diff --git a/.github/dapper-unfixed.json b/.github/dapper-unfixed.json new file mode 100644 index 0000000..2b871cb --- /dev/null +++ b/.github/dapper-unfixed.json @@ -0,0 +1,842 @@ +{ + "repository": "PastureStack/ipsec-vxlan-overlay-network", + "scope": "disposable-dapper-nonheader", + "unfixed": [ + { + "id": "CVE-2017-13716", + "package": "binutils", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/binutils@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "binutils-common", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/binutils-common@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "binutils-x86-64-linux-gnu", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/binutils-x86-64-linux-gnu@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-102473", + "package": "dash", + "version": "0.5.12-12ubuntu3", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102473", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-102474", + "package": "dash", + "version": "0.5.12-12ubuntu3", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102474", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-52005", + "package": "git", + "version": "1:2.53.0-1ubuntu1", + "purl": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-52005", + "reason": "Canonical Ubuntu 26.04 status: resolute_git: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-52005", + "package": "git-man", + "version": "1:2.53.0-1ubuntu1", + "purl": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-52005", + "reason": "Canonical Ubuntu 26.04 status: resolute_git: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41256", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41256", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41257", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41257", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43895", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43895", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43896", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43896", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-44777", + "package": "jq", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-44777", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "libbinutils", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/libbinutils@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-dev-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-dev-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-dev-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-dev-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-gconv-modules-extra", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-gconv-modules-extra", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc6", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc6", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc6-dev", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc6-dev", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6-dev@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "libctf-nobfd0", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/libctf-nobfd0@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "libctf0", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/libctf0@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2025-66382", + "package": "libexpat1", + "version": "2.7.4-1ubuntu0.2", + "purl": "pkg:deb/ubuntu/libexpat1@2.7.4-1ubuntu0.2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-66382", + "reason": "Canonical Ubuntu 26.04 status: resolute_expat: deferred (2026-09-28). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-67693", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-67693", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-88647", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88647", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-88648", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88648", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95184", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95184", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95209", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95209", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95210", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95210", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "libgprofng0", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/libgprofng0@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41256", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41256", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-41257", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-41257", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43895", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43895", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-43896", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-43896", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-44777", + "package": "libjq1", + "version": "1.8.1-4ubuntu2", + "purl": "pkg:deb/ubuntu/libjq1@1.8.1-4ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-44777", + "reason": "Canonical Ubuntu 26.04 status: resolute_jq: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-13757", + "package": "libp11-kit0", + "version": "0.26.2-2", + "purl": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-13757", + "reason": "Canonical Ubuntu 26.04 status: resolute_p11-kit: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-103111", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-103111", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-86145", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-86145", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89156", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89156", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89157", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89157", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89158", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89158", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89160", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89160", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89161", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89161", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89162", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89162", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-107161", + "package": "libsasl2-2", + "version": "2.1.28+dfsg1-9ubuntu3", + "purl": "pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-107161", + "package": "libsasl2-modules-db", + "version": "2.1.28+dfsg1-9ubuntu3", + "purl": "pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2017-13716", + "package": "libsframe3", + "version": "2.46-3ubuntu2", + "purl": "pkg:deb/ubuntu/libsframe3@2.46-3ubuntu2?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2017-13716", + "reason": "Canonical Ubuntu 26.04 status: resolute_binutils: deferred. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "libsystemd0", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "libudev1", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-56433", + "package": "login.defs", + "version": "1:4.17.4-2ubuntu3", + "purl": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-56433", + "package": "passwd", + "version": "1:4.17.4-2ubuntu3", + "purl": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35341", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35341", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35344", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35344", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35345", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35345", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35348", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35348", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35350", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35350", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35351", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35351", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35352", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35352", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35354", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35354", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35357", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35357", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35359", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35359", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35360", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35360", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35363", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35363", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35364", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35364", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35367", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35367", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35368", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35368", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35370", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35370", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35371", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35371", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35373", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35373", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35374", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35374", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35377", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35377", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18477", + "package": "tar", + "version": "1.35+dfsg-4ubuntu0.4", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18477", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18508", + "package": "tar", + "version": "1.35+dfsg-4ubuntu0.4", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18508", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + } + ] +} diff --git a/.github/runtime-unfixed.json b/.github/runtime-unfixed.json new file mode 100644 index 0000000..1399d34 --- /dev/null +++ b/.github/runtime-unfixed.json @@ -0,0 +1,599 @@ +{ + "unfixed": [ + { + "id": "CVE-2026-102473", + "package": "dash", + "version": "0.5.12-12ubuntu3", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102473", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-102474", + "package": "dash", + "version": "0.5.12-12ubuntu3", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102474", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-bin", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc-gconv-modules-extra", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc-gconv-modules-extra", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18374", + "package": "libc6", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89092", + "package": "libc6", + "version": "2.43-2ubuntu2.4", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2025-1352", + "package": "libelf1t64", + "version": "0.194-4", + "purl": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-1352", + "reason": "Canonical Ubuntu 26.04 status: resolute_elfutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2025-1376", + "package": "libelf1t64", + "version": "0.194-4", + "purl": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2025-1376", + "reason": "Canonical Ubuntu 26.04 status: resolute_elfutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-67693", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-67693", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-88647", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88647", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-88648", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88648", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95184", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95184", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95209", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95209", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-95210", + "package": "libgnutls30t64", + "version": "3.8.12-2ubuntu1.1", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95210", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-13757", + "package": "libp11-kit0", + "version": "0.26.2-2", + "purl": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-13757", + "reason": "Canonical Ubuntu 26.04 status: resolute_p11-kit: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-103111", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-103111", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-86145", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-86145", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89156", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89156", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89157", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89157", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89158", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89158", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89160", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89160", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89161", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89161", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-89162", + "package": "libpcre2-8-0", + "version": "10.46-1build1", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89162", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-107161", + "package": "libsasl2-2", + "version": "2.1.28+dfsg1-9ubuntu3", + "purl": "pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-107161", + "package": "libsasl2-modules-db", + "version": "2.1.28+dfsg1-9ubuntu3", + "purl": "pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "libsystemd0", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "libudev1", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-56433", + "package": "login.defs", + "version": "1:4.17.4-2ubuntu3", + "purl": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2024-56433", + "package": "passwd", + "version": "1:4.17.4-2ubuntu3", + "purl": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35341", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35341", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35344", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35344", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35345", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35345", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35348", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35348", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35350", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35350", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35351", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35351", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35352", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35352", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35354", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35354", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35357", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35357", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35359", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35359", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35360", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35360", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35363", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35363", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35364", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35364", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35367", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35367", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35368", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35368", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35370", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35370", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35371", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35371", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35373", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35373", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35374", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35374", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-35377", + "package": "rust-coreutils", + "version": "0.8.0-0ubuntu3", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35377", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-40228", + "package": "systemd-standalone-sysusers", + "version": "259.5-0ubuntu3.4", + "purl": "pkg:deb/ubuntu/systemd-standalone-sysusers@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04", + "severity": "LOW", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18477", + "package": "tar", + "version": "1.35+dfsg-4ubuntu0.4", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18477", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "id": "CVE-2026-18508", + "package": "tar", + "version": "1.35+dfsg-4ubuntu0.4", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "severity": "MEDIUM", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18508", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + } + ], + "repository": "PastureStack/ipsec-vxlan-overlay-network" +} diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py new file mode 100644 index 0000000..db676ee --- /dev/null +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -0,0 +1,68 @@ +"""Enforce release findings; only exact, reviewed unfixed low/medium entries may pass.""" +import argparse +import json +from pathlib import Path + + +def violations(report, ledger, repository): + if (not isinstance(report, dict) or report.get("SchemaVersion") != 2 + or not isinstance(report.get("Results"), list) or not report["Results"]): + raise ValueError("missing or malformed Trivy scan results") + for result in report["Results"]: + if not isinstance(result, dict) or not isinstance(result.get("Target"), str): + raise ValueError("malformed Trivy result") + for key in ("Vulnerabilities", "Secrets"): + if key in result and result[key] is not None and not isinstance(result[key], list): + raise ValueError("malformed Trivy findings") + if ledger.get("repository") != repository: + raise ValueError("allowlist repository mismatch") + reviewed = {} + for entry in ledger.get("unfixed", []): + key = (entry["id"], entry["package"], entry["version"], entry.get("purl", "")) + if key in reviewed: + raise ValueError("duplicate reviewed finding") + if (entry.get("severity") not in ("LOW", "MEDIUM") + or entry.get("status") != "no_official_fix" + or not entry.get("officialEvidence", "").startswith("https://") + or not entry.get("reason") or not entry.get("checkedAt")): + raise ValueError("incomplete official no-fix evidence") + reviewed[key] = entry + errors = [] + for result in report.get("Results") or []: + if result.get("Secrets"): + errors.append("secret findings remain") + for finding in result.get("Vulnerabilities") or []: + severity = finding.get("Severity", "UNKNOWN") + key = (finding.get("VulnerabilityID"), finding.get("PkgName"), + finding.get("InstalledVersion"), + (finding.get("PkgIdentifier") or {}).get("PURL", "")) + entry = reviewed.get(key) + fixed = str(finding.get("FixedVersion") or "").strip() + if (severity not in ("LOW", "MEDIUM") or fixed + or entry is None or entry["severity"] != severity): + errors.append("%s %s@%s severity=%s fixed=%s" % ( + key[0], key[1], key[2], severity, fixed or "none")) + return errors + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + # Workflows select a known evidence scope, never an arbitrary input path. + reports = { + "source": "evidence/source-security.json", + "product": "evidence/product-security.json", + "runtime": "evidence/runtime-security.json", + "dapper": "evidence/dapper-nonheader-security.json", + "release-runtime": "dist/release/runtime-security.json", + } + parser.add_argument("scope", choices=tuple(reports)) + parser.add_argument("--repository", required=True) + args = parser.parse_args() + report_path = Path(reports[args.scope]) + ledger_path = Path(".github/dapper-unfixed.json" if args.scope == "dapper" + else ".github/runtime-unfixed.json") + failures = violations(json.loads(report_path.read_text(encoding="utf-8")), + json.loads(ledger_path.read_text(encoding="utf-8")), args.repository) + if failures: + raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) + print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/.github/scripts/test_runtime_vulnerability_policy.py b/.github/scripts/test_runtime_vulnerability_policy.py new file mode 100644 index 0000000..df8cec2 --- /dev/null +++ b/.github/scripts/test_runtime_vulnerability_policy.py @@ -0,0 +1,82 @@ +import copy +import importlib.util +import pathlib +import subprocess +import sys +import unittest + +PATH = pathlib.Path(__file__).with_name('enforce-runtime-vulnerabilities.py') +SPEC = importlib.util.spec_from_file_location('gate', PATH) +GATE = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(GATE) +REPO = 'PastureStack/ipsec-vxlan-overlay-network' + + +class RuntimePolicy(unittest.TestCase): + def setUp(self): + self.finding = {'VulnerabilityID': 'TEST-1', 'PkgName': 'lib', 'InstalledVersion': '1', + 'Severity': 'MEDIUM', 'FixedVersion': '', + 'PkgIdentifier': {'PURL': 'pkg:test/lib@1'}} + self.report = {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': [self.finding]}]} + self.ledger = {'repository': REPO, 'unfixed': [{'id': 'TEST-1', 'package': 'lib', + 'version': '1', 'severity': 'MEDIUM', 'purl': 'pkg:test/lib@1', + 'status': 'no_official_fix', 'officialEvidence': 'https://fixture.invalid/advisory', + 'reason': 'Test fixture only', 'checkedAt': '2026-10-23'}]} + + def test_exact_reviewed_unfixed_medium_passes(self): + self.assertEqual(GATE.violations(self.report, self.ledger, REPO), []) + + def test_clean_scan_passes(self): + self.assertEqual(GATE.violations({'SchemaVersion': 2, 'Results': [{'Target': 'fixture'}]}, + {'repository': REPO, 'unfixed': []}, REPO), []) + + def test_missing_or_malformed_scan_fails_closed(self): + for report in ({}, {'Results': []}, {'SchemaVersion': 2, 'Results': []}, + {'SchemaVersion': 2, 'Results': [{}]}, + {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': {}}]}): + with self.assertRaises(ValueError): + GATE.violations(report, self.ledger, REPO) + + def test_unregistered_medium_blocks(self): + self.ledger['unfixed'] = [] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_medium_blocks(self): + for severity in ('LOW', 'MEDIUM'): + self.finding['Severity'] = severity + self.ledger['unfixed'][0]['severity'] = severity + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_high_critical_and_unknown_always_block(self): + for severity in ('HIGH', 'CRITICAL', 'UNKNOWN'): + self.finding['Severity'] = severity + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_version_or_purl_drift_blocks(self): + for key in ('version', 'purl'): + ledger = copy.deepcopy(self.ledger) + ledger['unfixed'][0][key] = 'different' + self.assertTrue(GATE.violations(self.report, ledger, REPO)) + + def test_secrets_always_block(self): + self.report['Results'][0]['Secrets'] = [{'RuleID': 'test'}] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_repository_drift_fails_closed(self): + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, 'another/repo') + + def test_incomplete_evidence_fails_closed(self): + del self.ledger['unfixed'][0]['checkedAt'] + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, REPO) + + def test_cli_rejects_free_form_paths(self): + result = subprocess.run([sys.executable, str(PATH), "../../etc/passwd", + "--repository", REPO], capture_output=True, text=True) + self.assertEqual(result.returncode, 2) + self.assertIn("invalid choice", result.stderr) + +if __name__ == '__main__': + unittest.main() diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index 63c891c..80e1432 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -53,7 +53,7 @@ jobs: cd "$GITHUB_WORKSPACE" go test -run '^$' ./... go test -run '^$' -tags=integration ./store - VERSION_OVERRIDE=0.14.39 ./scripts/build + VERSION_OVERRIDE=0.14.40 ./scripts/build - name: Analyze without publishing temporary alerts uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9148903..8a1d0db 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,6 +1,6 @@ name: Release IPsec overlay -# A release is dispatched from main only after an annotated v0.14.39 tag and +# A release is dispatched from main only after an annotated v0.14.40 tag and # successful, same-commit Security release gate and CodeQL verification runs. # GHCR, registry attestations, and GitHub Releases are not an atomic transaction. # All source/product/runtime gates precede the image push. A later failure may @@ -9,11 +9,11 @@ on: workflow_dispatch: inputs: release_tag: - description: Existing annotated, numeric v0.14.39 tag at main HEAD + description: Existing annotated, numeric v0.14.40 tag at main HEAD required: true type: choice options: - - v0.14.39 + - v0.14.40 security_run_id: description: Successful same-SHA Security release gate run ID required: true @@ -35,7 +35,7 @@ permissions: attestations: write concurrency: - group: ipsec-vxlan-overlay-release-v0.14.39 + group: ipsec-vxlan-overlay-release-v0.14.40 cancel-in-progress: false jobs: @@ -48,8 +48,8 @@ jobs: CODEQL_RUN_ID: ${{ inputs.codeql_run_id }} RESUME_DIGEST: ${{ inputs.resume_digest }} GH_TOKEN: ${{ github.token }} - SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.39 - LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.39 + SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40 + LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.40 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 GOFLAGS: -mod=vendor GOWORK: off @@ -67,7 +67,7 @@ jobs: run: | set -euo pipefail test "$GITHUB_REF" = refs/heads/main - test "$RELEASE_TAG" = v0.14.39 + test "$RELEASE_TAG" = v0.14.40 [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] [[ "$SECURITY_RUN_ID" =~ ^[0-9]+$ ]] [[ "$CODEQL_RUN_ID" =~ ^[0-9]+$ ]] @@ -115,7 +115,8 @@ jobs: --name "ipsec-vxlan-overlay-network-security-$SOURCE_SHA" --dir evidence for file in SHA256SUMS source-tree.txt source-locks.sha256 product.sha256 \ security-summary.txt source-security.json product-security.json \ - runtime-security.json source-sbom.cdx.json; do + runtime-security.json source-sbom.cdx.json dapper-security.json \ + dapper-nonheader-security.json; do test -s "evidence/$file" done sha256sum --check evidence/SHA256SUMS @@ -124,8 +125,17 @@ jobs: sha256sum --check evidence/source-locks.sha256 jq -e '.serialNumber and ((.components // []) | length > 0)' \ evidence/source-sbom.cdx.json >/dev/null + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + dapper --repository "$GITHUB_REPOSITORY" + for binary in ipsec-vxlan-overlay-network ipsec-vxlan-overlay-topology pasture-cni-resolver; do + jq -e --arg binary "$binary" \ + '[.Results[]? | select(.Type == "gobinary" and .Target == $binary) | .Packages[]?] | length > 0' \ + evidence/product-security.json >/dev/null + done for scope in source product runtime; do report="evidence/${scope}-security.json" + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + "$scope" --repository "$GITHUB_REPOSITORY" for field in secrets critical high; do grep -Fx "${scope}_${field}=0" evidence/security-summary.txt >/dev/null done @@ -152,15 +162,15 @@ jobs: shell: bash run: | set -euo pipefail - VERSION_OVERRIDE=0.14.39 ./scripts/build + VERSION_OVERRIDE=0.14.40 ./scripts/build sha256sum --check evidence/product.sha256 if [ -z "$RESUME_DIGEST" ]; then - VERSION_OVERRIDE=0.14.39 TAG=0.14.39 REPO=local/pasturestack \ + VERSION_OVERRIDE=0.14.40 TAG=0.14.40 REPO=local/pasturestack \ IMAGE_REVISION="$SOURCE_SHA" ./scripts/package test "$(wc -l < dist/images)" -eq 1 grep -Fx "$LOCAL_IMAGE" dist/images test "$(docker image inspect "$LOCAL_IMAGE" \ - --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.39 + --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.40 test "$(docker image inspect "$LOCAL_IMAGE" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA" docker tag "$LOCAL_IMAGE" "$SERVICE_IMAGE" @@ -178,7 +188,7 @@ jobs: docker pull "$SERVICE_IMAGE@$RESUME_DIGEST" docker tag "$SERVICE_IMAGE@$RESUME_DIGEST" "$SERVICE_IMAGE" test "$(docker image inspect "$SERVICE_IMAGE" \ - --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.39 + --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.40 test "$(docker image inspect "$SERVICE_IMAGE" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA" verification_container="$(docker create "$SERVICE_IMAGE")" @@ -207,9 +217,12 @@ jobs: docker run --rm --network none -v /var/run/docker.sock:/var/run/docker.sock \ -v "$cache:/root/.cache/trivy" -v "$release_dir:/release" "$TRIVY_IMAGE" \ image --cache-dir /root/.cache/trivy --skip-db-update --offline-scan \ - --scanners vuln,secret --severity CRITICAL,HIGH --format json \ + --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --format json \ --output /release/runtime-security.json "$SERVICE_IMAGE" test -s "$release_dir/runtime-security.json" + python3 .github/scripts/test_runtime_vulnerability_policy.py + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + release-runtime --repository "$GITHUB_REPOSITORY" test "$(jq '[.Results[]?.Secrets[]?] | length' "$release_dir/runtime-security.json")" -eq 0 test "$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" or .Severity == "HIGH")] | length' \ @@ -315,7 +328,7 @@ jobs: run: | set -euo pipefail release_dir="dist/release" - product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.39-linux-amd64" + product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.40-linux-amd64" mkdir -p "$product_dir" cp bin/ipsec-vxlan-overlay-network bin/ipsec-vxlan-overlay-topology bin/pasture-cni-resolver \ LICENSE ORIGIN.md SECURITY.md THIRD_PARTY_NOTICES.md "$product_dir/" @@ -327,11 +340,11 @@ jobs: find "$product_dir" -exec touch -h -d "@$source_epoch" {} + tar --sort=name --mtime="@$source_epoch" --owner=0 --group=0 \ --numeric-owner -C "$release_dir" \ - -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz" \ - ipsec-vxlan-overlay-network-0.14.39-linux-amd64 + -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.40-linux-amd64.tar.xz" \ + ipsec-vxlan-overlay-network-0.14.40-linux-amd64 ( cd "$release_dir" - sha256sum ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz \ + sha256sum ipsec-vxlan-overlay-network-0.14.40-linux-amd64.tar.xz \ source-sbom.cdx.json image-sbom.cdx.json product.sha256 \ runtime-security.json gate-security-summary.txt image-digest.txt \ release-identity.txt > SHA256SUMS @@ -355,9 +368,9 @@ jobs: run: | set -euo pipefail gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \ - --title 'IPsec Overlay v0.14.39' \ + --title 'IPsec Overlay v0.14.40' \ --notes "Source ${SOURCE_SHA}; Security gate run ${SECURITY_RUN_ID}; CodeQL run ${CODEQL_RUN_ID}. GHCR image ${SERVICE_IMAGE}@$(cat dist/release/image-digest.txt | sed 's/^.*@//')." \ - dist/release/ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz \ + dist/release/ipsec-vxlan-overlay-network-0.14.40-linux-amd64.tar.xz \ dist/release/source-sbom.cdx.json \ dist/release/image-sbom.cdx.json \ dist/release/product.sha256 \ diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 7ec2711..8cd1df0 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -20,12 +20,12 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 120 env: - CANDIDATE_VERSION: 0.14.39 - VERSION_OVERRIDE: 0.14.39 - TAG: 0.14.39 + CANDIDATE_VERSION: 0.14.40 + VERSION_OVERRIDE: 0.14.40 + TAG: 0.14.40 IMAGE_REVISION: ${{ github.sha }} REPO: local/pasturestack - IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.39 + IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.40 GO_VERSION: 1.27.3 GO_LINUX_AMD64_SHA256: 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 @@ -65,6 +65,7 @@ jobs: test "$(git rev-list --count "$reviewed_base"..HEAD)" -ge 1 python3 tests/test_release_history_contract.py python3 tests/test_openssl_package_contract.py + python3 tests/test_full_severity_security_contract.py source scripts/version test "$VERSION" = "$CANDIDATE_VERSION" go list -mod=vendor ./... >/dev/null @@ -76,7 +77,9 @@ jobs: mkdir -p evidence git ls-tree -r --name-only HEAD | LC_ALL=C sort > evidence/source-tree.txt sha256sum go.mod go.sum vendor/modules.txt ubuntu-apt.lock Dockerfile.dapper package/Dockerfile \ - security/dapper-linux-libc-dev.cves > evidence/source-locks.sha256 + security/dapper-linux-libc-dev.cves security/ubuntu-security-packages.lock \ + .github/runtime-unfixed.json .github/dapper-unfixed.json \ + .github/scripts/enforce-runtime-vulnerabilities.py > evidence/source-locks.sha256 - name: Validate, race-test, integrate metadata, and build reproducibly shell: bash @@ -184,18 +187,27 @@ jobs: docker pull "$TRIVY_IMAGE" docker run --rm -v "$TRIVY_CACHE:/root/.cache/trivy" \ "$TRIVY_IMAGE" image --cache-dir /root/.cache/trivy --download-db-only - run_fs_scan() { - local source=$1 destination=$2 + run_path_scan() { + local scan_type=$1 source=$2 destination=$3 docker run --rm --network none \ -v "$TRIVY_CACHE:/root/.cache/trivy" \ -v "$source:/scan:ro" -v "$PWD/evidence:/evidence" \ - "$TRIVY_IMAGE" fs --cache-dir /root/.cache/trivy \ - --skip-db-update --offline-scan --scanners vuln,secret \ - --severity CRITICAL,HIGH --format json \ + "$TRIVY_IMAGE" "$scan_type" --cache-dir /root/.cache/trivy \ + --skip-db-update --offline-scan --scanners vuln,secret --list-all-pkgs \ + --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --format json \ --output "/evidence/${destination}" /scan } - run_fs_scan "$source_tree" source-security.json - run_fs_scan "$product_tree" product-security.json + run_path_scan fs "$source_tree" source-security.json + # Filesystem mode intentionally ignores compiled Go executables. + # Rootfs mode must identify each delivered ELF, not emit an empty + # report that could be mistaken for a clean product scan. + run_path_scan rootfs "$product_tree" product-security.json + for binary in ipsec-vxlan-overlay-network ipsec-vxlan-overlay-topology pasture-cni-resolver; do + test -x "$product_tree/$binary" + jq -e --arg binary "$binary" \ + '[.Results[]? | select(.Type == "gobinary" and .Target == $binary) | .Packages[]?] | length > 0' \ + evidence/product-security.json >/dev/null + done docker run --rm --network none \ -v "$TRIVY_CACHE:/root/.cache/trivy" -v "$source_tree:/scan:ro" \ -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" fs \ @@ -205,7 +217,7 @@ jobs: -v "$TRIVY_CACHE:/root/.cache/trivy" -v "$PWD:/work" -w /work \ "$TRIVY_IMAGE" image --cache-dir /root/.cache/trivy \ --skip-db-update --offline-scan --scanners vuln,secret \ - --severity CRITICAL,HIGH --format json \ + --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --format json \ --output /work/evidence/runtime-security.json "$IMAGE" docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v "$TRIVY_CACHE:/root/.cache/trivy" -v "$PWD:/work" -w /work \ @@ -220,7 +232,7 @@ jobs: -v "$TRIVY_CACHE:/root/.cache/trivy" -v "$dapper_rootfs:/scan:ro" \ -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" rootfs \ --cache-dir /root/.cache/trivy --skip-db-update --offline-scan \ - --scanners vuln,secret --severity CRITICAL,HIGH --format json \ + --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --format json \ --output /evidence/dapper-security.json /scan docker run --rm --network none \ -v "$TRIVY_CACHE:/root/.cache/trivy" -v "$dapper_rootfs:/scan:ro" \ @@ -271,6 +283,15 @@ jobs: test -z "$(find "$dapper_rootfs" -type f \ \( -path '*/boot/vmlinuz*' -o -path '*/lib/modules/*' -o -path '*/usr/lib/modules/*' \) \ -print -quit)" + # Keep the complete builder scan above. Apply the full release policy + # separately to non-header packages; never broaden the existing, + # exact build-only header scope to other packages or the runtime. + jq --arg purl "$dapper_purl" \ + '.Results |= map(.Vulnerabilities = [(.Vulnerabilities // [])[] | + select(.PkgIdentifier.PURL != $purl)])' \ + evidence/dapper-security.json > evidence/dapper-nonheader-security.json + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + dapper --repository "$GITHUB_REPOSITORY" cut -f1 evidence/dapper-reviewed-matched.tsv | jq -Rn \ --arg purl "$dapper_purl" \ --arg timestamp "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \ @@ -283,7 +304,7 @@ jobs: impact_statement:$impact }] | { "@context":"https://openvex.dev/ns/v0.2.0", - "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.39", + "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.40", author:"PastureStack Security", timestamp:$timestamp, version:1, @@ -294,12 +315,13 @@ jobs: "$(wc -l < evidence/dapper-reviewed-matched.tsv)" rm -rf -- "$source_tree" "$product_tree" "$dapper_rootfs" - - name: Enforce delivered product zero and record disposable builder findings + - name: Enforce full-severity product policy and record disposable builder findings shell: bash run: | set -euo pipefail cd "$GITHUB_WORKSPACE" : > evidence/security-summary.txt + python3 .github/scripts/test_runtime_vulnerability_policy.py for scope in source product runtime; do report="evidence/${scope}-security.json" secrets=$(jq '[.Results[]?.Secrets[]?] | length' "$report") @@ -311,6 +333,8 @@ jobs: test "$secrets" -eq 0 test "$critical" -eq 0 test "$high" -eq 0 + python3 .github/scripts/enforce-runtime-vulnerabilities.py \ + "$scope" --repository "$GITHUB_REPOSITORY" done dapper_secrets=$(jq '[.Results[]?.Secrets[]?] | length' evidence/dapper-security.json) dapper_raw_critical=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' evidence/dapper-security.json) diff --git a/README.md b/README.md index ed20c77..56dec5f 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Release status -Candidate `v0.14.39` refreshes the compiler, effective Go dependencies, +Candidate `v0.14.40` refreshes the compiler, effective Go dependencies, official Ubuntu security packages, and checksum-pinned companion binaries. The companions are metadata CNI IPAM `v0.2.8`, host-local CNI IPAM `v0.1.6`, flat CNI IPAM `v0.1.6`, mount propagation `v1.0.12`, and per-host subnet @@ -21,6 +21,17 @@ firewall ownership contracts are unchanged. Candidate inputs are not proof of publication; require the final release's same-source checks, scan results, and immutable image digest before deployment. +The immutable `v0.14.39` release is retained but is not recommended for new +deployments: its historical HIGH/CRITICAL-only scan missed officially fixed +MEDIUM findings in strongSwan and systemd-sysusers. `v0.14.40` pins Ubuntu's +strongSwan `6.0.4-1ubuntu3.2` and systemd-sysusers `259.5-0ubuntu3.4`, carries +the matching checksum-bound strongSwan source, and scans all severities. +Any finding with an official fixed version blocks publication, including +LOW/MEDIUM; HIGH, CRITICAL, UNKNOWN, secrets, and unregistered findings also +block. Only exact repository/package/version/PURL LOW/MEDIUM entries backed +by the official Ubuntu no-fix ledger can pass. The disposable builder's +kernel-header scope stays separate and never exempts shipped runtime code. + The prior `v0.14.27` source and image were published with manifest digest `sha256:917c4369ee22808c100dd890d17296fe341e0dda4b2ad2923050f4fca5c22386` and release SBOM/provenance attestations. On an isolated Ubuntu 26.04.1 / Docker 29.8 VM, that @@ -150,11 +161,13 @@ two-host endpoint-change acceptance remain separate gates. Normal PR merges still require successful Security and CodeQL gates on the exact final source SHA before release. -The release gate rejects Critical/High findings and secrets in the source, +The release gate retains every severity and rejects fixed findings, unreviewed +findings, Critical/High/Unknown findings, and secrets in the source, shipped binaries, and runtime image. It scans the disposable Dapper builder separately and retains its raw findings; only exact, already-reviewed `linux-libc-dev` header findings receive builder-scoped VEX. New builder -findings remain visible and are not evidence that the shipped runtime is safe. +header findings remain explicitly unreviewed; all non-header builder packages +use the same full-severity, exact no-fix policy in a separate ledger. The Dapper image and its kernel headers are not included in the release image. Preferred commands inside the image are: diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 65af89d..cb158db 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -4,7 +4,7 @@ PastureStack does not relicense third-party work. Copyright, license, and attrib | Component | Version | Source | License | | --- | --- | --- | --- | -| strongSwan | Ubuntu `6.0.4-1ubuntu3.1` | [Ubuntu source package](https://packages.ubuntu.com/source/resolute-updates/strongswan) | GPL-2.0-or-later with OpenSSL exception, plus file-specific licenses listed by Ubuntu | +| strongSwan | Ubuntu `6.0.4-1ubuntu3.2` | [Ubuntu source package](https://packages.ubuntu.com/source/resolute-updates/strongswan) | GPL-2.0-or-later with OpenSSL exception, plus file-specific licenses listed by Ubuntu | | CNI reference plugins | 0.3.0 | [containernetworking/plugins](https://github.com/containernetworking/plugins) | Apache-2.0 | | CNI bridge compatibility binary | 0.7.2 | [rancher/rancher-cni-bridge](https://github.com/rancher/rancher-cni-bridge) | Apache-2.0 | | Weave router helper | r-v0.0.4 | [rancher-archives/weave](https://github.com/rancher-archives/weave) | Apache-2.0 | diff --git a/package/Dockerfile b/package/Dockerfile index 20f9693..33549af 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -8,12 +8,12 @@ ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510 ADD --checksum=sha256:44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340 https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/libssl3t64_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-libssl3t64.deb ADD --checksum=sha256:588e7f17afb9263a348c9587330805fc856536402328bec1660ff3a95e61bb4c https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl.deb ADD --checksum=sha256:1b582b937a1f7a8f987da9e1bbfcc806faea714267631ce0fbbd352c924b7daf https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl-provider-legacy_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl-provider-legacy.deb +ADD --checksum=sha256:79576bb61b9a406cea9eb73d0c565cc6254a6b6d2e7198f44758d2d7c61a7aec https://snapshot.ubuntu.com/ubuntu/20261023T000000Z/pool/main/s/strongswan/strongswan_6.0.4.orig.tar.bz2 /licenses/strongswan-source/strongswan_6.0.4.orig.tar.bz2 +ADD --checksum=sha256:1f6cfddbefa64298e0cd7dbfcf8dde7eb0b81f708a70f180698a9addbc77e631 https://snapshot.ubuntu.com/ubuntu/20261023T000000Z/pool/main/s/strongswan/strongswan_6.0.4-1ubuntu3.2.debian.tar.xz /licenses/strongswan-source/strongswan_6.0.4-1ubuntu3.2.debian.tar.xz +ADD --checksum=sha256:ee6958695eaf9f486e7c5eabb90232ed15bf54df054c82d2836ed00f71d82d94 https://snapshot.ubuntu.com/ubuntu/20261023T000000Z/pool/main/s/strongswan/strongswan_6.0.4-1ubuntu3.2.dsc /licenses/strongswan-source/strongswan_6.0.4-1ubuntu3.2.dsc ARG IMAGE_VERSION=dev ARG IMAGE_REVISION=unknown -ARG STRONGSWAN_ORIG_SHA256=79576bb61b9a406cea9eb73d0c565cc6254a6b6d2e7198f44758d2d7c61a7aec -ARG STRONGSWAN_DEBIAN_SHA256=2813fea68dc93da2c17cc0c7c8a30e39b61dba333c8bdf7a7e0ce7c6e9d01879 -ARG STRONGSWAN_DSC_SHA256=64c7e3ad1d44ff5b5e287cf02a65e4b51b351a854a2773d90fbb4a2ff8f1f39b ARG CNI_VERSION=v0.3.0 ARG CNI_SHA256=b1ae09833a238c51161918a8849031efdb46cf0068ea5b752e362d9836e2af7d ARG CNI_BRIDGE_VERSION=v0.7.2 @@ -65,17 +65,15 @@ RUN set -eux; \ for package in openssl libssl3t64 openssl-provider-legacy; do \ test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \ done; \ - mkdir -p /licenses/strongswan-source; \ - cd /licenses/strongswan-source; \ - apt-get source --download-only strongswan="${UBUNTU_APT_STRONGSWAN_VERSION}"; \ - echo "${STRONGSWAN_ORIG_SHA256} strongswan_6.0.4.orig.tar.bz2" | sha256sum -c -; \ - echo "${STRONGSWAN_DEBIAN_SHA256} strongswan_${UBUNTU_APT_STRONGSWAN_VERSION}.debian.tar.xz" | sha256sum -c -; \ - echo "${STRONGSWAN_DSC_SHA256} strongswan_${UBUNTU_APT_STRONGSWAN_VERSION}.dsc" | sha256sum -c -; \ + sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ + for package in libstrongswan libstrongswan-extra-plugins libstrongswan-standard-plugins strongswan-charon strongswan-libcharon strongswan-swanctl; do \ + test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_STRONGSWAN_SECURITY_VERSION}"; \ + done; \ + test "$(dpkg-query -W -f='${Version}' systemd-standalone-sysusers)" = '259.5-0ubuntu3.4'; \ mkdir -p /licenses/ubuntu-packages; \ for package in strongswan-charon strongswan-swanctl libstrongswan-standard-plugins libstrongswan-extra-plugins; do \ cp "/usr/share/doc/${package}/copyright" "/licenses/ubuntu-packages/${package}-copyright"; \ done; \ - sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ apt-cache showsrc strongswan | grep -Fx "Version: ${UBUNTU_APT_STRONGSWAN_VERSION}"; \ dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ { printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; } \ diff --git a/security/install-ubuntu-security-updates.sh b/security/install-ubuntu-security-updates.sh index 7fd1afe..8429de9 100644 --- a/security/install-ubuntu-security-updates.sh +++ b/security/install-ubuntu-security-updates.sh @@ -27,7 +27,7 @@ while IFS= read -r entry || test -n "$entry"; do done < "$lock" if test "$#" -gt 0; then mkdir -p "$tmp/lists/partial" - printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/20261023T000000Z\nSuites: resolute-updates resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' > "$tmp/security.sources" + printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/20261023T000000Z\nSuites: resolute-updates resolute-security\nComponents: main universe\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' > "$tmp/security.sources" apt_security() { apt-get -o Dir::State::lists="$tmp/lists" \ -o Dir::Cache::pkgcache="$tmp/pkgcache.bin" \ diff --git a/security/ubuntu-security-packages.lock b/security/ubuntu-security-packages.lock index 848640b..2c40096 100644 --- a/security/ubuntu-security-packages.lock +++ b/security/ubuntu-security-packages.lock @@ -36,3 +36,10 @@ libssh2-1t64=1.11.1-1ubuntu0.26.04.4 libcurl3t64-gnutls=8.18.0-1ubuntu2.8 libc-dev-bin=2.43-2ubuntu2.4 libexpat1=2.7.4-1ubuntu0.2 +libstrongswan=6.0.4-1ubuntu3.2 +libstrongswan-extra-plugins=6.0.4-1ubuntu3.2 +libstrongswan-standard-plugins=6.0.4-1ubuntu3.2 +strongswan-charon=6.0.4-1ubuntu3.2 +strongswan-libcharon=6.0.4-1ubuntu3.2 +strongswan-swanctl=6.0.4-1ubuntu3.2 +systemd-standalone-sysusers=259.5-0ubuntu3.4 diff --git a/tests/test_full_severity_security_contract.py b/tests/test_full_severity_security_contract.py new file mode 100644 index 0000000..e8d923e --- /dev/null +++ b/tests/test_full_severity_security_contract.py @@ -0,0 +1,46 @@ +"""Prevent a published runtime from bypassing fixed LOW/MEDIUM findings.""" +from pathlib import Path +import unittest + +ROOT = Path(__file__).resolve().parents[1] + +class FullSeverityContract(unittest.TestCase): + def test_candidate_and_release_scan_all_severities_and_enforce_policy(self): + for name in ("security-release-gate.yml", "release.yml"): + source = (ROOT / ".github/workflows" / name).read_text(encoding="utf-8") + self.assertNotIn("--severity CRITICAL,HIGH", source) + self.assertIn("--severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL", source) + self.assertIn(".github/scripts/enforce-runtime-vulnerabilities.py", source) + self.assertIn("dapper-nonheader-security.json", source) + policy = (ROOT / ".github/scripts/enforce-runtime-vulnerabilities.py").read_text(encoding="utf-8") + self.assertIn(".github/runtime-unfixed.json", policy) + self.assertIn(".github/dapper-unfixed.json", policy) + release = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8") + self.assertLess(release.index(".github/scripts/enforce-runtime-vulnerabilities.py"), + release.index("- name: Publish a new tag")) + + def test_builder_filter_is_exact_and_never_replaces_raw_evidence(self): + source = (ROOT / ".github/workflows/security-release-gate.yml").read_text(encoding="utf-8") + self.assertIn("pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", source) + self.assertIn("select(.PkgIdentifier.PURL != $purl)", source) + self.assertIn("evidence/dapper-security.json > evidence/dapper-nonheader-security.json", source) + self.assertIn("linux-libc-dev must not be shipped in the runtime image", source) + + def test_compiled_products_are_identified_by_rootfs_analyzer(self): + source = (ROOT / ".github/workflows/security-release-gate.yml").read_text(encoding="utf-8") + self.assertIn('run_path_scan rootfs "$product_tree" product-security.json', source) + self.assertIn('--scanners vuln,secret --list-all-pkgs', source) + for name in ("security-release-gate.yml", "release.yml"): + workflow = (ROOT / ".github/workflows" / name).read_text(encoding="utf-8") + self.assertIn('.Type == "gobinary" and .Target == $binary', workflow) + self.assertIn('.Packages[]?] | length > 0', workflow) + + def test_only_reviewed_strongswan_and_sysusers_versions_are_overlaid(self): + lock = (ROOT / "security/ubuntu-security-packages.lock").read_text(encoding="utf-8") + for package in ("libstrongswan", "libstrongswan-extra-plugins", "libstrongswan-standard-plugins", + "strongswan-charon", "strongswan-libcharon", "strongswan-swanctl"): + self.assertIn(package + "=6.0.4-1ubuntu3.2\n", lock) + self.assertIn("systemd-standalone-sysusers=259.5-0ubuntu3.4\n", lock) + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_openssl_package_contract.py b/tests/test_openssl_package_contract.py index d374980..e28ba39 100644 --- a/tests/test_openssl_package_contract.py +++ b/tests/test_openssl_package_contract.py @@ -100,11 +100,22 @@ def test_formal_security_gate_executes_contract(self): self.assertLess(workflow.index("python3 tests/test_openssl_package_contract.py"), workflow.index("name: Package the candidate runtime image")) - def test_source_archives_precede_security_index_overlay(self): + def test_security_source_archives_match_the_patched_strongswan_package(self): source = self.sources["package/Dockerfile"] overlay = source.index(" sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh") - self.assertLess(source.index("apt-get source --download-only strongswan="), overlay) - self.assertLess(source.index('echo "${STRONGSWAN_DSC_SHA256}'), overlay) + archives = { + "strongswan_6.0.4.orig.tar.bz2": "79576bb61b9a406cea9eb73d0c565cc6254a6b6d2e7198f44758d2d7c61a7aec", + "strongswan_6.0.4-1ubuntu3.2.debian.tar.xz": "1f6cfddbefa64298e0cd7dbfcf8dde7eb0b81f708a70f180698a9addbc77e631", + "strongswan_6.0.4-1ubuntu3.2.dsc": "ee6958695eaf9f486e7c5eabb90232ed15bf54df054c82d2836ed00f71d82d94", + } + for archive, digest in archives.items(): + line = ("ADD --checksum=sha256:" + digest + + " https://snapshot.ubuntu.com/ubuntu/20261023T000000Z/pool/main/s/strongswan/" + + archive + " /licenses/strongswan-source/" + archive) + self.assertIn(line, source) + self.assertNotIn("apt-get source --download-only", source) + self.assertLess(overlay, source.index('cp "/usr/share/doc/${package}/copyright"')) + self.assertIn("${UBUNTU_APT_STRONGSWAN_SECURITY_VERSION}", source) self.assertLess(overlay, source.index("/licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv")) def test_security_indexes_are_isolated_and_original_source_remains_readable(self): diff --git a/ubuntu-apt.lock b/ubuntu-apt.lock index a32a891..30ad276 100644 --- a/ubuntu-apt.lock +++ b/ubuntu-apt.lock @@ -26,6 +26,7 @@ UBUNTU_APT_NFTABLES_VERSION='1.1.6-1' UBUNTU_APT_OPENSSL_VERSION='3.5.5-1ubuntu3.6' UBUNTU_APT_PSMISC_VERSION='23.7-2ubuntu2' UBUNTU_APT_STRONGSWAN_VERSION='6.0.4-1ubuntu3.1' +UBUNTU_APT_STRONGSWAN_SECURITY_VERSION='6.0.4-1ubuntu3.2' UBUNTU_APT_TAR_VERSION='1.35+dfsg-4ubuntu0.4' UBUNTU_APT_UTIL_LINUX_VERSION='2.41.3-3ubuntu2' UBUNTU_APT_XZ_UTILS_VERSION='5.8.3-1'