[jeremi]

Nightly Release refuses CVE-2026-84243 in the pinned libc6 2.41-12+deb13u4 package. This draft proposes one expiring exception for each of the ten images: breg, breg-mcp, breg-review, casework, discovery, evidence, evidence-oid4vci, messaging, registry-render, and scheduling. The proposed owner is @jeremi and the expiry remains 2027-01-26. Owner risk acceptance and merge remain pending.

The affected gettext implementation remains present. Debian still lists the carried package as vulnerable and unfixed. The exposure rationale is conditional on the reviewed processes retaining their startup C locale:

• glibc documents C as the initial locale and states that libc does not call setlocale itself. Its exact Debian dcigettext implementation checks the current C/C. locale before consulting LANGUAGE.
• All fourteen shipped runtime and operator-tool executables were checked. Their loaded closures contain only the executable, loader, libc, libm and libpthread; no application or non-libc loaded library imports a locale setter. Source and constructor review covers pg_query's disabled NLS and AWS-LC initialization.
• The exported images contain no locale catalogs, and their reviewed nonroot process environments contain only PATH and SSL_CERT_FILE.
• Evidence retains SQLite's nonconstant dynamic-lookup wrapper. The rationale records its latent C extension capability and the existing restrictions: no first-party C loader caller, no rusqlite load_extension feature, and SQL authorizer denial of load_extension. Plugin or locale changes require re-review.

Evidence comes from the successful review-only 0.45.0 rehearsal, using protected-main source d68c3e4. The existing exceptions are renewed to that same image evidence, with rationale dates and independent test pins updated. Their owners, expiry dates, base image, process contracts, invalidation rules and checker behavior are preserved. Render's existing zlib rationale now distinguishes its Rust backend from the affected Debian system library.

Verification:

• All ten real rehearsal scans reproduced the missing CVE review refusal before the edits, then passed nightly policy afterward. The originally failing nightly scan also passes with the proposed baseline.
• Strict release advisory checks pass against all ten exact exported root filesystems, native Grype/Syft reports and OCI configurations: 12 blocking findings, 12 exact exceptions, zero invalid exceptions per image.
• Supported renewal: dry run, write, final dry run reporting zero files would change.
• GNU and LLVM ELF inspection agree on all fourteen executable hashes, NEEDED entries and undefined symbols. Runtime/tool hashes also match native Syft and the bound application layers.
• python3 -m unittest -b release/scripts/test_check_advisory_baselines.py release/scripts/test_advisory_renewal.py release/scripts/test_nightly_release.py: 122 tests run, 121 passed, one Linux-only toolchain test skipped on macOS.
• Linux CI runs all 53 advisory baseline tests successfully, including the real-glibc fixture skipped locally.
• Gitleaks and whitespace checks pass.

The scheduled nightly workflow has not run with this proposed policy. Its post-merge execution remains to be verified.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T15:52:51.269869Z	2fc133a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.