5.8 KiB
5.8 KiB
SPIKE — which security-notice sources work (security watch, R-1303), 2026-10-26 evening
Measured from DooPlex (the CI runner is a k3s pod on DooPlex with the same egress; its own reach is proven by the live
run, LIVE.md). Raw answers: raw/.
The controls
| Control | What it is | Our pin |
|---|---|---|
| P1 cloudflared | Cloudflare's eMudhra notice, 2026-10-20: fixed in 2026.10.2 (image trust store) | was 2026.9.3 (R-1300) |
| P2 traefik | GHSA-fh26-gfpp-7xxx (and 11 more, Oct 2026), fixed v3.7.14–v3.7.16; and the older set, e.g. 81 advisories for v3.1.2 | v3.7.13 |
| P3 vaultwarden | GHSA-wc45-m6pv-rrf9 and five more (2026-10-03), fixed 1.37.0 | 1.37.4 |
| P4 immich | GHSA-q89f-h332-8q2h (2026-09-28, high: SVG upload → RCE), fixed v3.2.4 | v3.2.4 |
| P5 nextcloud | advisories published in nextcloud/security-advisories (not in nextcloud/server) |
34.0.4 |
| P6 Go builder | GO-2026-6809 (R-972), fixed in Go 1.27.3 | golang 1.27.3 |
| N negative | vaultwarden 1.37.4 vs its advisories; traefik v3.7.16 vs GHSA-hrpp (≤ v3.7.15); Go 1.27.3 | — |
The table
| Source | P1 cloudflared | P2 traefik | P3 vaultwarden | P4 immich | P5 nextcloud | P6 Go | Negative | Cost per night | Key |
|---|---|---|---|---|---|---|---|---|---|
GitHub per-repo security advisories (/repos/O/R/security-advisories) |
no (only 2 old Windows advisories) | yes — 12 affect v3.7.13 | yes (6, range ≤ 1.36.0) | yes | yes, from nextcloud/security-advisories (100+, paged) |
n/a | correct (1.37.4 and v3.7.16 not affected) | 1 request per repo (+1 per 100 more) ≈ 85–90 | 60/hour without a key, shared by every DooPlex client; a 304 still counts (measured: 51 → 50). 5000/hour with a key |
OSV.dev query |
no (github.com/cloudflare/cloudflared at 2026.9.3: 0) |
old only (v3.1.2: 81; v3.7.13: 0 — none of October's) | no (not a package) | no | no (Packagist nextcloud/server: 0) |
yes (Go 1.27.2 → GO-2026-6809) | correct (Go 1.27.3: 0) | 1 POST per Go builder | none |
GitHub global advisories (/advisories?affects=) |
no | no (reviewed only; October's are not) | no | no | no | — | — | 1 per item | same as above |
GitHub release feed (/O/R/releases.atom, newest 10, full notes) |
no (cloudflared's release body is checksums only) | — | yes (1.37.0, 1.37.4 name GHSA ids) | partly (v3.3.5 says „security"; v3.2.4 is older than the 10 in the feed) | — | — | — | 1 per repo, no API quota (measured: core count unchanged) | none |
cloudflared RELEASE_NOTES (raw file) |
no for 2026.10.2 (no marker) — but Cloudflare marks security fixes VULN- (12 so far, e.g. 2026.10.4 VULN-176088) |
— | — | — | — | — | — | 1 | none |
Cloudflare blog feed (blog.cloudflare.com/rss/, full text, ~2 weeks) |
YES — „8 eMudhra certificates are compromised" (2026-10-20) names cloudflared | — | — | — | — | — | — | 1 | none |
Registry tags (Docker Hub, ghcr.io anonymous token, lscr.io = Docker Hub linuxserver/*) |
BEHIND only (2026.10.2 existed) | BEHIND only | — | — | — | — | — | 1–3 per image | none |
The choice (the smallest set that catches every positive control)
- GitHub per-repo security advisories — catches P2, P3, P4, P5. The primary source.
- Cloudflare blog feed + cloudflared
RELEASE_NOTESVULN-markers — the only automated way to P1 (the blog);VULN-catches Cloudflare's other security releases (2026.10.0, 2026.10.4). - OSV, Go stdlib only — P6, for the Go builder pins of the controller and the hub.
- GitHub release feeds — no quota; catches apps that write „security"/CVE/GHSA in their notes but publish no advisories (a second net, not a primary).
- Registry tags — BEHIND, as
check-infra-pins.pydoes, for every pin.
Dropped: OSV for apps (it found nothing the per-repo advisories did not, and nothing from October), GitHub's global advisory search (reviewed advisories only).
What the watch CANNOT see
- A fix announced only by mail, or on a blog we do not read. P1 is caught only because Cloudflare's blog names cloudflared in full text; a vendor that announces in a mail or a forum is invisible.
- A security fix nobody calls one (a base-image or trust-store bump with plain release notes, like cloudflared 2026.10.2's „bump distroless image"). It shows only as BEHIND (weekly).
- Packages inside our own images: the Alpine/Debian packages in the controller, hub and Samba images (Samba's version is whatever Alpine 3.24 ships; Debian's and Alpine's security trackers are not read). BEHIND on the base image's point release is the only signal.
- Floating tags (
redis:7-alpine,postgres:16-…,mariadb:12.3): there is no exact version to match a range against; they are listed as FLOATING, and a pull at install takes the line's newest. - Apps with no GitHub home or no notice practice (PostgreSQL, MariaDB, Plex, Emby, OnlyOffice's server, the linuxserver wrappers): only BEHIND, plus release-feed words where a feed exists.
- Without a key: the advisory lists of the apps are read every second night (about 40 a night), the box programs every night. The operator said yes to a key (2026-10-26); until it exists the watch runs in this mode and says so.
Facts measured on the way
- Our traefik pin v3.7.13 is inside 12 advisories of October 2026 (fixed v3.7.14–v3.7.16). Our config uses the docker and file providers, no Kubernetes ingress, no FastProxy, no NTLM/Negotiate backend; ForwardAuth goes to the controller. None of the 12 seem to apply → FILED: R-1304 (raise in the next controller release).
- A Gitea Actions secret cannot be named
GITHUB_…(Gitea reserves theGITHUB_andGITEA_prefixes), so the CI secret isGH_ADVISORY_TOKEN, and the same name in CC's store.