From 1bf4eab02c87da7e3f92c78ba78fce467670b5be Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 21:52:49 +0800 Subject: [PATCH 1/3] ci: retain the canonical checked runtime publisher --- .github/workflows/supply-chain.yml | 46 ------------------------------ README.md | 7 +++++ 2 files changed, 7 insertions(+), 46 deletions(-) diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index e9a95e7..31cfe83 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -377,49 +377,3 @@ jobs: done docker builder prune --all --force >/dev/null rm -rf bin dist evidence "$trivy_cache" - publish: - if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' - needs: verify - runs-on: ubuntu-24.04 - timeout-minutes: 30 - permissions: - contents: write - actions: read - packages: write - env: - GH_TOKEN: ${{ github.token }} - RELEASE_TAG: v0.8.20 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - persist-credentials: false - - name: Publish only this run's verified immutable runtime - shell: bash - run: | - set -euo pipefail - test "$(git rev-parse HEAD)" = "$GITHUB_SHA" - test "$(git rev-parse "refs/tags/$RELEASE_TAG^{}")" = "$GITHUB_SHA" - gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "security-runtime-$GITHUB_SHA" --dir dist/security-runtime - test "$(cat dist/security-runtime/source-revision.txt)" = "$GITHUB_SHA" - (cd dist/security-runtime && sha256sum --check SHA256SUMS) - gzip -dc dist/security-runtime/images.tar.gz | docker load - printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin - trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT - : > dist/security-runtime/registry-images.jsonl - local_image='ghcr.io/pasturestack/resource-scheduler:v0.8.20' - remote_image="ghcr.io/pasturestack/resource-scheduler:$RELEASE_TAG" - if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then - echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1 - else - grep -Eq 'manifest unknown|no such manifest' "$RUNNER_TEMP/manifest-error" - fi - docker tag "$local_image" "$remote_image" - docker push "$remote_image" | tee "$RUNNER_TEMP/push-log" - pushed=$(awk '/digest: sha256:/{for(i=1;i<=NF;i++) if($i=="digest:") print $(i+1)}' "$RUNNER_TEMP/push-log") - readback=$(docker buildx imagetools inspect "$remote_image" | awk '$1=="Digest:"{print $2; exit}') - test "$pushed" = "$readback" - [[ "$readback" =~ ^sha256:[0-9a-f]{64}$ ]] - jq -n --arg image "$remote_image" --arg digest "$readback" --arg source "$GITHUB_SHA" '{image:$image,digest:$digest,source:$source}' >> dist/security-runtime/registry-images.jsonl - sha256sum dist/security-runtime/registry-images.jsonl > dist/security-runtime/registry-images.sha256 - gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$GITHUB_REPOSITORY $RELEASE_TAG" --notes "Official security rebuild from $GITHUB_SHA. The release contains the exact tested/scanned runtime archive, SBOMs, and registry digest readbacks. No deployment is included." dist/security-runtime/* diff --git a/README.md b/README.md index e9fce9e..c65a547 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,12 @@ # PastureStack Resource Scheduler +The current published release is [v0.8.20](https://github.com/PastureStack/resource-scheduler/releases/tag/v0.8.20), +produced from `35d3a67c62df4b22d7167da3d73dd9dbc4905e66` by the existing +[release workflow](https://github.com/PastureStack/resource-scheduler/actions/runs/39961862641). +Its runtime digest is `sha256:e5a389273344585fca5c4513060e5289b30ca13046d8ec286b8563952f1325d4`. +Only `release.yml` publishes; `supply-chain.yml` retains verification evidence +without a second publisher. Later source changes do not replace released bytes. + Resource Scheduler is the control-plane daemon that tracks host capacity, labels, and host-port reservations. It consumes the dated metadata API, handles scheduling events, ranks eligible hosts, reserves and releases resources, and exposes the health endpoint used by the infrastructure catalog. PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE. From dceeeaf16b47de6f586692a48d63390b83817c24 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:14:05 +0800 Subject: [PATCH 2/3] Enforce complete runtime findings before immutable publication --- .github/runtime-unfixed.json | 566 ++++++++++++++++++ .../enforce-runtime-vulnerabilities.py | 58 ++ .../test_runtime_vulnerability_policy.py | 77 +++ README.md | 10 + scripts/assess-runtime-vulnerabilities | 5 + 5 files changed, 716 insertions(+) create mode 100644 .github/runtime-unfixed.json create mode 100644 .github/scripts/enforce-runtime-vulnerabilities.py create mode 100644 .github/scripts/test_runtime_vulnerability_policy.py diff --git a/.github/runtime-unfixed.json b/.github/runtime-unfixed.json new file mode 100644 index 0000000..bcb588d --- /dev/null +++ b/.github/runtime-unfixed.json @@ -0,0 +1,566 @@ +{ + "repository": "PastureStack/resource-scheduler", + "unfixed": [ + { + "severity": "MEDIUM", + "package": "dash", + "id": "CVE-2026-102473", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.5.12-12ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102473", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "dash", + "id": "CVE-2026-102474", + "purl": "pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "0.5.12-12ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-102474", + "reason": "Canonical Ubuntu 26.04 status: resolute_dash: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-bin", + "id": "CVE-2026-18374", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-bin", + "id": "CVE-2026-89092", + "purl": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-gconv-modules-extra", + "id": "CVE-2026-18374", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc-gconv-modules-extra", + "id": "CVE-2026-89092", + "purl": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc6", + "id": "CVE-2026-18374", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18374", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libc6", + "id": "CVE-2026-89092", + "purl": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04", + "version": "2.43-2ubuntu2.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89092", + "reason": "Canonical Ubuntu 26.04 status: resolute_glibc: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libgnutls30t64", + "id": "CVE-2026-67693", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "version": "3.8.12-2ubuntu1.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-67693", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libgnutls30t64", + "id": "CVE-2026-88647", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "version": "3.8.12-2ubuntu1.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88647", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libgnutls30t64", + "id": "CVE-2026-88648", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "version": "3.8.12-2ubuntu1.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-88648", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libgnutls30t64", + "id": "CVE-2026-95184", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "version": "3.8.12-2ubuntu1.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95184", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libgnutls30t64", + "id": "CVE-2026-95209", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "version": "3.8.12-2ubuntu1.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95209", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libgnutls30t64", + "id": "CVE-2026-95210", + "purl": "pkg:deb/ubuntu/libgnutls30t64@3.8.12-2ubuntu1.1?arch=amd64&distro=ubuntu-26.04", + "version": "3.8.12-2ubuntu1.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-95210", + "reason": "Canonical Ubuntu 26.04 status: resolute_gnutls28: deferred (2026-10-15). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libp11-kit0", + "id": "CVE-2026-13757", + "purl": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04", + "version": "0.26.2-2", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-13757", + "reason": "Canonical Ubuntu 26.04 status: resolute_p11-kit: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-103111", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-103111", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-86145", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-86145", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89156", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89156", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89157", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89157", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89158", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89158", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89160", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89160", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89161", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89161", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libpcre2-8-0", + "id": "CVE-2026-89162", + "purl": "pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04", + "version": "10.46-1build1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-89162", + "reason": "Canonical Ubuntu 26.04 status: resolute_pcre2: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libsasl2-2", + "id": "CVE-2026-107161", + "purl": "pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "2.1.28+dfsg1-9ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "libsasl2-modules-db", + "id": "CVE-2026-107161", + "purl": "pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-9ubuntu3?arch=amd64&distro=ubuntu-26.04", + "version": "2.1.28+dfsg1-9ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-107161", + "reason": "Canonical Ubuntu 26.04 status: resolute_cyrus-sasl2: deferred (2026-10-14). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "libsystemd0", + "id": "CVE-2026-40228", + "purl": "pkg:deb/ubuntu/libsystemd0@259.9-0ubuntu0.1?arch=amd64&distro=ubuntu-26.04", + "version": "259.9-0ubuntu0.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "libudev1", + "id": "CVE-2026-40228", + "purl": "pkg:deb/ubuntu/libudev1@259.9-0ubuntu0.1?arch=amd64&distro=ubuntu-26.04", + "version": "259.9-0ubuntu0.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-40228", + "reason": "Canonical Ubuntu 26.04 status: resolute_systemd: deferred (2026-06-05). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "login.defs", + "id": "CVE-2024-56433", + "purl": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1", + "version": "1:4.17.4-2ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "LOW", + "package": "passwd", + "id": "CVE-2024-56433", + "purl": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1", + "version": "1:4.17.4-2ubuntu3", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2024-56433", + "reason": "Canonical Ubuntu 26.04 status: resolute_shadow: deferred (2026-08-31). No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35341", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35341", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35344", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35344", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35345", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35345", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35348", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35348", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35350", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35350", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35351", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35351", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35352", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35352", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35354", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35354", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35357", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35357", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35359", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35359", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35360", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35360", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35363", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35363", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35364", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35364", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35367", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35367", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35368", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35368", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35370", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35370", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35371", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35371", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35373", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35373", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35374", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35374", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "rust-coreutils", + "id": "CVE-2026-35377", + "purl": "pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04", + "version": "0.10.0-1ubuntu2~26.04.1", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-35377", + "reason": "Canonical Ubuntu 26.04 status: resolute_rust-coreutils: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "tar", + "id": "CVE-2026-18477", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "version": "1.35+dfsg-4ubuntu0.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18477", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + }, + { + "severity": "MEDIUM", + "package": "tar", + "id": "CVE-2026-18508", + "purl": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04", + "version": "1.35+dfsg-4ubuntu0.4", + "status": "no_official_fix", + "officialEvidence": "https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2026-18508", + "reason": "Canonical Ubuntu 26.04 status: resolute_tar: needed. No official resolute fixed package is available; keep tracking.", + "checkedAt": "2026-10-23" + } + ] +} diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py new file mode 100644 index 0000000..383356b --- /dev/null +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -0,0 +1,58 @@ +"""Enforce release findings; only exact, reviewed unfixed low/medium entries may pass.""" +import argparse +import json +from pathlib import Path + + +def violations(report, ledger, repository): + if (not isinstance(report, dict) or report.get("SchemaVersion") != 2 + or not isinstance(report.get("Results"), list) or not report["Results"]): + raise ValueError("missing or malformed Trivy scan results") + for result in report["Results"]: + if not isinstance(result, dict) or not isinstance(result.get("Target"), str): + raise ValueError("malformed Trivy result") + for key in ("Vulnerabilities", "Secrets"): + if key in result and result[key] is not None and not isinstance(result[key], list): + raise ValueError("malformed Trivy findings") + if ledger.get("repository") != repository: + raise ValueError("allowlist repository mismatch") + reviewed = {} + for entry in ledger.get("unfixed", []): + key = (entry["id"], entry["package"], entry["version"], entry.get("purl", "")) + if key in reviewed: + raise ValueError("duplicate reviewed finding") + if (entry.get("severity") not in ("LOW", "MEDIUM") + or entry.get("status") != "no_official_fix" + or not entry.get("officialEvidence", "").startswith("https://") + or not entry.get("reason") or not entry.get("checkedAt")): + raise ValueError("incomplete official no-fix evidence") + reviewed[key] = entry + errors = [] + for result in report.get("Results") or []: + if result.get("Secrets"): + errors.append("secret findings remain") + for finding in result.get("Vulnerabilities") or []: + severity = finding.get("Severity", "UNKNOWN") + key = (finding.get("VulnerabilityID"), finding.get("PkgName"), + finding.get("InstalledVersion"), + (finding.get("PkgIdentifier") or {}).get("PURL", "")) + entry = reviewed.get(key) + fixed = str(finding.get("FixedVersion") or "").strip() + if (severity not in ("LOW", "MEDIUM") or fixed + or entry is None or entry["severity"] != severity): + errors.append("%s %s@%s severity=%s fixed=%s" % ( + key[0], key[1], key[2], severity, fixed or "none")) + return errors + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + parser.add_argument("report") + parser.add_argument("ledger") + parser.add_argument("--repository", required=True) + args = parser.parse_args() + failures = violations(json.loads(Path(args.report).read_text()), + json.loads(Path(args.ledger).read_text()), args.repository) + if failures: + raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) + print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/.github/scripts/test_runtime_vulnerability_policy.py b/.github/scripts/test_runtime_vulnerability_policy.py new file mode 100644 index 0000000..f1683fc --- /dev/null +++ b/.github/scripts/test_runtime_vulnerability_policy.py @@ -0,0 +1,77 @@ +import copy +import importlib.util +import pathlib +import unittest + +PATH = pathlib.Path(__file__).with_name('enforce-runtime-vulnerabilities.py') +SPEC = importlib.util.spec_from_file_location('gate', PATH) +GATE = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(GATE) +REPO = 'PastureStack/network-policy-manager' + + +class RuntimePolicy(unittest.TestCase): + def setUp(self): + self.finding = {'VulnerabilityID': 'TEST-1', 'PkgName': 'lib', 'InstalledVersion': '1', + 'Severity': 'MEDIUM', 'FixedVersion': '', + 'PkgIdentifier': {'PURL': 'pkg:test/lib@1'}} + self.report = {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': [self.finding]}]} + self.ledger = {'repository': REPO, 'unfixed': [{'id': 'TEST-1', 'package': 'lib', + 'version': '1', 'severity': 'MEDIUM', 'purl': 'pkg:test/lib@1', + 'status': 'no_official_fix', 'officialEvidence': 'https://fixture.invalid/advisory', + 'reason': 'Test fixture only', 'checkedAt': '2026-10-23'}]} + + def test_exact_reviewed_unfixed_medium_passes(self): + self.assertEqual(GATE.violations(self.report, self.ledger, REPO), []) + + def test_clean_scan_passes(self): + self.assertEqual(GATE.violations({'SchemaVersion': 2, 'Results': [{'Target': 'fixture'}]}, + {'repository': REPO, 'unfixed': []}, REPO), []) + + def test_missing_or_malformed_scan_fails_closed(self): + for report in ({}, {'Results': []}, {'SchemaVersion': 2, 'Results': []}, + {'SchemaVersion': 2, 'Results': [{}]}, + {'SchemaVersion': 2, 'Results': [{'Target': 'fixture', 'Vulnerabilities': {}}]}): + with self.assertRaises(ValueError): + GATE.violations(report, self.ledger, REPO) + + def test_unregistered_medium_blocks(self): + self.ledger['unfixed'] = [] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_medium_blocks(self): + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_fixed_low_blocks(self): + self.finding['Severity'] = 'LOW' + self.ledger['unfixed'][0]['severity'] = 'LOW' + self.finding['FixedVersion'] = '2' + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_high_critical_and_unknown_always_block(self): + for severity in ('HIGH', 'CRITICAL', 'UNKNOWN'): + self.finding['Severity'] = severity + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_version_or_purl_drift_blocks(self): + for key in ('version', 'purl'): + ledger = copy.deepcopy(self.ledger) + ledger['unfixed'][0][key] = 'different' + self.assertTrue(GATE.violations(self.report, ledger, REPO)) + + def test_secrets_always_block(self): + self.report['Results'][0]['Secrets'] = [{'RuleID': 'test'}] + self.assertTrue(GATE.violations(self.report, self.ledger, REPO)) + + def test_repository_drift_fails_closed(self): + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, 'another/repo') + + def test_incomplete_evidence_fails_closed(self): + del self.ledger['unfixed'][0]['checkedAt'] + with self.assertRaises(ValueError): + GATE.violations(self.report, self.ledger, REPO) + +if __name__ == '__main__': + unittest.main() diff --git a/README.md b/README.md index c65a547..3775549 100644 --- a/README.md +++ b/README.md @@ -93,3 +93,13 @@ The inherited project remains licensed under [Apache License 2.0](LICENSE). Past ## October 2026 security maintenance Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned `ca-certificates 20260816ubuntu0.26.04.1` security package after their frozen APT baseline; the final trust store and installed version are verified. Release artifacts must pass the repository's existing checks before publication. + +## Full-severity release policy + +Release verification retains the complete runtime vulnerability report. Every +finding with an official fix blocks release, regardless of severity. Unknown +findings block unless a separately reviewed, exact not-affected statement is +proved by the actual product dependency graph. LOW/MEDIUM findings without an +official fix require the repository's exact CVE/package/version/PURL review ledger; +new or changed findings fail closed. This policy-only update does not replace any +already published immutable artifact. diff --git a/scripts/assess-runtime-vulnerabilities b/scripts/assess-runtime-vulnerabilities index bcd0bd3..cb01ddc 100644 --- a/scripts/assess-runtime-vulnerabilities +++ b/scripts/assess-runtime-vulnerabilities @@ -5,6 +5,11 @@ report=${1:?usage: assess-runtime-vulnerabilities REPORT_JSON OUTPUT_DIR SUBJECT output_dir=${2:?usage: assess-runtime-vulnerabilities REPORT_JSON OUTPUT_DIR SUBJECT} subject=${3:?usage: assess-runtime-vulnerabilities REPORT_JSON OUTPUT_DIR SUBJECT} +repo_root=$(cd "$(dirname "$0")/.." && pwd) +python3 "$repo_root/.github/scripts/enforce-runtime-vulnerabilities.py" \ + "$report" "$repo_root/.github/runtime-unfixed.json" \ + --repository PastureStack/resource-scheduler + mkdir -p "${output_dir}" total=$(jq '[.Results[]?.Vulnerabilities[]?] | length' "${report}") From 11b323e6c11473831f9057e5febe41ee93e5b4de Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:32:05 +0800 Subject: [PATCH 3/3] Constrain policy input to stdin and repository-owned ledger --- .github/scripts/enforce-runtime-vulnerabilities.py | 7 +++---- scripts/assess-runtime-vulnerabilities | 4 +--- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/.github/scripts/enforce-runtime-vulnerabilities.py b/.github/scripts/enforce-runtime-vulnerabilities.py index 383356b..b952eee 100644 --- a/.github/scripts/enforce-runtime-vulnerabilities.py +++ b/.github/scripts/enforce-runtime-vulnerabilities.py @@ -1,6 +1,7 @@ """Enforce release findings; only exact, reviewed unfixed low/medium entries may pass.""" import argparse import json +import sys from pathlib import Path @@ -47,12 +48,10 @@ def violations(report, ledger, repository): if __name__ == "__main__": parser = argparse.ArgumentParser() - parser.add_argument("report") - parser.add_argument("ledger") parser.add_argument("--repository", required=True) args = parser.parse_args() - failures = violations(json.loads(Path(args.report).read_text()), - json.loads(Path(args.ledger).read_text()), args.repository) + failures = violations(json.load(sys.stdin), + json.loads((Path(__file__).resolve().parents[1] / "runtime-unfixed.json").read_text(encoding="utf-8")), args.repository) if failures: raise SystemExit("Release vulnerability policy failed:\n" + "\n".join(failures)) print("RELEASE_VULNERABILITY_POLICY_OK") diff --git a/scripts/assess-runtime-vulnerabilities b/scripts/assess-runtime-vulnerabilities index cb01ddc..82ad9a0 100644 --- a/scripts/assess-runtime-vulnerabilities +++ b/scripts/assess-runtime-vulnerabilities @@ -6,9 +6,7 @@ output_dir=${2:?usage: assess-runtime-vulnerabilities REPORT_JSON OUTPUT_DIR SUB subject=${3:?usage: assess-runtime-vulnerabilities REPORT_JSON OUTPUT_DIR SUBJECT} repo_root=$(cd "$(dirname "$0")/.." && pwd) -python3 "$repo_root/.github/scripts/enforce-runtime-vulnerabilities.py" \ - "$report" "$repo_root/.github/runtime-unfixed.json" \ - --repository PastureStack/resource-scheduler +python3 "$repo_root/.github/scripts/enforce-runtime-vulnerabilities.py" --repository PastureStack/resource-scheduler < "$report" mkdir -p "${output_dir}"