115 lines
11 KiB
Plaintext
115 lines
11 KiB
Plaintext
-- W9: notices that are not about the product; an empty fix with a closed range
|
|
ok W9 a GitHub Actions advisory (the project's CI) is not about the image -> not listed
|
|
ok W9 an empty fix with a range ending at 2.6.0 -> ADVISORY, fixed after 2.6.0 (not 'no fixed version')
|
|
ok W9 negative: the same notice at 2.7.0 -> not listed
|
|
ok W9 control: an open range with no fix still says 'no fixed version named yet'
|
|
-- W1-W4: the classes
|
|
ok W1 traefik v3.7.13 -> ADVISORY, fixed v3.7.14
|
|
ok W1 negative: traefik v3.7.16 -> CURRENT (the rc is no fix, v2 is another channel)
|
|
ok W1 Nextcloud 34.0.4 -> no Server advisory (fixed 34.0.1); the Deck app's advisory is not ours
|
|
ok W1 Nextcloud 34.0.0 -> ADVISORY GHSA-nc01
|
|
ok W1 an unreadable range is LISTED (unsure), never dropped
|
|
ok W1 OSV: Go 1.27.2 -> GO-2026-6809 fixed 1.27.3; Go 1.27.3 -> none
|
|
ok W2 the recorded Cloudflare blog item -> ADVISORY for cloudflared (and only that item)
|
|
ok W2 the VULN- marker in 2026.10.4 -> ADVISORY fixed 2026.10.4; 2026.10.2's plain bump is not one
|
|
ok W2 the same blog item 71 days later -> nothing (30-day window)
|
|
ok W2 positive control at the pin it hit: cloudflared 2026.9.3 on 2026-10-26 -> ADVISORY
|
|
ok W3 filebrowser 1.5.6-stable -> BEHIND 1.5.7-stable (the beta is no channel, its CVE no fix)
|
|
ok W3 redis 7-alpine -> FLOATING
|
|
ok W3 postgres gap -> GAP (BEHIND still computed: no newer 16-…)
|
|
ok W3 an abandoned template -> GAP, nothing looked up (no route needed)
|
|
ok W4 a source that fails -> NOT CHECKED, with the reason
|
|
ok W4 the table prints the NOT CHECKED line
|
|
-- W5-W7: memory and mails
|
|
ok W5 a new advisory mails that night
|
|
ok W5 the mail carries our version, the fixed version, the lane
|
|
ok W5 the same advisory the next night mails NOTHING
|
|
ok W5 still open 7 days later -> one reminder
|
|
ok W5 and not again the next night
|
|
ok W5 a vendor notice mails once and never repeats
|
|
ok W5 a pin checked clean forgets its closed advisory
|
|
ok W5 box programs first in the subject
|
|
-- W6: a source down
|
|
ok W6 one night down -> no mail
|
|
ok W6 two nights -> one mail naming the source
|
|
ok W6 a third night -> no second mail
|
|
ok W6 back up -> the streak resets (one more night down -> no mail)
|
|
-- W7: weekly and seed
|
|
ok W7 Monday -> the weekly summary
|
|
ok W7 not twice the same Monday
|
|
ok W7 a Tuesday whose last weekly is 8 days old -> the weekly (a missed Monday)
|
|
ok W7 a seed mails nothing, records the advisory, and says what it would have mailed
|
|
ok W7 a pin the seed could not read is PENDING
|
|
ok W7 its first real read is recorded SILENTLY; a pin added later still mails
|
|
-- W13: one image in the catalog AND on DooPlex (R-1333)
|
|
ok W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0)
|
|
ok W13 the memory keeps one entry per group
|
|
ok W13 the old shared key is copied to the DooPlex key: no mail again
|
|
ok W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail)
|
|
ok W13 DooPlex's pin checked clean forgets only DooPlex's entry
|
|
-- W14: Docker Hub — retry a 429, cache a tag list for 24 h, one fetch per path, paced (R-1334)
|
|
ok W14 a 429 is retried after its Retry-After, and the retry's tags are used
|
|
ok W14 a 429 on every try -> NOT CHECKED only after the last try (4 tries)
|
|
ok W14 a tag list cached an hour ago -> no request
|
|
ok W14 a tag list cached 25 h ago -> fetched again, and the cache holds the new list
|
|
ok W14 two names of one Docker Hub path -> one fetch
|
|
ok W14 Docker Hub requests are spaced (>= 1.0 s apart)
|
|
ok W14 main() loads the runner's tag cache, hands it to run() and prints the TAGS line
|
|
-- W8: the inventory and its gate
|
|
ok W8 a gap with no reason is a problem
|
|
ok W8 two sources parse
|
|
ok W8 an unknown kind is a problem
|
|
ok W8 a decoy pin whose line is only a comment REFUSES (rc 1, names demo/b)
|
|
-- W10: the runtime inside an image
|
|
ok W10 Node 24.18.1 -> ADVISORY from runtime, CVE-2026-111497, fixed 24.22.1
|
|
ok W10 negative control: Node 24.22.1 -> no advisory
|
|
ok W10 Python Brotli 1.2.0 -> ADVISORY, fixed 1.2.1
|
|
ok W10 negative control: Brotli 1.2.1 -> no advisory
|
|
ok W10 Node 20 (no fixed release on its line) -> ADVISORY naming the end of life
|
|
ok W10 a layer read error -> NOT CHECKED with source runtime
|
|
ok W10 a registry with no route -> a note, not a failure
|
|
RUNTIME-READ ex/node-old:1.0.0 0 s ok
|
|
ok W10 the result is cached by digest: one full read for two nights
|
|
RUNTIME-READ ex/broken:1.0.0 0 s NOT CHECKED: layer sha256:1234 unreadable: ReadError
|
|
ok W10 an UNCHECKED result is not cached (tomorrow tries again)
|
|
ok W10 main() hands the reader to run() (off only with --no-runtime)
|
|
ok W10 the reader counts what it read and from the cache (the log's RUNTIME line)
|
|
-- W11: ghcr.io tags are paged
|
|
ok W11 both pages are read (1.1.0 is on page 2)
|
|
-- W12: the DooPlex group
|
|
ok W12 the list file is read, group dooplex, the catalog's sources reused
|
|
ok W12 an image the catalog does not ship is a stated gap (runtime + registry only)
|
|
ok W12 a DooPlex advisory names the homelab session and not the lane
|
|
XX W12 a DooPlex image in our own private registry -> GAP with the reason, no failed source (R-1334) ('NOT CHECKED', [{'source': 'runtime', 'why': 'registry gitea.dooplex.hu: no anonymous token route'}])
|
|
ok W12 the weekly mail has its own DooPlex block
|
|
-- W15: a timeout is tried again; a stated unreadable pin is a GAP, not a failed source (R-1334)
|
|
XX t_timeouts_and_stated ran SourceError: https://hub.docker.com/v2/repositories/library/redis/tags?page_size=100&ordering=last_updated: The read operation timed out
|
|
-- W16: notices that do not apply, and fixes that were missed (R-1310)
|
|
XX W16 another program's package in the repo (Gitea's runner) is not listed True
|
|
ok W16 the same notice also naming the pinned program IS listed (control)
|
|
ok W16 the pinned program's package is listed (control)
|
|
XX W16 Uptime Kuma's rootless-only notice is not listed for our image True
|
|
XX W16 every GHSA a release names is its own entry, once ['release:ex/app@1.0.1', 'release:ex/app@1.0.2']
|
|
XX W16 ... with the lowest release that names it as the fix {'release:ex/app@1.0.2': '1.0.2', 'release:ex/app@1.0.1': '1.0.1'}
|
|
XX W16 a GHSA in both the advisory list and a release is one entry (the advisory's) [{'id': 'GHSA-aaaa-bbbb-cccc', 'source': 'GitHub advisory', 'severity': 'high', 'summary': 'snicheck skips the check', 'fixed': '1.0.1', 'link': 'https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx', 'unsure': False, 'published': '2026-10-07'}, {'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Fixes GHSA-aaaa-bbbb-cccc', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
XX W16 a line where „security” is only a word is no ADVISORY (Traefik's announcements line) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': '[security] Point security announcements to GitHub advisories (#14099)', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
XX W16 „no longer receives security fixes” is no ADVISORY (Dawarich) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Dawarich no longer receives security fixes on this line', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
XX W16 the same notes with a real id ARE listed, by that id (control: Traefik v3.7.17) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'CVE fixed: Advisory GHSA-xv5x-242w-7hf7', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
ok W16 a plain „Security Fixes” heading with no id is still an ADVISORY (control: Vaultwarden's shape)
|
|
XX W16 linuxserver's YY.MM.YYYYMMDD tag is not newer than 26.09.2 26.09.20260929
|
|
XX W16 a real newer tag beside it still counts (control) 26.09.20260929
|
|
ok W16 a pin that IS on the date shape still compares its own shape (control)
|
|
|
|
FAIL: W12 a DooPlex image in our own private registry -> GAP with the reason, no failed source (R-1334) ('NOT CHECKED', [{'source': 'runtime', 'why': 'registry gitea.dooplex.hu: no anonymous token route'}])
|
|
FAIL: t_timeouts_and_stated ran SourceError: https://hub.docker.com/v2/repositories/library/redis/tags?page_size=100&ordering=last_updated: The read operation timed out
|
|
FAIL: W16 another program's package in the repo (Gitea's runner) is not listed True
|
|
FAIL: W16 Uptime Kuma's rootless-only notice is not listed for our image True
|
|
FAIL: W16 every GHSA a release names is its own entry, once ['release:ex/app@1.0.1', 'release:ex/app@1.0.2']
|
|
FAIL: W16 ... with the lowest release that names it as the fix {'release:ex/app@1.0.2': '1.0.2', 'release:ex/app@1.0.1': '1.0.1'}
|
|
FAIL: W16 a GHSA in both the advisory list and a release is one entry (the advisory's) [{'id': 'GHSA-aaaa-bbbb-cccc', 'source': 'GitHub advisory', 'severity': 'high', 'summary': 'snicheck skips the check', 'fixed': '1.0.1', 'link': 'https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx', 'unsure': False, 'published': '2026-10-07'}, {'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Fixes GHSA-aaaa-bbbb-cccc', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
FAIL: W16 a line where „security” is only a word is no ADVISORY (Traefik's announcements line) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': '[security] Point security announcements to GitHub advisories (#14099)', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
FAIL: W16 „no longer receives security fixes” is no ADVISORY (Dawarich) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Dawarich no longer receives security fixes on this line', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
FAIL: W16 the same notes with a real id ARE listed, by that id (control: Traefik v3.7.17) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'CVE fixed: Advisory GHSA-xv5x-242w-7hf7', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
|
FAIL: W16 linuxserver's YY.MM.YYYYMMDD tag is not newer than 26.09.2 26.09.20260929
|
|
FAIL: W16 a real newer tag beside it still counts (control) 26.09.20260929
|