From ab244187f647ca418c0ce787c14204964c73c65a Mon Sep 17 00:00:00 2001 From: maksimtech <268127343+maksimtech@users.noreply.github.com> Date: Thu, 15 Oct 2026 14:28:04 +0200 Subject: [PATCH] docs(security): the settled exceptions that stay say why The gate lists these entries as settled: their alerts are closed because the scanners stopped reporting them, not because anything left the image. `patchradar debian` on 2026-10-15 still reports gcc-14 no-dsa in trixie at 14.2.0-19 (fix only in sid, 14.4.0-3), so the flaws are still present and only the reporting changed. The entries stay, and each now records when the scanner fell silent and what Debian said, in the words the CVE-2026-82560 entry already uses. Deleting a flaw that is demonstrably present because a scanner fell silent is the one direction the file must not drift in. Checked, not inferred: a script read this repository's live open and closed code-scanning alerts and listed every kept settled entry that did not say why (4 before, 0 after), and tools/security_exceptions.py on the same alerts still exits 1, only for CodeQL #60, which #50 fixes. Co-Authored-By: Claude Opus 5.5 (1M context) --- CHANGELOG.md | 9 +++++++++ SECURITY-EXCEPTIONS.toml | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ee462f3..964aba7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -96,6 +96,15 @@ what has already shipped, and for nothing else. See `RELEASING.md`. ### Changed +- **`SECURITY-EXCEPTIONS.toml`: the settled entries that stay now say why.** Docker Scout and Snyk + stopped reporting the gcc-14 advisories (CVE-2026-102010 and CVE-2026-95619, and their Snyk ids) + on 2026-10-07 and 2026-10-08, so the gate lists them as settled. `patchradar debian` on 2026-10-15 + still reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid, so the package is + still unfixed and only the reporting changed. The entries are kept, and each now records when the + scanner fell silent and what Debian said, as this file's CVE-2026-82560 entry already did. + Deleting a flaw that is demonstrably present because a scanner fell silent is the one direction + the file must not drift in. + - **The NIS2 document describes the branch rules as they are since 2026-10-12.** The ruleset on main lost the owner's bypass and requires a pull request for every change, the version bump included; the document said the maintainer could bypass the rules, that no rule required a pull request and that release commits went straight to main. A test holds the new diff --git a/SECURITY-EXCEPTIONS.toml b/SECURITY-EXCEPTIONS.toml index 65209f3..d47d430 100644 --- a/SECURITY-EXCEPTIONS.toml +++ b/SECURITY-EXCEPTIONS.toml @@ -200,6 +200,14 @@ why = """ CVE-2026-102010. Open in trixie for both gcc-12 (12.4.0-5) and gcc-14 (14.2.0-19), with no fixed version in any suite and no Debian bug recorded — checked with `patchradar debian CVE-2026-102010`, which is this repository's own command and the reason the distinction between "no fix" and "nobody asked" is available at all. So there is nothing to wait for and nothing to ask for: what moves a flaw in this state is evidence on the tracker page, https://security-tracker.debian.org/tracker/CVE-2026-102010. Nor is it removable. Snyk names the source package `gcc-14`, and what is installed is `libstdc++6`, the C++ runtime a long list of packages in the base image link against — unlike the full `perl`, which was removable and was removed. + +Since 2026-10-07T20:10:21Z Snyk Container has stopped reporting it, which is why \ +the gate lists this entry as settled. It is kept, and the reason is not how long \ +the silence has lasted: `patchradar debian CVE-2026-102010` on 2026-10-15 still \ +reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \ +(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \ +reporting changed. Deleting a flaw that is demonstrably present because a \ +scanner fell silent is the one direction this file must not drift in. """ review_by = "2026-12-31" @@ -238,6 +246,14 @@ https://security-tracker.debian.org/tracker/CVE-2026-102010. Two entries for one flaw is not duplication: the gate matches by id, and an id \ with no entry fails the build whichever scanner emitted it. zlib has been in the \ same position since September. + +Since 2026-10-07T20:11:08Z Docker Scout has stopped reporting it, which is why \ +the gate lists this entry as settled. It is kept, and the reason is not how long \ +the silence has lasted: `patchradar debian CVE-2026-102010` on 2026-10-15 still \ +reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \ +(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \ +reporting changed. Deleting a flaw that is demonstrably present because a \ +scanner fell silent is the one direction this file must not drift in. """ review_by = "2026-12-31" @@ -258,6 +274,14 @@ compiler and `libstdc++6`. Which of them is installed had been asserted and neve measured, so `tests/docker/inspect.sh` now prints the gcc and libstdc++ packages \ and the next `docker-build-check` run answers it — a flaw in cc1 needs something \ to compile, and nothing in this image compiles anything. + +Since 2026-10-08T15:15:52Z Snyk Container has stopped reporting it, which is why \ +the gate lists this entry as settled. It is kept, and the reason is not how long \ +the silence has lasted: `patchradar debian CVE-2026-95619` on 2026-10-15 still \ +reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \ +(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \ +reporting changed. Deleting a flaw that is demonstrably present because a \ +scanner fell silent is the one direction this file must not drift in. """ review_by = "2026-12-31" @@ -269,5 +293,13 @@ why = """ The same flaw as SNYK-DEBIAN13-GCC14-20386241 above, under the other scanner's \ id. The gate matches by id, so one flaw needs an entry per scanner — zlib and \ CVE-2026-102010 are in the same position. + +Since 2026-10-08T15:15:00Z Docker Scout has stopped reporting it, which is why \ +the gate lists this entry as settled. It is kept, and the reason is not how long \ +the silence has lasted: `patchradar debian CVE-2026-95619` on 2026-10-15 still \ +reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \ +(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \ +reporting changed. Deleting a flaw that is demonstrably present because a \ +scanner fell silent is the one direction this file must not drift in. """ review_by = "2026-12-31"