diff --git a/products/relay-v2/security/advisory-baseline.json b/products/relay-v2/security/advisory-baseline.json index 72040e3ef..8955a118d 100644 --- a/products/relay-v2/security/advisory-baseline.json +++ b/products/relay-v2/security/advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:c36dc82eab1250c2e3fc430589b275d8f66d8e5c0a18fd030873a8cac6a81982", + "sha256:7c3e77123161022070b0103e51ce23da1e5e524b77279f4a40bf05867b8c41e2", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2" + "definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2" }, "policies": [ { @@ -75,7 +75,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Relay candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } }, { @@ -133,7 +133,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } }, { @@ -191,7 +191,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Relay candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Relay candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -209,14 +209,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } }, { @@ -249,7 +249,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -267,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } } ] diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index 8e783b267..49b442d32 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -25,12 +25,12 @@ ROOT / "release/security/mint-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "relay": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "discovery": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "evidence": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "mint": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "relay": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "discovery": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "evidence": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "mint": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", } -LIVE_REFERENCE_SOURCE_REVISION = "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92" +LIVE_REFERENCE_SOURCE_REVISION = "130136a2b20ad10d359849ac111316a2fb1cb39e" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json index ed9e6929e..6ead82379 100644 --- a/release/security/discovery-advisory-baseline.json +++ b/release/security/discovery-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:9c34752fe979137e4188319f1dc04e4715dade650f03f355b73fec697ee393ad" + "sha256:7ae58ef941e4bb6dee936093650adbc8fca3c4e6fe338b1272a8f522bb116b82" ], "config": { "user": "65532", @@ -43,7 +43,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099" + "definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad" }, "policies": [ { @@ -66,7 +66,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate reaches no scanf-family function at all: the reviewed binary imports none of the glibc scanf entry points, including the __isoc23_ aliases, and embeds no scanf symbol name to resolve dynamically, so no vulnerable allocating-character scanf path exists in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Discovery candidate reaches no scanf-family function at all: the reviewed binary imports none of the glibc scanf entry points, including the __isoc23_ aliases, and embeds no scanf symbol name to resolve dynamically, so no vulnerable allocating-character scanf path exists in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -84,14 +84,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -111,10 +111,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } }, { @@ -124,7 +124,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Discovery candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -142,14 +142,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -169,10 +169,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } }, { @@ -182,7 +182,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Discovery candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports no glibc resolver symbol at all. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Discovery candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports no glibc resolver symbol at all. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -200,14 +200,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -227,10 +227,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } }, { @@ -240,7 +240,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Discovery candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and links no TLS stack of any kind, serving its immutable index in plaintext behind the deployment's own terminator. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Discovery candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and links no TLS stack of any kind, serving its immutable index in plaintext behind the deployment's own terminator. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -258,14 +258,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -285,10 +285,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } } ] diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index f93afc597..507ca8458 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:07112d7cf9758545d376842d3da2b43045cda4c019650ca959637033e630a5af", + "sha256:e2e804985721aea3ad33bc3833147fb9053a1d19e336a0eac74afc6498bc0b51", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc" + "definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23" }, "policies": [ { @@ -68,7 +68,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } }, { @@ -126,7 +126,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } }, { @@ -184,7 +184,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } }, { @@ -242,7 +242,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } } ] diff --git a/release/security/mint-advisory-baseline.json b/release/security/mint-advisory-baseline.json index 869d8850e..03f0600c9 100644 --- a/release/security/mint-advisory-baseline.json +++ b/release/security/mint-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:87f6c179626b6c3bc64dc1c2e754850958b83442e28caa552753866c7320e692", + "sha256:a788f7502c8e3df8561ef0509df9a033dcc808803b32a32f04f5b7bdc7f54b3b", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8081/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1" + "definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e" }, "policies": [ { @@ -68,7 +68,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } }, { @@ -126,7 +126,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } }, { @@ -184,7 +184,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } }, { @@ -242,7 +242,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } } ]