yuqei/ai-contract-platform
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

release: correct RC-04 vulnerability waiver versions

Browse Source
This commit is contained in:
yuqei
2026-09-20 15:00:30 +08:00
parent 9e9a22fcec
commit d9469a7c90
3 changed files with 271 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yuqei-infra/release/linux-release-security-policy.v1.json
+58 -10
View File
@@ -169,7 +169,7 @@
},
"exemptions": [
{
"id": "RC04.4-DEBIAN13-PYTHON-UNFIXED-HIGH-001",
"id": "RC04.6-DEBIAN13-PYTHON-UNFIXED-HIGH-001",
"expires_at": "2026-10-20T00:00:00Z",
"scope": {
"roles": [
@@ -212,62 +212,110 @@
{
"vulnerability_id": "CVE-2026-76642",
"package_names": [
"bsdutils",
"bsdutils"
],
"installed_version": "1:2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-76642",
"package_names": [
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux"
],
"installed_version": "2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-76642",
"package_names": [
"login"
],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78408",
"package_names": [
"bsdutils"
],
"installed_version": "1:2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78408",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux"
],
"installed_version": "2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78408",
"package_names": [
"login"
],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78409",
"package_names": [
"bsdutils"
],
"installed_version": "1:2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78409",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux"
],
"installed_version": "2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78409",
"package_names": [
"login"
],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78410",
"package_names": [
"bsdutils"
],
"installed_version": "1:2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78410",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux"
],
"installed_version": "1:2.41.5-0+deb13u1"
"installed_version": "2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-78410",
"package_names": [
"login"
],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1"
},
{
"vulnerability_id": "CVE-2026-9538",
yuqei-infra/scripts/linux_release_common.py
+42 -10
View File
@@ -110,7 +110,7 @@ _WINDOWS_GIT_EXECUTABLE = (
)
VULNERABILITY_WAIVERS = [
{
"id": "RC04.4-DEBIAN13-PYTHON-UNFIXED-HIGH-001",
"id": "RC04.6-DEBIAN13-PYTHON-UNFIXED-HIGH-001",
"expires_at": "2026-10-20T00:00:00Z",
"scope": {
"roles": ["contract-api", "ai-platform-api", "ai-worker"],
@@ -136,65 +136,97 @@ VULNERABILITY_WAIVERS = [
"package_names": ["libacl1"],
"installed_version": "2.3.2-2+b1",
},
{
"vulnerability_id": "CVE-2026-76642",
"package_names": ["bsdutils"],
"installed_version": "1:2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-76642",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux",
],
"installed_version": "2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-76642",
"package_names": ["login"],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78408",
"package_names": ["bsdutils"],
"installed_version": "1:2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78408",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux",
],
"installed_version": "2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78408",
"package_names": ["login"],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78409",
"package_names": ["bsdutils"],
"installed_version": "1:2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78409",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux",
],
"installed_version": "2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78409",
"package_names": ["login"],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78410",
"package_names": ["bsdutils"],
"installed_version": "1:2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78410",
"package_names": [
"bsdutils",
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"login",
"mount",
"util-linux",
],
"installed_version": "1:2.41.5-0+deb13u1",
"installed_version": "2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-78410",
"package_names": ["login"],
"installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1",
},
{
"vulnerability_id": "CVE-2026-9538",
yuqei-infra/tests/test_linux_release_build_tools.py
+171 -10
View File
@@ -407,18 +407,106 @@ def _scan(
}
def _waived_python_vulnerabilities() -> list[dict[str, Any]]:
waiver = common.VULNERABILITY_WAIVERS[0]
def _captured_python_base_vulnerabilities() -> list[dict[str, Any]]:
# Independent fixture captured from the pinned Python base image. Do not
# derive this from the waiver under test: Debian packages sharing one CVE
# can carry different epoch-qualified installed versions.
findings = [
(
"CVE-2025-69720",
"6.5+20250216-2",
["libncursesw6", "libtinfo6", "ncurses-base", "ncurses-bin"],
),
("CVE-2026-16742", "257.13-1~deb13u1", ["libsystemd0", "libudev1"]),
("CVE-2026-54369", "2.3.2-2+b1", ["libacl1"]),
("CVE-2026-76642", "1:2.41.5-0+deb13u1", ["bsdutils"]),
(
"CVE-2026-76642",
"2.41.5-0+deb13u1",
[
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"mount",
"util-linux",
],
),
(
"CVE-2026-76642",
"1:4.16.0-2+really2.41.5-0+deb13u1",
["login"],
),
("CVE-2026-78408", "1:2.41.5-0+deb13u1", ["bsdutils"]),
(
"CVE-2026-78408",
"2.41.5-0+deb13u1",
[
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"mount",
"util-linux",
],
),
(
"CVE-2026-78408",
"1:4.16.0-2+really2.41.5-0+deb13u1",
["login"],
),
("CVE-2026-78409", "1:2.41.5-0+deb13u1", ["bsdutils"]),
(
"CVE-2026-78409",
"2.41.5-0+deb13u1",
[
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"mount",
"util-linux",
],
),
(
"CVE-2026-78409",
"1:4.16.0-2+really2.41.5-0+deb13u1",
["login"],
),
("CVE-2026-78410", "1:2.41.5-0+deb13u1", ["bsdutils"]),
(
"CVE-2026-78410",
"2.41.5-0+deb13u1",
[
"libblkid1",
"liblastlog2-2",
"libmount1",
"libsmartcols1",
"libuuid1",
"mount",
"util-linux",
],
),
(
"CVE-2026-78410",
"1:4.16.0-2+really2.41.5-0+deb13u1",
["login"],
),
("CVE-2026-9538", "5.40.1-6+deb13u1", ["perl-base"]),
]
return [
{
"VulnerabilityID": finding["vulnerability_id"],
"VulnerabilityID": vulnerability_id,
"PkgName": package_name,
"InstalledVersion": finding["installed_version"],
"InstalledVersion": installed_version,
"FixedVersion": "",
"Severity": "HIGH",
}
for finding in waiver["findings"]
for package_name in finding["package_names"]
for vulnerability_id, installed_version, package_names in findings
for package_name in package_names
]
@@ -816,8 +904,10 @@ def test_policy_pins_exact_linux_toolchain_and_zero_vulnerability_thresholds() -
assert policy["vulnerability_scan"]["ignore_unfixed"] is False
assert policy["vulnerability_scan"]["exemptions"] == common.VULNERABILITY_WAIVERS
waiver = policy["vulnerability_scan"]["exemptions"][0]
assert waiver["id"] == "RC04.6-DEBIAN13-PYTHON-UNFIXED-HIGH-001"
assert waiver["expires_at"] == "2026-10-20T00:00:00Z"
assert waiver["scope"]["roles"] == ["contract-api", "ai-platform-api", "ai-worker"]
assert len(waiver["findings"]) == 16
assert sum(len(item["package_names"]) for item in waiver["findings"]) == 44
assert (
policy["vulnerability_scan"]["database"]["repository_transport"]
@@ -1560,8 +1650,28 @@ def test_trivy_scan_fails_closed_on_parse_error_or_high_critical() -> None:
def test_trivy_scan_allows_only_exact_unfixed_python_waiver_occurrences() -> None:
policy = common.load_policy(POLICY_PATH)
vulnerabilities = _waived_python_vulnerabilities()
assert len(vulnerabilities) == 44
vulnerabilities = _captured_python_base_vulnerabilities()
fixture_keys = [
(
item["VulnerabilityID"],
item["PkgName"],
item["InstalledVersion"],
)
for item in vulnerabilities
]
waiver_keys = [
(
finding["vulnerability_id"],
package_name,
finding["installed_version"],
)
for waiver in policy["vulnerability_scan"]["exemptions"]
for finding in waiver["findings"]
for package_name in finding["package_names"]
]
assert len(fixture_keys) == len(set(fixture_keys)) == 44
assert len(waiver_keys) == len(set(waiver_keys)) == 44
assert set(fixture_keys) == set(waiver_keys)
report = _scan("contract-api.docker.tar", vulnerabilities)
summary = common.validate_trivy_scan(
@@ -1590,6 +1700,9 @@ def test_trivy_scan_allows_only_exact_unfixed_python_waiver_occurrences() -> Non
("fixable", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("critical", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("duplicate", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("wrong-class", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("wrong-type", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("wrong-os", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("valid", "contract-web", datetime(2026, 9, 20, tzinfo=timezone.utc)),
("valid", "contract-api", datetime(2026, 10, 20, tzinfo=timezone.utc)),
],
@@ -1598,7 +1711,7 @@ def test_trivy_waiver_mismatch_or_expiry_fails_closed(
mutation: str, role: str, at: datetime
) -> None:
policy = common.load_policy(POLICY_PATH)
vulnerabilities = _waived_python_vulnerabilities()
vulnerabilities = _captured_python_base_vulnerabilities()
if mutation == "unknown-cve":
vulnerabilities[0]["VulnerabilityID"] = "CVE-2099-0001"
elif mutation == "wrong-package":
@@ -1612,11 +1725,59 @@ def test_trivy_waiver_mismatch_or_expiry_fails_closed(
elif mutation == "duplicate":
vulnerabilities.append(dict(vulnerabilities[0]))
report = _scan("contract-api.docker.tar", vulnerabilities)
if mutation == "wrong-class":
report["Results"][0]["Class"] = "lang-pkgs"
elif mutation == "wrong-type":
report["Results"][0]["Type"] = "ubuntu"
elif mutation == "wrong-os":
report["Metadata"]["OS"]["Family"] = "ubuntu"
with pytest.raises(common.ReleaseValidationError, match="gate failed"):
common.validate_trivy_scan(report, policy, role=role, at=at)
@pytest.mark.parametrize(
("package_name", "wrong_version"),
[
("bsdutils", "2.41.5-0+deb13u1"),
("bsdutils", "1:4.16.0-2+really2.41.5-0+deb13u1"),
("libblkid1", "1:2.41.5-0+deb13u1"),
("libblkid1", "1:4.16.0-2+really2.41.5-0+deb13u1"),
("login", "1:2.41.5-0+deb13u1"),
("login", "2.41.5-0+deb13u1"),
],
ids=[
"bsdutils-as-library",
"bsdutils-as-login",
"library-as-old-unified-version",
"library-as-login",
"login-as-old-unified-version",
"login-as-library",
],
)
def test_trivy_waiver_rejects_util_linux_version_interchange(
package_name: str, wrong_version: str
) -> None:
policy = common.load_policy(POLICY_PATH)
vulnerabilities = _captured_python_base_vulnerabilities()
finding = next(
item
for item in vulnerabilities
if item["VulnerabilityID"] == "CVE-2026-76642"
and item["PkgName"] == package_name
)
finding["InstalledVersion"] = wrong_version
report = _scan("contract-api.docker.tar", vulnerabilities)
with pytest.raises(common.ReleaseValidationError, match="gate failed"):
common.validate_trivy_scan(
report,
policy,
role="contract-api",
at=datetime(2026, 9, 20, tzinfo=timezone.utc),
)
def test_docker_archive_rejects_layer_content_not_bound_to_config(tmp_path: Path) -> None:
path = tmp_path / "image.docker.tar"
role = "contract-api"
@@ -1819,7 +1980,7 @@ def test_installable_manifest_preserves_complete_waiver_accounting(tmp_path: Pat
scan_path = bundle["root"] / image["scan"]["path"]
scan_payload = _scan(
Path(image["docker_archive"]["path"]).name,
_waived_python_vulnerabilities(),
_captured_python_base_vulnerabilities(),
image_id=image["oci"]["config_digest"],
)
scan_path.write_bytes(common.canonical_json_bytes(scan_payload))