87 lines
6.4 KiB
Markdown
87 lines
6.4 KiB
Markdown
# REPORT — the nightly security watch (R-1303), 2026-10-26 night
|
||
|
||
> A sibling of `REPORT.md`: the night session owns `REPORT.md` tonight. Readings taken alone (the brief's „safest
|
||
> reading", stated first):
|
||
> 1. **The key:** the operator said yes; the token did not exist by the end, so the watch runs in no-key mode (box
|
||
> programs nightly, apps' advisory lists every second night) and switches by itself when `GH_ADVISORY_TOKEN` exists.
|
||
> The name is `GH_…`, not `GITHUB_…`: Gitea reserves the `GITHUB_` and `GITEA_` prefixes for Actions secrets.
|
||
> 2. **The memory:** a file the CI job commits to `main` itself (`documentation/security-watch/state.json`), not the
|
||
> runner's disk (two runners, two disks), not the Actions cache (needs a node step), not DooPlex (a host change).
|
||
> 3. **A seed that could not read everything** (no key) leaves those pins pending; their first real read is recorded
|
||
> silently. Otherwise the first nights after the seed would have been the mail storm the brief forbids.
|
||
|
||
## In plain words
|
||
|
||
1. **Sources picked:** GitHub's per-repo security advisories (the main source), GitHub release notes, the Cloudflare
|
||
blog plus cloudflared's own `VULN-` notes, OSV for our Go builders, and the registries for „newer version". **They
|
||
cannot see:** a fix told only by mail, forum or a blog we do not read; a security fix nobody calls one; packages inside
|
||
our own images (Debian, Alpine, Samba); closed-source apps (Plex, Emby); floating tags like `redis:7-alpine`.
|
||
2. **Watched:** 108 pins — 11 box programs and build bases, 97 catalog images (21 of them with a stated „no source").
|
||
3. **First real run (the seed, CI job 2408):** ADVISORY on **30 pins (142 notices)**: 3 box programs (traefik, the file
|
||
manager, cloudflared) and 27 apps; BEHIND on 17; 0 NOT CHECKED. Nothing was mailed — the seed records them.
|
||
4. **The test mail arrived:** yes — „[Felhom security] TEST — not a real advisory …" in the admin@felhom.eu mailbox
|
||
(Resend id `01a17a5d-…`, CI job 2407).
|
||
5. **The operator does:** make the GitHub key and store it as `GH_ADVISORY_TOKEN` (CC's store and Gitea Actions). Then
|
||
decide the order of triage for the advisory list (R-1305, R-1306).
|
||
|
||
## The ADVISORY list today (box programs first; full list `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`)
|
||
|
||
| Program | Our version | Fixed in (notices) |
|
||
|---|---|---|
|
||
| traefik | v3.7.13 | v3.7.14–v3.7.16 (15; triage: none seems to apply to our config — R-1304) |
|
||
| file manager (FileBrowser Quantum) | 1.5.6-stable | 1.5.7-stable for 2 of 36 (GHSA-qx86, needs the password; GHSA-3846); the rest on 2.x (R-1305) |
|
||
| cloudflared | 2026.10.3 | 2026.10.4 (VULN-176088, metrics allowlist; our metrics are on the container's own loopback) + the eMudhra blog post (already fixed, R-1300) |
|
||
| 27 apps | — | e.g. Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.2.4; Seerr 2.7.3 → 3.5.0; Wanderer v0.20.0 → v0.21.2; Rallly 4.15.3 → 4.15.4; Immich v3.2.4 → v3.3.5 (notes); SparkyFitness: no fix yet (R-1306) |
|
||
|
||
## Commits and CI (by commit)
|
||
|
||
| Repo | Commit | What | CI |
|
||
|---|---|---|---|
|
||
| felhom.eu | `97ae7086` | spike + rows R-1303, R-1304 | job 2401 success |
|
||
| felhom.eu | `1f62d629` | the watch, the shared list + gate, tests, workflow | job 2402 success |
|
||
| felhom.eu | `6ee23a3b` | abandoned = GAP; seed-pending | (see below) |
|
||
| app catalog | `f61800a` | `upstream:` in 65 templates, gate + decoys, checklist 1.10 | job 2403 success |
|
||
| controller | `e01eb64b` | `upstream.txt`, `# upstream:` comments, gate + decoys | job 2404 success |
|
||
| felhom.eu | `ed843da7` | the memory, committed by the CI job itself | — |
|
||
| felhom.eu | (this commit) | docs, rows R-1305–R-1309, STATUS, this report | read at the end |
|
||
|
||
Live runs in CI: job 2405 (dry: every host reached; 30 NOT CHECKED because DooPlex's shared GitHub quota was at 0 —
|
||
printed and counted, the reason for the key), 2407 (test mail), 2408 (seed; memory pushed). Tests: 38 checks, no
|
||
network; red-proved five ways (dedupe, streak, the 30-day window, a swallowed source error, the seed-pending set); the
|
||
two gates' decoys red-proved with a reader that reads comments.
|
||
|
||
## Rows
|
||
|
||
Before **215**, after **222**; opened **7** (R-1303 – R-1309), closed **0**.
|
||
|
||
## Observations
|
||
|
||
- traefik v3.7.13 inside 12 October advisories — **FILED: R-1304**.
|
||
- The file manager 1.5.6-stable inside 36 notices, 2 fixed in its own channel — **FILED: R-1305**.
|
||
- 27 app pins with published notices — **FILED: R-1306** (one row; the list is the file).
|
||
- Packages inside our own images not watched — **FILED: R-1307**. Floating tags — **FILED: R-1308**. Mail-only and
|
||
silent fixes, closed-source apps — **FILED: R-1309**.
|
||
- Three upstream repos renamed (cal.com → `calcom/cal.diy`, jellyseerr → `seerr-team/seerr`, wanderer →
|
||
`open-wanderer/wanderer`) — **NOT-A-FINDING: the mapping uses the new names; the images still pull.**
|
||
- plant-it's image name points nowhere — **NOT-A-FINDING: known and stated in its template (abandoned); the watch lists
|
||
it as GAP and never looks it up.**
|
||
- The hub's Dockerfile lines are not gated in felhom.eu's own runner (only the catalog's and the controller's are) —
|
||
**NOT-A-FINDING: the watch reads them nightly and reports a missing line as NOT CHECKED; a gate there would need its
|
||
own decoy suite for two lines.**
|
||
- nginx's channel test treats 1.31 (mainline) as the same channel as 1.30 (stable) — **NOT-A-FINDING: BEHIND is a weekly
|
||
hint; the notice match does not depend on it.**
|
||
- Without a key, the dry run spent DooPlex's whole GitHub quota (shared with every DooPlex client) — **NOT-A-FINDING:
|
||
that is R-1303's „blocked on"; the watch reported it as NOT CHECKED, as designed.**
|
||
|
||
## Documents changed
|
||
|
||
`runbooks/monthly-floating-retest.md` §4a (the BEHIND check is nightly; the monthly run keeps the same-name re-test);
|
||
`architecture/capability-map-detail/B.md` B23 (a watch mail starts the lane); `architecture/08-alarm-ladder.md` §11 (the
|
||
three signals, `[DESIGN]`); `scripts/CHANGELOG.md`; `REUSE.md`; the catalog's `NEW-APP-CHECKLIST.md` 1.10. System
|
||
poster: none of the three needed — no machine, path, backup tier or key changed (a CI job reads public sources).
|
||
|
||
## Teardown
|
||
|
||
Machine and host: nothing provisioned. Hub: nothing. CI: three manual runs, no lasting change but the memory file. Work
|
||
copies `felhom.eu-cfsec`, `app-catalog-cfsec`, `felhom-controller-cfsec` on DooPlex: removed at the end, all pushed.
|