108 lines
6.3 KiB
Plaintext
108 lines
6.3 KiB
Plaintext
-- W9: notices that are not about the product; an empty fix with a closed range
|
|
ok W9 a GitHub Actions advisory (the project's CI) is not about the image -> not listed
|
|
ok W9 an empty fix with a range ending at 2.6.0 -> ADVISORY, fixed after 2.6.0 (not 'no fixed version')
|
|
ok W9 negative: the same notice at 2.7.0 -> not listed
|
|
ok W9 control: an open range with no fix still says 'no fixed version named yet'
|
|
-- W1-W4: the classes
|
|
ok W1 traefik v3.7.13 -> ADVISORY, fixed v3.7.14
|
|
ok W1 negative: traefik v3.7.16 -> CURRENT (the rc is no fix, v2 is another channel)
|
|
ok W1 Nextcloud 34.0.4 -> no Server advisory (fixed 34.0.1); the Deck app's advisory is not ours
|
|
ok W1 Nextcloud 34.0.0 -> ADVISORY GHSA-nc01
|
|
ok W1 an unreadable range is LISTED (unsure), never dropped
|
|
ok W1 OSV: Go 1.27.2 -> GO-2026-6809 fixed 1.27.3; Go 1.27.3 -> none
|
|
ok W2 the recorded Cloudflare blog item -> ADVISORY for cloudflared (and only that item)
|
|
ok W2 the VULN- marker in 2026.10.4 -> ADVISORY fixed 2026.10.4; 2026.10.2's plain bump is not one
|
|
ok W2 the same blog item 71 days later -> nothing (30-day window)
|
|
ok W2 positive control at the pin it hit: cloudflared 2026.9.3 on 2026-10-26 -> ADVISORY
|
|
ok W3 filebrowser 1.5.6-stable -> BEHIND 1.5.7-stable (the beta is no channel, its CVE no fix)
|
|
ok W3 redis 7-alpine -> FLOATING
|
|
ok W3 postgres gap -> GAP (BEHIND still computed: no newer 16-…)
|
|
ok W3 an abandoned template -> GAP, nothing looked up (no route needed)
|
|
ok W4 a source that fails -> NOT CHECKED, with the reason
|
|
ok W4 the table prints the NOT CHECKED line
|
|
-- W5-W7: memory and mails
|
|
ok W5 a new advisory mails that night
|
|
ok W5 the mail carries our version, the fixed version, the lane
|
|
ok W5 the same advisory the next night mails NOTHING
|
|
ok W5 still open 7 days later -> one reminder
|
|
ok W5 and not again the next night
|
|
ok W5 a vendor notice mails once and never repeats
|
|
ok W5 a pin checked clean forgets its closed advisory
|
|
ok W5 box programs first in the subject
|
|
-- W6: a source down
|
|
ok W6 one night down -> no mail
|
|
ok W6 two nights -> one mail naming the source
|
|
ok W6 a third night -> no second mail
|
|
ok W6 back up -> the streak resets (one more night down -> no mail)
|
|
-- W7: weekly and seed
|
|
ok W7 Monday -> the weekly summary
|
|
ok W7 not twice the same Monday
|
|
ok W7 a Tuesday whose last weekly is 8 days old -> the weekly (a missed Monday)
|
|
ok W7 a seed mails nothing, records the advisory, and says what it would have mailed
|
|
ok W7 a pin the seed could not read is PENDING
|
|
ok W7 its first real read is recorded SILENTLY; a pin added later still mails
|
|
-- W13: one image in the catalog AND on DooPlex (R-1333)
|
|
XX W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0) nd a notice that affects a version we ship.
|
|
|
|
Box programs first (none tonight).
|
|
|
|
rommapp/romm — CVE-2026-111497
|
|
What: s
|
|
Our version: 5.4.0 (t; t)
|
|
Fixed in: 1.0.1
|
|
Severity: high
|
|
Source: GitHub advisory
|
|
Link: l
|
|
Next: the homelab session updates this DooPlex workload (Felhom changes nothing on DooPlex; the list: documentation/security-watch/dooplex-workloads.txt)
|
|
|
|
A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
|
|
XX W13 the memory keeps one entry per group ['rommapp/romm|CVE-2026-111497']
|
|
XX W13 the old shared key is copied to the DooPlex key: no mail again ([], {'rommapp/romm|CVE-2026-111497': {'first': '2026-10-27', 'last_mailed': '2026-10-27', 'program': 'rommapp/romm 5.4.0 (x)', 'summary': 's'}})
|
|
XX W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail) (['rommapp/romm|CVE-2026-111497'], [])
|
|
ok W13 DooPlex's pin checked clean forgets only DooPlex's entry
|
|
-- W8: the inventory and its gate
|
|
ok W8 a gap with no reason is a problem
|
|
ok W8 two sources parse
|
|
ok W8 an unknown kind is a problem
|
|
ok W8 a decoy pin whose line is only a comment REFUSES (rc 1, names demo/b)
|
|
-- W10: the runtime inside an image
|
|
ok W10 Node 24.18.1 -> ADVISORY from runtime, CVE-2026-111497, fixed 24.22.1
|
|
ok W10 negative control: Node 24.22.1 -> no advisory
|
|
ok W10 Python Brotli 1.2.0 -> ADVISORY, fixed 1.2.1
|
|
ok W10 negative control: Brotli 1.2.1 -> no advisory
|
|
ok W10 Node 20 (no fixed release on its line) -> ADVISORY naming the end of life
|
|
ok W10 a layer read error -> NOT CHECKED with source runtime
|
|
ok W10 a registry with no route -> a note, not a failure
|
|
RUNTIME-READ ex/node-old:1.0.0 0 s ok
|
|
ok W10 the result is cached by digest: one full read for two nights
|
|
RUNTIME-READ ex/broken:1.0.0 0 s NOT CHECKED: layer sha256:1234 unreadable: ReadError
|
|
ok W10 an UNCHECKED result is not cached (tomorrow tries again)
|
|
ok W10 main() hands the reader to run() (off only with --no-runtime)
|
|
ok W10 the reader counts what it read and from the cache (the log's RUNTIME line)
|
|
-- W11: ghcr.io tags are paged
|
|
ok W11 both pages are read (1.1.0 is on page 2)
|
|
-- W12: the DooPlex group
|
|
ok W12 the list file is read, group dooplex, the catalog's sources reused
|
|
ok W12 an image the catalog does not ship is a stated gap (runtime + registry only)
|
|
ok W12 a DooPlex advisory names the homelab session and not the lane
|
|
ok W12 a DooPlex image in a private registry -> NOT CHECKED with the reason
|
|
ok W12 the weekly mail has its own DooPlex block
|
|
|
|
FAIL: W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0) nd a notice that affects a version we ship.
|
|
|
|
Box programs first (none tonight).
|
|
|
|
rommapp/romm — CVE-2026-111497
|
|
What: s
|
|
Our version: 5.4.0 (t; t)
|
|
Fixed in: 1.0.1
|
|
Severity: high
|
|
Source: GitHub advisory
|
|
Link: l
|
|
Next: the homelab session updates this DooPlex workload (Felhom changes nothing on DooPlex; the list: documentation/security-watch/dooplex-workloads.txt)
|
|
|
|
A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
|
|
FAIL: W13 the memory keeps one entry per group ['rommapp/romm|CVE-2026-111497']
|
|
FAIL: W13 the old shared key is copied to the DooPlex key: no mail again ([], {'rommapp/romm|CVE-2026-111497': {'first': '2026-10-27', 'last_mailed': '2026-10-27', 'program': 'rommapp/romm 5.4.0 (x)', 'summary': 's'}})
|
|
FAIL: W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail) (['rommapp/romm|CVE-2026-111497'], [])
|