From d9469a7c9045b94c1ed55439cdbffec586115fc9 Mon Sep 17 00:00:00 2001 From: yuqei Date: Sun, 20 Sep 2026 15:00:30 +0800 Subject: [PATCH] release: correct RC-04 vulnerability waiver versions --- .../linux-release-security-policy.v1.json | 68 ++++++- yuqei-infra/scripts/linux_release_common.py | 52 ++++- .../tests/test_linux_release_build_tools.py | 181 +++++++++++++++++- 3 files changed, 271 insertions(+), 30 deletions(-) diff --git a/yuqei-infra/release/linux-release-security-policy.v1.json b/yuqei-infra/release/linux-release-security-policy.v1.json index d1a62037..bd78a18c 100644 --- a/yuqei-infra/release/linux-release-security-policy.v1.json +++ b/yuqei-infra/release/linux-release-security-policy.v1.json @@ -169,7 +169,7 @@ }, "exemptions": [ { - "id": "RC04.4-DEBIAN13-PYTHON-UNFIXED-HIGH-001", + "id": "RC04.6-DEBIAN13-PYTHON-UNFIXED-HIGH-001", "expires_at": "2026-10-20T00:00:00Z", "scope": { "roles": [ @@ -212,62 +212,110 @@ { "vulnerability_id": "CVE-2026-76642", "package_names": [ - "bsdutils", + "bsdutils" + ], + "installed_version": "1:2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-76642", + "package_names": [ "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux" ], + "installed_version": "2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-76642", + "package_names": [ + "login" + ], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-78408", + "package_names": [ + "bsdutils" + ], "installed_version": "1:2.41.5-0+deb13u1" }, { "vulnerability_id": "CVE-2026-78408", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux" ], + "installed_version": "2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-78408", + "package_names": [ + "login" + ], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-78409", + "package_names": [ + "bsdutils" + ], "installed_version": "1:2.41.5-0+deb13u1" }, { "vulnerability_id": "CVE-2026-78409", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux" ], + "installed_version": "2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-78409", + "package_names": [ + "login" + ], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-78410", + "package_names": [ + "bsdutils" + ], "installed_version": "1:2.41.5-0+deb13u1" }, { "vulnerability_id": "CVE-2026-78410", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux" ], - "installed_version": "1:2.41.5-0+deb13u1" + "installed_version": "2.41.5-0+deb13u1" + }, + { + "vulnerability_id": "CVE-2026-78410", + "package_names": [ + "login" + ], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1" }, { "vulnerability_id": "CVE-2026-9538", diff --git a/yuqei-infra/scripts/linux_release_common.py b/yuqei-infra/scripts/linux_release_common.py index e2cdcfe7..e6206b08 100644 --- a/yuqei-infra/scripts/linux_release_common.py +++ b/yuqei-infra/scripts/linux_release_common.py @@ -110,7 +110,7 @@ _WINDOWS_GIT_EXECUTABLE = ( ) VULNERABILITY_WAIVERS = [ { - "id": "RC04.4-DEBIAN13-PYTHON-UNFIXED-HIGH-001", + "id": "RC04.6-DEBIAN13-PYTHON-UNFIXED-HIGH-001", "expires_at": "2026-10-20T00:00:00Z", "scope": { "roles": ["contract-api", "ai-platform-api", "ai-worker"], @@ -136,65 +136,97 @@ VULNERABILITY_WAIVERS = [ "package_names": ["libacl1"], "installed_version": "2.3.2-2+b1", }, + { + "vulnerability_id": "CVE-2026-76642", + "package_names": ["bsdutils"], + "installed_version": "1:2.41.5-0+deb13u1", + }, { "vulnerability_id": "CVE-2026-76642", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux", ], + "installed_version": "2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-76642", + "package_names": ["login"], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-78408", + "package_names": ["bsdutils"], "installed_version": "1:2.41.5-0+deb13u1", }, { "vulnerability_id": "CVE-2026-78408", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux", ], + "installed_version": "2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-78408", + "package_names": ["login"], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-78409", + "package_names": ["bsdutils"], "installed_version": "1:2.41.5-0+deb13u1", }, { "vulnerability_id": "CVE-2026-78409", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux", ], + "installed_version": "2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-78409", + "package_names": ["login"], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-78410", + "package_names": ["bsdutils"], "installed_version": "1:2.41.5-0+deb13u1", }, { "vulnerability_id": "CVE-2026-78410", "package_names": [ - "bsdutils", "libblkid1", "liblastlog2-2", "libmount1", "libsmartcols1", "libuuid1", - "login", "mount", "util-linux", ], - "installed_version": "1:2.41.5-0+deb13u1", + "installed_version": "2.41.5-0+deb13u1", + }, + { + "vulnerability_id": "CVE-2026-78410", + "package_names": ["login"], + "installed_version": "1:4.16.0-2+really2.41.5-0+deb13u1", }, { "vulnerability_id": "CVE-2026-9538", diff --git a/yuqei-infra/tests/test_linux_release_build_tools.py b/yuqei-infra/tests/test_linux_release_build_tools.py index 122f7d28..a169db60 100644 --- a/yuqei-infra/tests/test_linux_release_build_tools.py +++ b/yuqei-infra/tests/test_linux_release_build_tools.py @@ -407,18 +407,106 @@ def _scan( } -def _waived_python_vulnerabilities() -> list[dict[str, Any]]: - waiver = common.VULNERABILITY_WAIVERS[0] +def _captured_python_base_vulnerabilities() -> list[dict[str, Any]]: + # Independent fixture captured from the pinned Python base image. Do not + # derive this from the waiver under test: Debian packages sharing one CVE + # can carry different epoch-qualified installed versions. + findings = [ + ( + "CVE-2025-69720", + "6.5+20250216-2", + ["libncursesw6", "libtinfo6", "ncurses-base", "ncurses-bin"], + ), + ("CVE-2026-16742", "257.13-1~deb13u1", ["libsystemd0", "libudev1"]), + ("CVE-2026-54369", "2.3.2-2+b1", ["libacl1"]), + ("CVE-2026-76642", "1:2.41.5-0+deb13u1", ["bsdutils"]), + ( + "CVE-2026-76642", + "2.41.5-0+deb13u1", + [ + "libblkid1", + "liblastlog2-2", + "libmount1", + "libsmartcols1", + "libuuid1", + "mount", + "util-linux", + ], + ), + ( + "CVE-2026-76642", + "1:4.16.0-2+really2.41.5-0+deb13u1", + ["login"], + ), + ("CVE-2026-78408", "1:2.41.5-0+deb13u1", ["bsdutils"]), + ( + "CVE-2026-78408", + "2.41.5-0+deb13u1", + [ + "libblkid1", + "liblastlog2-2", + "libmount1", + "libsmartcols1", + "libuuid1", + "mount", + "util-linux", + ], + ), + ( + "CVE-2026-78408", + "1:4.16.0-2+really2.41.5-0+deb13u1", + ["login"], + ), + ("CVE-2026-78409", "1:2.41.5-0+deb13u1", ["bsdutils"]), + ( + "CVE-2026-78409", + "2.41.5-0+deb13u1", + [ + "libblkid1", + "liblastlog2-2", + "libmount1", + "libsmartcols1", + "libuuid1", + "mount", + "util-linux", + ], + ), + ( + "CVE-2026-78409", + "1:4.16.0-2+really2.41.5-0+deb13u1", + ["login"], + ), + ("CVE-2026-78410", "1:2.41.5-0+deb13u1", ["bsdutils"]), + ( + "CVE-2026-78410", + "2.41.5-0+deb13u1", + [ + "libblkid1", + "liblastlog2-2", + "libmount1", + "libsmartcols1", + "libuuid1", + "mount", + "util-linux", + ], + ), + ( + "CVE-2026-78410", + "1:4.16.0-2+really2.41.5-0+deb13u1", + ["login"], + ), + ("CVE-2026-9538", "5.40.1-6+deb13u1", ["perl-base"]), + ] return [ { - "VulnerabilityID": finding["vulnerability_id"], + "VulnerabilityID": vulnerability_id, "PkgName": package_name, - "InstalledVersion": finding["installed_version"], + "InstalledVersion": installed_version, "FixedVersion": "", "Severity": "HIGH", } - for finding in waiver["findings"] - for package_name in finding["package_names"] + for vulnerability_id, installed_version, package_names in findings + for package_name in package_names ] @@ -816,8 +904,10 @@ def test_policy_pins_exact_linux_toolchain_and_zero_vulnerability_thresholds() - assert policy["vulnerability_scan"]["ignore_unfixed"] is False assert policy["vulnerability_scan"]["exemptions"] == common.VULNERABILITY_WAIVERS waiver = policy["vulnerability_scan"]["exemptions"][0] + assert waiver["id"] == "RC04.6-DEBIAN13-PYTHON-UNFIXED-HIGH-001" assert waiver["expires_at"] == "2026-10-20T00:00:00Z" assert waiver["scope"]["roles"] == ["contract-api", "ai-platform-api", "ai-worker"] + assert len(waiver["findings"]) == 16 assert sum(len(item["package_names"]) for item in waiver["findings"]) == 44 assert ( policy["vulnerability_scan"]["database"]["repository_transport"] @@ -1560,8 +1650,28 @@ def test_trivy_scan_fails_closed_on_parse_error_or_high_critical() -> None: def test_trivy_scan_allows_only_exact_unfixed_python_waiver_occurrences() -> None: policy = common.load_policy(POLICY_PATH) - vulnerabilities = _waived_python_vulnerabilities() - assert len(vulnerabilities) == 44 + vulnerabilities = _captured_python_base_vulnerabilities() + fixture_keys = [ + ( + item["VulnerabilityID"], + item["PkgName"], + item["InstalledVersion"], + ) + for item in vulnerabilities + ] + waiver_keys = [ + ( + finding["vulnerability_id"], + package_name, + finding["installed_version"], + ) + for waiver in policy["vulnerability_scan"]["exemptions"] + for finding in waiver["findings"] + for package_name in finding["package_names"] + ] + assert len(fixture_keys) == len(set(fixture_keys)) == 44 + assert len(waiver_keys) == len(set(waiver_keys)) == 44 + assert set(fixture_keys) == set(waiver_keys) report = _scan("contract-api.docker.tar", vulnerabilities) summary = common.validate_trivy_scan( @@ -1590,6 +1700,9 @@ def test_trivy_scan_allows_only_exact_unfixed_python_waiver_occurrences() -> Non ("fixable", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)), ("critical", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)), ("duplicate", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)), + ("wrong-class", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)), + ("wrong-type", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)), + ("wrong-os", "contract-api", datetime(2026, 9, 20, tzinfo=timezone.utc)), ("valid", "contract-web", datetime(2026, 9, 20, tzinfo=timezone.utc)), ("valid", "contract-api", datetime(2026, 10, 20, tzinfo=timezone.utc)), ], @@ -1598,7 +1711,7 @@ def test_trivy_waiver_mismatch_or_expiry_fails_closed( mutation: str, role: str, at: datetime ) -> None: policy = common.load_policy(POLICY_PATH) - vulnerabilities = _waived_python_vulnerabilities() + vulnerabilities = _captured_python_base_vulnerabilities() if mutation == "unknown-cve": vulnerabilities[0]["VulnerabilityID"] = "CVE-2099-0001" elif mutation == "wrong-package": @@ -1612,11 +1725,59 @@ def test_trivy_waiver_mismatch_or_expiry_fails_closed( elif mutation == "duplicate": vulnerabilities.append(dict(vulnerabilities[0])) report = _scan("contract-api.docker.tar", vulnerabilities) + if mutation == "wrong-class": + report["Results"][0]["Class"] = "lang-pkgs" + elif mutation == "wrong-type": + report["Results"][0]["Type"] = "ubuntu" + elif mutation == "wrong-os": + report["Metadata"]["OS"]["Family"] = "ubuntu" with pytest.raises(common.ReleaseValidationError, match="gate failed"): common.validate_trivy_scan(report, policy, role=role, at=at) +@pytest.mark.parametrize( + ("package_name", "wrong_version"), + [ + ("bsdutils", "2.41.5-0+deb13u1"), + ("bsdutils", "1:4.16.0-2+really2.41.5-0+deb13u1"), + ("libblkid1", "1:2.41.5-0+deb13u1"), + ("libblkid1", "1:4.16.0-2+really2.41.5-0+deb13u1"), + ("login", "1:2.41.5-0+deb13u1"), + ("login", "2.41.5-0+deb13u1"), + ], + ids=[ + "bsdutils-as-library", + "bsdutils-as-login", + "library-as-old-unified-version", + "library-as-login", + "login-as-old-unified-version", + "login-as-library", + ], +) +def test_trivy_waiver_rejects_util_linux_version_interchange( + package_name: str, wrong_version: str +) -> None: + policy = common.load_policy(POLICY_PATH) + vulnerabilities = _captured_python_base_vulnerabilities() + finding = next( + item + for item in vulnerabilities + if item["VulnerabilityID"] == "CVE-2026-76642" + and item["PkgName"] == package_name + ) + finding["InstalledVersion"] = wrong_version + report = _scan("contract-api.docker.tar", vulnerabilities) + + with pytest.raises(common.ReleaseValidationError, match="gate failed"): + common.validate_trivy_scan( + report, + policy, + role="contract-api", + at=datetime(2026, 9, 20, tzinfo=timezone.utc), + ) + + def test_docker_archive_rejects_layer_content_not_bound_to_config(tmp_path: Path) -> None: path = tmp_path / "image.docker.tar" role = "contract-api" @@ -1819,7 +1980,7 @@ def test_installable_manifest_preserves_complete_waiver_accounting(tmp_path: Pat scan_path = bundle["root"] / image["scan"]["path"] scan_payload = _scan( Path(image["docker_archive"]["path"]).name, - _waived_python_vulnerabilities(), + _captured_python_base_vulnerabilities(), image_id=image["oci"]["config_digest"], ) scan_path.write_bytes(common.canonical_json_bytes(scan_payload))