From 4b68c0356df96f5862362652d4f3911c4d201f20 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Sat, 22 Aug 2026 15:25:18 +0200 Subject: [PATCH] fix(release): renew image advisories for v0.25.0 The application layer DiffID moves with every build and a baseline binds its exposure assertions to exact layer IDs, so the first candidate of a release always trips them. Candidate run 32574081507 stopped on that, as v0.22, v0.23, and v0.24 each did before it. Rebind the four baselines to the official v0.25.0 candidate images built from 130136a2b20ad10d359849ac111316a2fb1cb39e, and move the live pins in the checker test to match. Security review notes (release provenance): - Evidence is regenerated from the exact candidate images in their private packages, with the scanner versions the candidate workflow pins: syft v1.45.1, grype v0.114.0, crane v0.21.2. No digest is carried over from a different candidate and none is hand-invented. - The 21 pinned base layers are unchanged on all four images and remain the exact ordered prefix of the candidates' rootfs.diff_ids, so only the application layer moved. runtime.image still resolves to the same pinned distroless base. - runtime.config is byte-equal to each candidate's OCI process contract: user, entrypoint, command, working_dir, environment, healthcheck, args_escaped, exposed_ports, and stop_signal all match. Image labels are the three OCI identity labels plus the fixed uid/gid pair. - Every asserted file digest was taken from Syft and confirmed against the exported rootfs. The four base libraries are byte-identical to what was already recorded; only /usr/local/bin/ moved. - The four accepted risks were re-verified against these binaries, not carried forward. CVE-2026-5450: Discovery imports no scanf entry point; Evidence, Mint, and Relay reach sscanf at exactly two call sites whose recovered format strings are %lu and %lx, with no allocating conversion and no unresolved site. CVE-2026-5928: no wide-character input symbol is imported. CVE-2026-5435: only __res_init is imported, none of the deprecated resolver-printing helpers. CVE-2026-14456: no OpenSSL library is linked or named for dynamic loading; TLS is rustls over aws-lc-rs. This is a rebind of an unchanged judgement, not a new acceptance. - check-advisory-baselines.py now reports invalid=0 for all four services against the regenerated evidence, and the focused test suite passes. Signed-off-by: Jeremi Joslin --- .../relay-v2/security/advisory-baseline.json | 60 +++++++++---------- .../scripts/test_check_advisory_baselines.py | 10 ++-- .../security/discovery-advisory-baseline.json | 60 +++++++++---------- .../security/evidence-advisory-baseline.json | 60 +++++++++---------- release/security/mint-advisory-baseline.json | 60 +++++++++---------- 5 files changed, 125 insertions(+), 125 deletions(-) diff --git a/products/relay-v2/security/advisory-baseline.json b/products/relay-v2/security/advisory-baseline.json index 72040e3ef..8955a118d 100644 --- a/products/relay-v2/security/advisory-baseline.json +++ b/products/relay-v2/security/advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:c36dc82eab1250c2e3fc430589b275d8f66d8e5c0a18fd030873a8cac6a81982", + "sha256:7c3e77123161022070b0103e51ce23da1e5e524b77279f4a40bf05867b8c41e2", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2" + "definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2" }, "policies": [ { @@ -75,7 +75,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Relay candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } }, { @@ -133,7 +133,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Relay candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } }, { @@ -191,7 +191,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Relay candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Relay candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -209,14 +209,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } }, { @@ -249,7 +249,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Relay candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -267,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f5f25e00c19e62d4307f757c4d424e6d647e444d49ecd2410d08742e2a4dc5e2", + "runtime_definition_digest": "sha256:95ecbce0432752e3b84672e57b3bcd11b61f618dbb9284f5415df265afa99eb2", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/relay", - "sha256": "sha256:2a8f45dc3c70522d2e35714af42a24826fdbbdc1d59deafc475067d0393489ce" + "sha256": "sha256:34cf762f9b3653c06241dc23b7fbe761cf84e530a22b7457222a37a69b8b1221" } ], - "definition_digest": "sha256:3534073aa3178748d2a7fbd445d948c339a4b32a9d788c31fc9ef628e16f438b" + "definition_digest": "sha256:6ef5bbfc6c93cdb76f0759ead0d6b96960ed1199d9b5ec179cbad29eb202df8d" } } ] diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index 8e783b267..49b442d32 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -25,12 +25,12 @@ ROOT / "release/security/mint-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "relay": "sha256:37d5f594a66a7fdb95cf1d5478e8a47a52ffc14c9b1dc5aad0c3ab340fd5e9be", - "discovery": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "evidence": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "mint": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", + "relay": "sha256:e36610df8906a7ba0e238f5007c5f0e1c2dff2ab2509f56045a1a5397cf6fc35", + "discovery": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "evidence": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "mint": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", } -LIVE_REFERENCE_SOURCE_REVISION = "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92" +LIVE_REFERENCE_SOURCE_REVISION = "130136a2b20ad10d359849ac111316a2fb1cb39e" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json index ed9e6929e..6ead82379 100644 --- a/release/security/discovery-advisory-baseline.json +++ b/release/security/discovery-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:9c34752fe979137e4188319f1dc04e4715dade650f03f355b73fec697ee393ad" + "sha256:7ae58ef941e4bb6dee936093650adbc8fca3c4e6fe338b1272a8f522bb116b82" ], "config": { "user": "65532", @@ -43,7 +43,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099" + "definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad" }, "policies": [ { @@ -66,7 +66,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate reaches no scanf-family function at all: the reviewed binary imports none of the glibc scanf entry points, including the __isoc23_ aliases, and embeds no scanf symbol name to resolve dynamically, so no vulnerable allocating-character scanf path exists in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Discovery candidate reaches no scanf-family function at all: the reviewed binary imports none of the glibc scanf entry points, including the __isoc23_ aliases, and embeds no scanf symbol name to resolve dynamically, so no vulnerable allocating-character scanf path exists in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -84,14 +84,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -111,10 +111,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } }, { @@ -124,7 +124,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Discovery candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Discovery candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -142,14 +142,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -169,10 +169,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } }, { @@ -182,7 +182,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Discovery candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports no glibc resolver symbol at all. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Discovery candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports no glibc resolver symbol at all. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -200,14 +200,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -227,10 +227,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } }, { @@ -240,7 +240,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Discovery candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and links no TLS stack of any kind, serving its immutable index in plaintext behind the deployment's own terminator. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Discovery candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and links no TLS stack of any kind, serving its immutable index in plaintext behind the deployment's own terminator. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -258,14 +258,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:003c16f68b7231fb43e8c36aa1d549330febf28e6436a617cb9cf3c1ecdb9348", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:8901d3f3c52a178162ef534d180bd9f43c7441674cdcf0f87b8b3f6c52591c71", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:4a30a9a01d394b36ba49295f0734de7ae018df0e2369cb5f6e9b3f10a567b099", + "runtime_definition_digest": "sha256:59d1a7a99618ffb89d9dc50a081ff9372c5879f2894dd4862cc55996c1ee34ad", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -285,10 +285,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:beb9eb94306e27736f6bcb0f6305e3bf3d920a4dfca457b6353cc513b8c53c7e" + "sha256": "sha256:89381bc650f64a04c31b629387090e105377940a301eba04600d2a76a9a52358" } ], - "definition_digest": "sha256:7900bf6d3e80cf6e7b200c80ccdf1627480f36a2a77fe7b0f80d30f43dea8340" + "definition_digest": "sha256:88efc8dac9301be346898f5c9751a5e50e515626ab353bb889ced8ff7fe5131d" } } ] diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index f93afc597..507ca8458 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:07112d7cf9758545d376842d3da2b43045cda4c019650ca959637033e630a5af", + "sha256:e2e804985721aea3ad33bc3833147fb9053a1d19e336a0eac74afc6498bc0b51", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8080/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc" + "definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23" }, "policies": [ { @@ -68,7 +68,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Evidence candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } }, { @@ -126,7 +126,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Evidence candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } }, { @@ -184,7 +184,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Evidence candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } }, { @@ -242,7 +242,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Evidence candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:010205641f5c90449f50f7de7687572b649e70f6c40c78167e8793a3a5ba63e5", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:607e0797fec9273d0acf5a1313ede9a8c517e73505ebff3b6191c8342a397d4f", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:f927faeac67fe84a849bfb3c3d50aca339ba6d1a0f57ecc53377209cc6fe50fc", + "runtime_definition_digest": "sha256:d7ca76cfe8aadd490a082cfa6f0af72835531f37aa51041728acb21074618b23", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:11089b72a1b653f5fcefa58c82610f6682d7eec747c1d1ece5290ba74aa3e175" + "sha256": "sha256:0fa7d38cc671053402970f0c189c072c81851fb65b275ed86fb5b77cc338a54a" } ], - "definition_digest": "sha256:5775694607c369fb379d715db5dd427e8eee17e7e1f853d6c693e20bf9920a1f" + "definition_digest": "sha256:2336d76e1ad97bf7af42111496e83cc040bd3c7506f00c3ea1ff19c4fc27b45c" } } ] diff --git a/release/security/mint-advisory-baseline.json b/release/security/mint-advisory-baseline.json index 869d8850e..03f0600c9 100644 --- a/release/security/mint-advisory-baseline.json +++ b/release/security/mint-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:87f6c179626b6c3bc64dc1c2e754850958b83442e28caa552753866c7320e692", + "sha256:a788f7502c8e3df8561ef0509df9a033dcc808803b32a32f04f5b7bdc7f54b3b", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -45,7 +45,7 @@ "exposed_ports": ["8081/tcp"], "stop_signal": "" }, - "definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1" + "definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e" }, "policies": [ { @@ -68,7 +68,7 @@ "severity": "Critical", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Mint candidate had only fixed-format %lu and %lx sscanf call sites and no effective vulnerable allocating-character scanf path in the reviewed bytes. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -86,14 +86,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -113,10 +113,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } }, { @@ -126,7 +126,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.24.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The official v0.25.0 Linux AMD64 Mint candidate had no effective wide-character input path in the reviewed bytes; libc exporting ungetwc is expected. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -144,14 +144,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -171,10 +171,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } }, { @@ -184,7 +184,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.24.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", + "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed Trixie version. The official v0.25.0 Linux AMD64 Mint candidate had no effective deprecated resolver-printing path in the reviewed bytes: the reviewed binary imports __res_init and none of the deprecated resolver-printing helpers. A candidate must retain the complete ordered reference rootfs layers, the production OCI process contract, and the Syft-bound executable closure digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -202,14 +202,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:3a7299f559d987305122c7669fc3643095eb0955f8ff4a38c9430d54d0b4452e", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -229,10 +229,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } }, { @@ -242,7 +242,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.24.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", + "rationale": "Debian marks the Trixie issue postponed with no fixed Trixie version, and Grype reports it wont-fix. The advisory is an unbounded pending-connection queue in the OpenSSL QUIC server path. The official v0.25.0 Linux AMD64 Mint candidate links no OpenSSL library: the reviewed binary declares only libgcc_s.so.1, libm.so.6, libc.so.6, and the program interpreter as NEEDED, contains no libssl.so.3 or libcrypto.so.3 name to load dynamically, and terminates TLS with rustls and aws-lc-rs rather than OpenSSL. libssl3t64 ships in the pinned distroless base and no image process opens it. A candidate must retain the complete ordered reference rootfs layers, which pin every libssl3t64 byte, the production OCI process contract, and the Syft-bound reviewed file digests.", "reviewed_at": "2026-08-22", "expires_at": "2026-09-03", "invalidation_triggers": [ @@ -260,14 +260,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "component_layer_id": "sha256:80bb2aedf42cbf9911cb9073be23406c0e7f799f8083bf13a1cd2d460a25e383", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f6bbc75354bdfc5740555df576e343052c66375dd979cbf3f75fd48a60c42a40", - "reference_source_revision": "d1a6c7b925faf35dbc5a9f3269991f0d5e722f92", + "reference_image_digest": "sha256:01e025a12f410fb9c563545fec58fabf4685b161be6a18608f0ff0108a98eaa2", + "reference_source_revision": "130136a2b20ad10d359849ac111316a2fb1cb39e", "reference_provenance": "official_candidate", - "runtime_definition_digest": "sha256:a1e310d9ee685042ed104cf76af34f4c049f22634dc71306de55aeada28962e1", + "runtime_definition_digest": "sha256:8df58c9c4ed2516e9c95b2ff4c20f0a219b36be64dc55314d0ba4d4bf2ca0b6e", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -287,10 +287,10 @@ }, { "path": "/usr/local/bin/mint", - "sha256": "sha256:628e429a1adad92acc5435e8bc867edb099556fcd2d552550f4a8f019b95a164" + "sha256": "sha256:d598a23ca43b235013c771476c8d1e587cbcaee2068cbce6e076fd4bd9e052d1" } ], - "definition_digest": "sha256:d212a47d35d2f57d2d6081ee3df226faec725735f6b207d1b9087bd03276e4d0" + "definition_digest": "sha256:e2f008807a72cccbed92d0503eaf99147d4459ce401cb9ae150ff9822accdc83" } } ]