface/spec/lib/go/csi +github.com/moby/swarmkit/v2/internal/csi/capability +github.com/moby/swarmkit/v2/agent/csi/plugin +github.com/moby/swarmkit/v2/volumequeue +github.com/moby/swarmkit/v2/agent/csi +github.com/moby/swarmkit/v2/agent/secrets +github.com/moby/swarmkit/v2/agent +github.com/moby/swarmkit/v2/template +github.com/moby/moby/v2/daemon/cluster/executor/container +github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay/ovmanager +github.com/moby/swarmkit/v2/manager/allocator/networkallocator +github.com/moby/moby/v2/daemon/libnetwork/cnmallocator +github.com/moby/moby/v2/daemon/server/swarmbackend +github.com/moby/moby/v2/daemon/server/volumebackend +github.com/fernet/fernet-go +github.com/moby/swarmkit/v2/manager/encryption +code.cloudfoundry.org/clock +github.com/bits-and-blooms/bitset +github.com/moby/swarmkit/v2/internal/idm +github.com/stretchr/testify/assert/yaml +github.com/stretchr/testify/internal/difflib +github.com/stretchr/testify/internal/spew +internal/gate +internal/nettest +net/http/internal/testcert +net/http/httptest +github.com/stretchr/testify/assert +github.com/stretchr/testify/require +github.com/stretchr/testify/suite +github.com/moby/swarmkit/v2/manager/allocator +github.com/moby/swarmkit/v2/api/defaults +github.com/moby/swarmkit/v2/api/validation +github.com/moby/swarmkit/v2/manager/constraint +github.com/moby/swarmkit/v2/manager/drivers +github.com/moby/swarmkit/v2/manager/orchestrator +github.com/moby/swarmkit/v2/manager/state/raft/membership +go.etcd.io/etcd/client/pkg/v3/verify +go.uber.org/multierr +go.uber.org/zap/internal/pool +go.uber.org/zap/buffer +go.uber.org/zap/internal/bufferpool +go.uber.org/zap/internal/color +go.uber.org/zap/internal/exit +go.uber.org/zap/zapcore +go.uber.org/zap/internal +go.uber.org/zap/internal/stacktrace +go.uber.org/zap +go.etcd.io/etcd/client/pkg/v3/fileutil +github.com/dustin/go-humanize +go.etcd.io/etcd/pkg/v3/ioutil +go.etcd.io/etcd/pkg/v3/pbutil +go.etcd.io/etcd/server/v3/etcdserver/api/snap/snappb +go.etcd.io/etcd/server/v3/storage/wal/walpb +go.etcd.io/raft/v3/quorum +go.etcd.io/raft/v3/tracker +go.etcd.io/raft/v3/confchange +go.etcd.io/raft/v3 +go.etcd.io/etcd/server/v3/etcdserver/api/snap +github.com/coreos/go-semver/semver +go.etcd.io/etcd/api/v3/authpb +go.etcd.io/etcd/api/v3/versionpb +go.etcd.io/etcd/api/v3/membershippb +go.etcd.io/etcd/api/v3/mvccpb +go.etcd.io/etcd/api/v3/etcdserverpb +go.etcd.io/etcd/api/v3/version +go.etcd.io/etcd/pkg/v3/crc +go.etcd.io/etcd/server/v3/storage/wal +github.com/moby/swarmkit/v2/manager/state/raft/storage +github.com/moby/swarmkit/v2/manager/state/raft/transport +go.etcd.io/etcd/pkg/v3/idutil +github.com/moby/swarmkit/v2/manager/state/raft +github.com/moby/swarmkit/v2/manager/controlapi +github.com/moby/swarmkit/v2/manager/csi +github.com/moby/swarmkit/v2/manager/dispatcher/heartbeat +github.com/moby/swarmkit/v2/manager/dispatcher +github.com/moby/swarmkit/v2/manager/health +github.com/moby/swarmkit/v2/manager/keymanager +github.com/moby/swarmkit/v2/manager/logbroker +github.com/moby/swarmkit/v2/manager/metrics +github.com/moby/swarmkit/v2/manager/orchestrator/constraintenforcer +github.com/moby/swarmkit/v2/manager/orchestrator/restart +github.com/moby/swarmkit/v2/manager/orchestrator/taskinit +github.com/moby/swarmkit/v2/manager/orchestrator/update +github.com/moby/swarmkit/v2/manager/orchestrator/global +github.com/moby/swarmkit/v2/manager/orchestrator/jobs/global +github.com/moby/swarmkit/v2/manager/orchestrator/jobs/replicated +github.com/moby/swarmkit/v2/manager/orchestrator/jobs +github.com/moby/swarmkit/v2/manager/orchestrator/replicated +github.com/moby/swarmkit/v2/manager/orchestrator/taskreaper +github.com/moby/swarmkit/v2/manager/orchestrator/volumeenforcer +github.com/moby/swarmkit/v2/manager/resourceapi +container/heap +github.com/moby/swarmkit/v2/manager/scheduler +github.com/moby/swarmkit/v2/manager/watchapi +github.com/moby/swarmkit/v2/xnet +github.com/moby/swarmkit/v2/manager +github.com/moby/swarmkit/v2/node +github.com/moby/moby/v2/daemon/cluster +github.com/moby/moby/v2/daemon/command/trap +github.com/containerd/containerd/v2/pkg/timeout +github.com/containerd/containerd/v2/core/metrics +github.com/containerd/containerd/v2/core/metrics/cgroups/common +github.com/containerd/containerd/v2/core/metrics/types/v1 +github.com/containerd/containerd/v2/core/runtime +github.com/containerd/containerd/v2/core/metrics/cgroups/v1 +github.com/containerd/containerd/v2/core/metrics/types/v2 +github.com/containerd/containerd/v2/core/metrics/cgroups/v2 +github.com/containerd/plugin/registry +github.com/containerd/containerd/v2/core/metrics/cgroups +github.com/containerd/containerd/api/runtime/bootstrap/v1 +github.com/containerd/containerd/api/runtime/task/v2 +github.com/containerd/containerd/api/runtime/task/v3 +github.com/containerd/containerd/v2/core/events/exchange +github.com/containerd/containerd/v2/pkg/atomicfile +github.com/containerd/containerd/v2/pkg/deprecation +github.com/containerd/containerd/api/services/ttrpc/events/v1 +github.com/containerd/containerd/v2/pkg/shutdown +github.com/containerd/containerd/v2/pkg/sys/reaper +github.com/containerd/containerd/v2/pkg/ttrpcutil +github.com/mdlayher/socket +github.com/mdlayher/vsock +github.com/containerd/containerd/v2/pkg/shim +github.com/containerd/containerd/v2/plugins/services/warning +go.opentelemetry.io/otel/semconv/v1.17.0 +github.com/containerd/otelttrpc/internal +github.com/containerd/otelttrpc +github.com/containerd/containerd/v2/core/runtime/v2 +github.com/containerd/containerd/v2/plugins/content/local/plugin +github.com/containerd/containerd/v2/core/diff/apply +github.com/containerd/containerd/v2/plugins/diff/walking/plugin +github.com/containerd/containerd/v2/plugins/events +github.com/containerd/containerd/v2/internal/tomlext +github.com/containerd/containerd/v2/plugins/gc +github.com/containerd/containerd/v2/plugins/leases +github.com/containerd/containerd/v2/plugins/metadata +github.com/containerd/containerd/v2/core/mount/manager +github.com/containerd/containerd/v2/plugins/mount +github.com/containerd/containerd/v2/plugins/services/containers +github.com/containerd/containerd/v2/plugins/services/content +github.com/containerd/containerd/v2/plugins/services/diff +github.com/containerd/containerd/v2/plugins/services/events +github.com/containerd/containerd/v2/plugins/services/healthcheck +github.com/containerd/containerd/v2/plugins/services/images +github.com/containerd/containerd/v2/plugins/services/introspection +github.com/containerd/containerd/v2/plugins/services/leases +github.com/containerd/containerd/v2/plugins/services/namespaces +github.com/containerd/containerd/v2/plugins/services/snapshots +github.com/intel/goresctrl/pkg/kubernetes +github.com/intel/goresctrl/pkg/path +gopkg.in/inf.v0 +github.com/x448/float16 +github.com/fxamacker/cbor/v2 +sigs.k8s.io/json/internal/golang/encoding/json +sigs.k8s.io/json +k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes +k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct +k8s.io/apimachinery/pkg/api/resource +go.yaml.in/yaml/v2 +sigs.k8s.io/yaml +github.com/intel/goresctrl/pkg/blockio +github.com/containerd/containerd/v2/pkg/blockio +github.com/intel/goresctrl/pkg/utils +github.com/intel/goresctrl/pkg/rdt +github.com/containerd/containerd/v2/pkg/rdt +github.com/containerd/containerd/v2/plugins/services/tasks +github.com/containerd/containerd/v2/plugins/services/version +github.com/containerd/containerd/v2/core/snapshots/storage +github.com/containerd/containerd/v2/plugins/snapshots/native +github.com/containerd/containerd/v2/plugins/snapshots/native/plugin +github.com/containerd/containerd/v2/plugins/snapshots/overlay +github.com/containerd/containerd/v2/plugins/snapshots/overlay/plugin +github.com/moby/moby/v2/daemon/internal/containerd/server/embedded +github.com/containerd/containerd/v2/cmd/containerd/server/config +github.com/moby/moby/v2/pkg/pidfile +github.com/moby/moby/v2/daemon/internal/containerd/server/supervisor +github.com/coreos/go-systemd/v22/activation +github.com/moby/moby/v2/daemon/listeners +github.com/moby/moby/v2/daemon/server/httpstatus +github.com/moby/moby/api/types +github.com/moby/moby/v2/daemon/server/httputils +github.com/moby/moby/v2/daemon/server/middleware +github.com/moby/moby/v2/daemon/server/router +github.com/moby/moby/v2/daemon/server +github.com/moby/moby/v2/daemon/server/router/build +github.com/moby/moby/v2/daemon/server/router/checkpoint +github.com/moby/moby/v2/daemon/internal/runconfig +github.com/moby/moby/v2/daemon/server/httputils/internal/httputil/header +github.com/moby/moby/v2/daemon/server/httputils/internal/httputil +github.com/moby/moby/v2/daemon/server/httputils/contentencoding +github.com/moby/moby/v2/daemon/server/httputils/contenttype +github.com/moby/moby/v2/daemon/server/httputils/logstream +golang.org/x/net/websocket +github.com/moby/moby/v2/daemon/server/router/container +internal/profile +net/http/pprof +github.com/moby/moby/v2/daemon/server/router/debug +github.com/moby/moby/v2/daemon/server/router/distribution +github.com/moby/moby/v2/daemon/server/router/grpc +github.com/moby/moby/v2/daemon/server/router/image +github.com/moby/moby/v2/daemon/server/networkbackend +github.com/moby/moby/v2/daemon/server/router/network +github.com/moby/moby/v2/daemon/server/router/plugin +github.com/moby/moby/v2/daemon/server/router/session +github.com/moby/moby/v2/daemon/server/router/swarm +github.com/moby/moby/v2/daemon/server/router/system +github.com/moby/moby/v2/daemon/server/router/volume +github.com/spf13/cobra +github.com/moby/moby/v2/daemon/command +github.com/moby/moby/v2/cmd/dockerd From 49f2ff40676b9db0b2f9d158689f5f00a424c31b Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:33:54 +0800 Subject: [PATCH 07/10] ci: pin upstream license bytes before checkout conversion --- scripts/install-dapper-container-tools | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/install-dapper-container-tools b/scripts/install-dapper-container-tools index 69d26ce7..8f56d80c 100644 --- a/scripts/install-dapper-container-tools +++ b/scripts/install-dapper-container-tools @@ -14,11 +14,11 @@ fetch() { printf '%s %s\n' "$3" "$2" | sha256sum -c - } fetch https://raw.githubusercontent.com/moby/moby/0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c/LICENSE \ - "$proof/docker-LICENSE" 3f0cfdfd5c7ab8cfc8169a57384e297e60f4fe4e8d1060ec4c21c11435d89564 + "$proof/docker-LICENSE" 7c87873291f289713ac5df48b1f2010eb6963752bbd6b530416ab99fc37914a8 fetch https://raw.githubusercontent.com/moby/moby/0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c/NOTICE \ - "$proof/moby-NOTICE" 4bb4a5457d22fe492c9fdc6d97fd03047380f36e83c3afb6f3730cccb6d8d0c9 + "$proof/moby-NOTICE" a249c4197359eee43031d16cecb172326f92ee7b6701af99dfe5c3e5b3d5eca9 fetch https://raw.githubusercontent.com/docker/cli/a82e528901260c8df6073311379eac65f92db204/NOTICE \ - "$proof/docker-cli-NOTICE" a6dc343629353d41f43fa5398e05594b47eca9b404c0ebb839610a50910fd230 + "$proof/docker-cli-NOTICE" a8c869fbda819afb8d80e0ac19bac52e766bc6c19cb38cf94f52d64c4be2aab6 fetch https://download.docker.com/linux/static/stable/x86_64/docker-29.9.2.tgz \ "$work/docker.tgz" 9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb tar -xzf "$work/docker.tgz" -C "$work" docker/docker docker/dockerd docker/docker-proxy docker/docker-init From a3b85cb23b65b377d66fab2e0d2488639c09a865 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:38:41 +0800 Subject: [PATCH 08/10] build: align runc xsys with pinned xnet dependency floor --- scripts/install-dapper-container-tools | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/install-dapper-container-tools b/scripts/install-dapper-container-tools index 8f56d80c..a632a1cc 100644 --- a/scripts/install-dapper-container-tools +++ b/scripts/install-dapper-container-tools @@ -64,7 +64,7 @@ tar -xzf "$work/runc.tgz" --strip-components=1 -C "$work/runc" ( cd "$work/runc" go get github.com/cilium/ebpf@v0.22.0 github.com/moby/sys/user@v0.4.1 \ - golang.org/x/net@v0.60.0 golang.org/x/sys@v0.46.0 + golang.org/x/net@v0.60.0 golang.org/x/sys@v0.48.0 go mod download CGO_ENABLED=1 go list -tags 'seccomp urfave_cli_no_docs' -deps . > "$proof/runc-package-graph.txt" go mod verify From 4cb14ef8774cc1d7e8da96f96fc5230d11996bfb Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:44:20 +0800 Subject: [PATCH 09/10] build: use released cgroups API compatible with patched ebpf --- scripts/install-dapper-container-tools | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/install-dapper-container-tools b/scripts/install-dapper-container-tools index a632a1cc..95c1f329 100644 --- a/scripts/install-dapper-container-tools +++ b/scripts/install-dapper-container-tools @@ -64,6 +64,7 @@ tar -xzf "$work/runc.tgz" --strip-components=1 -C "$work/runc" ( cd "$work/runc" go get github.com/cilium/ebpf@v0.22.0 github.com/moby/sys/user@v0.4.1 \ + github.com/opencontainers/cgroups@v0.1.0 \ golang.org/x/net@v0.60.0 golang.org/x/sys@v0.48.0 go mod download CGO_ENABLED=1 go list -tags 'seccomp urfave_cli_no_docs' -deps . > "$proof/runc-package-graph.txt" From 0aadd6f79890c994da2c047214a2a224471f9191 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sat, 24 Oct 2026 00:08:34 +0800 Subject: [PATCH 10/10] fix: retain containerd PGP with released maintained imgcrypt --- README.md | 5 ++++- scripts/install-dapper-container-tools | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index f62ceb90..3a60a4a9 100644 --- a/README.md +++ b/README.md @@ -84,7 +84,10 @@ The disposable builder uses official Docker 29.9.2 CLI/daemon bytes, with its supported Go 1.26.10 compiler, rather than Ubuntu's outdated embedded Go tools. Containerd stays on the 2.2 compatibility branch at 2.2.10 and runc stays on 1.4 at 1.4.3; both are rebuilt from SHA-pinned released sources using Go 1.27.3 and -released security-fixed dependencies. Runc retains seccomp. Containerd's build +released security-fixed dependencies. Runc retains seccomp. Containerd +uses released imgcrypt 2.0.3 / ocicrypt 1.3.2 to retain encrypted-image PGP +support through the maintained ProtonMail implementation; CI tests that wrapper +and requires the deprecated x/crypto OpenPGP package to be absent. omits the unused Btrfs snapshotter; the actual test daemon uses overlay2/vfs. These are builder-only changes, not a host Docker upgrade or a new deployment recipe. CI exercises the real inner daemon and package-image build, independently diff --git a/scripts/install-dapper-container-tools b/scripts/install-dapper-container-tools index 95c1f329..78b69455 100644 --- a/scripts/install-dapper-container-tools +++ b/scripts/install-dapper-container-tools @@ -36,6 +36,7 @@ tar -xzf "$work/runc.tgz" --strip-components=1 -C "$work/runc" ( cd "$work/containerd" go get github.com/cilium/ebpf@v0.22.0 github.com/klauspost/compress@v1.18.7 \ + github.com/containerd/imgcrypt/v2@v2.0.3 \ github.com/moby/sys/user@v0.4.1 golang.org/x/net@v0.60.0 \ golang.org/x/crypto@v0.57.0 golang.org/x/mod@v0.41.0 golang.org/x/text@v0.42.0 \ google.golang.org/grpc@v1.83.2 \ @@ -49,6 +50,9 @@ tar -xzf "$work/runc.tgz" --strip-components=1 -C "$work/runc" for tool in containerd ctr containerd-shim-runc-v2; do go list -tags "$tags" -deps "./cmd/$tool" > "$proof/$tool-package-graph.txt" done + # Keep encrypted-image PGP support through the maintained implementation. + grep -Fxq 'github.com/ProtonMail/go-crypto/openpgp' "$proof/containerd-package-graph.txt" + go test github.com/containers/ocicrypt/keywrap/pgp go mod verify export GOPROXY=off GOSUMDB=off for tool in containerd ctr containerd-shim-runc-v2; do