diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index 655684686f..093e251838 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -31,23 +31,23 @@ ROOT / "release/security/registry-render-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "breg": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "casework": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "discovery": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "evidence": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "scheduling": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "breg-mcp": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "breg-review": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "evidence-oid4vci": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "messaging": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "registry-render": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", + "breg": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "casework": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "discovery": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "evidence": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "scheduling": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "breg-mcp": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "breg-review": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "evidence-oid4vci": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "messaging": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "registry-render": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", } -LIVE_REFERENCE_SOURCE_REVISION = "4c6f484c9b01985afb30422e6b297efc122ae4d4" +LIVE_REFERENCE_SOURCE_REVISION = "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest # exception. Move it forward by hand when the baselines are renewed. -LIVE_REVIEW_EVALUATION_DATE = "2026-10-27" +LIVE_REVIEW_EVALUATION_DATE = "2026-11-01" LIVE_REFERENCE_PROVENANCE = { "breg": "local_reproduction", "casework": "local_reproduction", diff --git a/release/security/breg-advisory-baseline.json b/release/security/breg-advisory-baseline.json index 611e4dea43..377a76aa02 100644 --- a/release/security/breg-advisory-baseline.json +++ b/release/security/breg-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:9a7864c291a00c2982c24a150111395e81ee6d7c47cd98043506f5529afc353e", + "sha256:6cc19af93d10d83a76995a3fb40a30b1dca5a3ddb34b89d569b4581efe24d1ff", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -51,7 +51,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc" + "definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede" }, "policies": [ { @@ -74,8 +74,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -92,14 +92,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", - "component_layer_id": "sha256:9a7864c291a00c2982c24a150111395e81ee6d7c47cd98043506f5529afc353e", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", + "component_layer_id": "sha256:6cc19af93d10d83a76995a3fb40a30b1dca5a3ddb34b89d569b4581efe24d1ff", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -119,10 +119,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -132,8 +132,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -150,14 +150,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", - "component_layer_id": "sha256:9a7864c291a00c2982c24a150111395e81ee6d7c47cd98043506f5529afc353e", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", + "component_layer_id": "sha256:6cc19af93d10d83a76995a3fb40a30b1dca5a3ddb34b89d569b4581efe24d1ff", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -177,10 +177,68 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg, /usr/local/bin/bregctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", + "component_layer_id": "sha256:6cc19af93d10d83a76995a3fb40a30b1dca5a3ddb34b89d569b4581efe24d1ff", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/breg", + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" + } + ], + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -190,8 +248,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -208,14 +266,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -235,10 +293,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -248,8 +306,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -266,14 +324,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -293,10 +351,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -306,8 +364,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -324,14 +382,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -351,10 +409,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -364,8 +422,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -382,14 +440,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -409,10 +467,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -422,8 +480,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -440,14 +498,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -467,10 +525,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -480,8 +538,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -498,14 +556,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -525,10 +583,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -538,8 +596,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -556,14 +614,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -583,10 +641,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -596,8 +654,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -614,14 +672,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -641,10 +699,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } }, { @@ -654,8 +712,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -672,14 +730,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:6e675ca1693a5ef6f65d28a0ce446870ce74cdba6caf3718396c343ea92ff82b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bcf2c7660853e63b7e17728d45af6eabb054ac3df9e358c733734d9e88ed548d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4742a3d8aba7a93515a25a3b317f46869d70b3cf0722dd465cdf87169c2953dc", + "runtime_definition_digest": "sha256:8f513e2f15f7ec17e307b3814e722f0cd6bcef31d3643c71e6b783942768cede", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -699,10 +757,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:db1f6447fb0b0164c61430db0227ebeca1ce9c14646b7de2d0cf7714f50bdd67" + "sha256": "sha256:105a5268f05f92281b3dd44ae051685a2ccf965bb6e5cdb054e015e676946bfd" } ], - "definition_digest": "sha256:48492463f3b9712bf67a95633b44f83e3113b430f60f587741c6d548b9becd47" + "definition_digest": "sha256:1e9ff7ba939d10c5c6b8dac9170a6f1399b34efbe94a04732bbe55aa2f951276" } } ] diff --git a/release/security/breg-mcp-advisory-baseline.json b/release/security/breg-mcp-advisory-baseline.json index 184d7f3422..303e676984 100644 --- a/release/security/breg-mcp-advisory-baseline.json +++ b/release/security/breg-mcp-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:66303ab9bc99bc28104c888c6f015d0b07d890bca36439599e22bbd262f60e30", + "sha256:bc716929a72951913a3c5275378ae6128d37125a817172c1fcff86f454e382ba", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84" + "definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", - "component_layer_id": "sha256:66303ab9bc99bc28104c888c6f015d0b07d890bca36439599e22bbd262f60e30", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", + "component_layer_id": "sha256:bc716929a72951913a3c5275378ae6128d37125a817172c1fcff86f454e382ba", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", - "component_layer_id": "sha256:66303ab9bc99bc28104c888c6f015d0b07d890bca36439599e22bbd262f60e30", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", + "component_layer_id": "sha256:bc716929a72951913a3c5275378ae6128d37125a817172c1fcff86f454e382ba", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg-mcp; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", + "component_layer_id": "sha256:bc716929a72951913a3c5275378ae6128d37125a817172c1fcff86f454e382ba", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/breg-mcp", + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" + } + ], + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f4911c4284e241013485658fdcd0c2eb929f6564b8f345861f5f25dc4a9a5a8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:aea9da88c24b37ca9bceee8f1b7a6135886e131b9bd629420148b0dc27dc8c55", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d6c6c2eb0bfb0529c1cff4604ec1d943ac40e442684e3b68695a6ba5213f4d84", + "runtime_definition_digest": "sha256:c33b4c04d7aeb0ee1cbf03d5abb3a11c25a389e228655246e21b288492373493", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:f14e118bbc8e7ebb1de75e9e4712392644da79866161274974b22624e6067325" + "sha256": "sha256:a14df34df2297da04074c093f113786c9ae6d3d13f77e9c577db67be93960a67" } ], - "definition_digest": "sha256:a4b2389594103c02d1a2005689d328aee28912a843e04a95f0b03221cb1cbba9" + "definition_digest": "sha256:3eb07284abaaee42b9915b7d9370bfd18e723bd723db772b3400917a82f05352" } } ] diff --git a/release/security/breg-review-advisory-baseline.json b/release/security/breg-review-advisory-baseline.json index 1811095940..09412cc3ee 100644 --- a/release/security/breg-review-advisory-baseline.json +++ b/release/security/breg-review-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:552a4f909098fc265d5e82ba1acb9d3f786cc8e47fce946cd4f892391a2bc4c5", + "sha256:7f43f66a95f33bb08b24e94205bc65f9223fae497105251b791d3e6df19311e6", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1" + "definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", - "component_layer_id": "sha256:552a4f909098fc265d5e82ba1acb9d3f786cc8e47fce946cd4f892391a2bc4c5", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", + "component_layer_id": "sha256:7f43f66a95f33bb08b24e94205bc65f9223fae497105251b791d3e6df19311e6", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", - "component_layer_id": "sha256:552a4f909098fc265d5e82ba1acb9d3f786cc8e47fce946cd4f892391a2bc4c5", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", + "component_layer_id": "sha256:7f43f66a95f33bb08b24e94205bc65f9223fae497105251b791d3e6df19311e6", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg-review; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", + "component_layer_id": "sha256:7f43f66a95f33bb08b24e94205bc65f9223fae497105251b791d3e6df19311e6", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/breg-review", + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" + } + ], + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 breg-review local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ad5ba1a0be3ebb24db0ad05348097b06e5b6d0c687ac62ede56c72d15d5c91f8", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:d2fbd1920be9d5609fe6b79d98262663dd28a8424be13d258e1277ff5a59c088", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:ee2477ef94a9dccfc537d126a3468d291209e22a8d934208a6eca14697a512b1", + "runtime_definition_digest": "sha256:e9174a512b4877ed47c410b2c194535e3e14c5476adf9f96ab3ac0613f2bf41c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7b01cc6a83f01fcb62d5e374969b29161281d2023a911735c2b641e1a75cd17b" + "sha256": "sha256:27fd7c6a2a7a7a6df1af1e1b4e9f46c2bffd157a420d843a377593fb29675dae" } ], - "definition_digest": "sha256:4cf2011af58ee820559164b68545baedff616f2249e0aa94074ce57466c08afb" + "definition_digest": "sha256:40eacd014b30f67ac3d89fb3e10b91d19cc8c26eb8c293c4ac297c8fdcfd0570" } } ] diff --git a/release/security/casework-advisory-baseline.json b/release/security/casework-advisory-baseline.json index 59e9ea8dee..55fe006ee4 100644 --- a/release/security/casework-advisory-baseline.json +++ b/release/security/casework-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:1fdfc8b1727f284e0b34d499ea79cfb13095fe744393ca1dcfbf99ffc7ff5491", + "sha256:ba2d0b86ad4da425e8d57aa77a25330660284aa0f9760dfdc2edd5fa400226e2", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03" + "definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", - "component_layer_id": "sha256:1fdfc8b1727f284e0b34d499ea79cfb13095fe744393ca1dcfbf99ffc7ff5491", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", + "component_layer_id": "sha256:ba2d0b86ad4da425e8d57aa77a25330660284aa0f9760dfdc2edd5fa400226e2", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", - "component_layer_id": "sha256:1fdfc8b1727f284e0b34d499ea79cfb13095fe744393ca1dcfbf99ffc7ff5491", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", + "component_layer_id": "sha256:ba2d0b86ad4da425e8d57aa77a25330660284aa0f9760dfdc2edd5fa400226e2", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/casework, /usr/local/bin/caseworkctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", + "component_layer_id": "sha256:ba2d0b86ad4da425e8d57aa77a25330660284aa0f9760dfdc2edd5fa400226e2", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/casework", + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" + } + ], + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 casework local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cd82945cd7229e823777a0a1681e4246e60b994c9f53a68ed41edf330220bd9b", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:0f03f782aab2ef7e1b264ce11d6738e9b257a75b28ed9e765118f1a9be17df18", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:283aebf90b3d7a28f17abaefb1982e9488238d049f3248554d09c445bfacfb03", + "runtime_definition_digest": "sha256:20bbd38e1caca68229b28f544db89c960ad02f748c24bbbe81f5dd90f58cd60d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9ec1a85f179e93e46b14495c5dc9aaaa3ae8607afeaded70b7d455c952bd21c0" + "sha256": "sha256:30b378ae0a8723d69758e30c37e7b810423deab8ba7f005db2051ebcfe537157" } ], - "definition_digest": "sha256:11cd6483fa96a751ee6951b8a0ce061731f06e35d8b2e1d11cdd2cf0a62e0e9f" + "definition_digest": "sha256:653ca60a899d132efae6167d6600f807f8bfc6f7995e114e440a90665c3d0c8d" } } ] diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json index dc364810ae..3c2b42d8a8 100644 --- a/release/security/discovery-advisory-baseline.json +++ b/release/security/discovery-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:b590fdc57cf6038e63b5507296a4809e21369381be8929619dfd14d1441edcfd" + "sha256:cf3ccfb7e0e580370c6148e29afeef1a89e2d218a72a4222c2bee5a71d18fa96" ], "config": { "user": "65532", @@ -50,7 +50,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854" + "definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d" }, "policies": [ { @@ -73,8 +73,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -91,14 +91,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", - "component_layer_id": "sha256:b590fdc57cf6038e63b5507296a4809e21369381be8929619dfd14d1441edcfd", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", + "component_layer_id": "sha256:cf3ccfb7e0e580370c6148e29afeef1a89e2d218a72a4222c2bee5a71d18fa96", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -118,10 +118,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -131,8 +131,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -149,14 +149,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", - "component_layer_id": "sha256:b590fdc57cf6038e63b5507296a4809e21369381be8929619dfd14d1441edcfd", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", + "component_layer_id": "sha256:cf3ccfb7e0e580370c6148e29afeef1a89e2d218a72a4222c2bee5a71d18fa96", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -176,10 +176,68 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/discovery; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", + "component_layer_id": "sha256:cf3ccfb7e0e580370c6148e29afeef1a89e2d218a72a4222c2bee5a71d18fa96", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/discovery", + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" + } + ], + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -189,8 +247,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -207,14 +265,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -234,10 +292,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -247,8 +305,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -265,14 +323,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -292,10 +350,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -305,8 +363,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -323,14 +381,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -350,10 +408,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -363,8 +421,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -381,14 +439,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -408,10 +466,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -421,8 +479,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -439,14 +497,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -466,10 +524,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -479,8 +537,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -497,14 +555,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -524,10 +582,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -537,8 +595,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -555,14 +613,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -582,10 +640,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -595,8 +653,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -613,14 +671,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -640,10 +698,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } }, { @@ -653,8 +711,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 discovery local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -671,14 +729,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f4ea54bda67b1d5901384035d8406d398d8f3a59f172f2e60c4e1fd866e2d064", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:3e9b05b0140248e5a56c4e300fa24071907ea795b22bd015685466ed54871366", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1105eecb79d0607a2e36d76da8092ffa85a184bb4be95d7203c20c03af2b2854", + "runtime_definition_digest": "sha256:9f83a9fbaea3349b55622dd9156348373ddd3ae2afb4f491899682352ae0ae1d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -698,10 +756,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:b509837f1ce2ac03fcb5dfb3abba148be05376b2d25c9fa6af490f9d498f92f0" + "sha256": "sha256:08f0524f931c278df5fcf6174f342d84bcd5758ed4e45699a805cce8de69370a" } ], - "definition_digest": "sha256:e30444a66c84142bbe93cb1d2de806c79b6d1df7da110c4202eeb27f180cbf3e" + "definition_digest": "sha256:6627f2afca017c2fbe3f4fe50c779a323ffc6b111f0ebf2380b6e9e4f5eac173" } } ] diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index 8c81e32095..9c8a062ea6 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:f73d8f698aae784ea6a7d67f0fcc5316c092eeccf5a78d4042dfe3e84a7460b2", + "sha256:7087276079392a91f1f74d645808d04cefa39148e19af01175e0c8f19b205b55", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8" + "definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", - "component_layer_id": "sha256:f73d8f698aae784ea6a7d67f0fcc5316c092eeccf5a78d4042dfe3e84a7460b2", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", + "component_layer_id": "sha256:7087276079392a91f1f74d645808d04cefa39148e19af01175e0c8f19b205b55", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", - "component_layer_id": "sha256:f73d8f698aae784ea6a7d67f0fcc5316c092eeccf5a78d4042dfe3e84a7460b2", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", + "component_layer_id": "sha256:7087276079392a91f1f74d645808d04cefa39148e19af01175e0c8f19b205b55", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/evidence; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The Evidence report retains one nonconstant dlsym wrapper in bundled SQLite. Source review found no first-party C extension loader call, rusqlite omits its load_extension feature, and registry-platform-sqlite denies SQL load_extension; the latent C loader is not an enabled runtime path. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_config_changed", + "runtime_base_changed" + ], + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", + "component_layer_id": "sha256:7087276079392a91f1f74d645808d04cefa39148e19af01175e0c8f19b205b55", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/evidence", + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" + } + ], + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:a9c3c07fd2bd527e124023863b0769007b9160686ba4cca6699f6d4fc12132e7", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:bbda9f38e879f9308b3784402096faadc54c4f1260feacb415a098364af2d969", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:165822aa8f2c7bb170aecb03a13a4bfb020d5274b836fcfd80952080b93d3ae8", + "runtime_definition_digest": "sha256:6646f74f957e195bd4f95ae81bc18bc6c69466eaaddabf162d5301b8dd55c0a1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:c66494f39940b34dde1ea0d4d2bff2293d2daf044ec8ca08436e9e94846635b4" + "sha256": "sha256:10eb94bddc041182249f8475b21656fe96097890579d5cae110e84b0448d5feb" } ], - "definition_digest": "sha256:2f3c9f9db1db1e74f1c32dfefc1f58bd079d5861e53ab387e3d523a97dd18764" + "definition_digest": "sha256:92dfe8d2da2c02ecc210ba38797213aa68d9ef5c7a081f3bf95f5fa4e22f3d11" } } ] diff --git a/release/security/evidence-oid4vci-advisory-baseline.json b/release/security/evidence-oid4vci-advisory-baseline.json index ab07c6ced5..8b7c9f9b16 100644 --- a/release/security/evidence-oid4vci-advisory-baseline.json +++ b/release/security/evidence-oid4vci-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:d968a90e9973d5c609ad504de906ca120e76b7eaf8fb5e0148d13055b6c9d286", + "sha256:d7a04e1fa4163c1462822227f98648b7d06178ed952e14f6d2d78ded777957ac", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d" + "definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", - "component_layer_id": "sha256:d968a90e9973d5c609ad504de906ca120e76b7eaf8fb5e0148d13055b6c9d286", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", + "component_layer_id": "sha256:d7a04e1fa4163c1462822227f98648b7d06178ed952e14f6d2d78ded777957ac", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", - "component_layer_id": "sha256:d968a90e9973d5c609ad504de906ca120e76b7eaf8fb5e0148d13055b6c9d286", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", + "component_layer_id": "sha256:d7a04e1fa4163c1462822227f98648b7d06178ed952e14f6d2d78ded777957ac", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/evidence-oid4vci; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", + "component_layer_id": "sha256:d7a04e1fa4163c1462822227f98648b7d06178ed952e14f6d2d78ded777957ac", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/evidence-oid4vci", + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" + } + ], + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:2f76a0d0c4c7269256bf0355bbc4cadf8b70babb86f8acb801bfdf3ea1328dac", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:b7fba0eb62dd8feed9c148305dcf605634139860ad96024f9d48b0df88a85dee", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:d11571296d9b878726f4fb9221380e4dcbc95e50adadc64257bfbff5c047228d", + "runtime_definition_digest": "sha256:5875c619836998ff19ee42442083aca024e04c0710401eca0e227172f73a0c5a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:bf840da8e21d8095e7b167306df96c962e11d692cdc6ea3aca5c5610a40d5803" + "sha256": "sha256:50d04ab4430f0de2574cb60d95c7d636fe7a9e0465cbebf8efb09f00c8b2cfc9" } ], - "definition_digest": "sha256:e25d320dcda7c06c65407def96e1d656f0573aaccad3310ca8720a6492657fdd" + "definition_digest": "sha256:350212d06112f6c4dfe924a48fb05682c919f378023ed8032fe1dd36d1c03d9f" } } ] diff --git a/release/security/messaging-advisory-baseline.json b/release/security/messaging-advisory-baseline.json index ece666b917..bfbfbad4c0 100644 --- a/release/security/messaging-advisory-baseline.json +++ b/release/security/messaging-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:52cd8e2bb6fd08489c103dd423a028be7c7b2778ce8aaeb98f4e16ce54295e7e", + "sha256:93957799f106c514b7707fc41122f26423298b86d93f0431d222aa9b2693df64", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31" + "definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", - "component_layer_id": "sha256:52cd8e2bb6fd08489c103dd423a028be7c7b2778ce8aaeb98f4e16ce54295e7e", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", + "component_layer_id": "sha256:93957799f106c514b7707fc41122f26423298b86d93f0431d222aa9b2693df64", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", - "component_layer_id": "sha256:52cd8e2bb6fd08489c103dd423a028be7c7b2778ce8aaeb98f4e16ce54295e7e", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", + "component_layer_id": "sha256:93957799f106c514b7707fc41122f26423298b86d93f0431d222aa9b2693df64", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/messaging, /usr/local/bin/messagingctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", + "component_layer_id": "sha256:93957799f106c514b7707fc41122f26423298b86d93f0431d222aa9b2693df64", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/messaging", + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" + } + ], + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 messaging local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7260edbd217d9c86f05b2bf775ff57b1645360dc42ac2b16d090213f07555cf5", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:9ac90ba2fa61edf9c1779918be77688bdff23da5c0f1c33345afa61354058301", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:4c23cbafe17935b15678e3bf428a0420db57c4b0b03c0c15116eaffdca406a31", + "runtime_definition_digest": "sha256:f8f64399a1cb24deb0e8a4e5f485e46244cd37250684aedde9476d65e1ce2b5c", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:d38a4ee1572e6280cc5de3bff5b42dcffd1c1c8f7176a522ed8077ce4b6d745f" + "sha256": "sha256:f3ed749e70e4fcd9f3ce0ee1ff9f93d92eda8629d12d7177b59e5794cd2c918f" } ], - "definition_digest": "sha256:f9c92bf28ddd1ec4f04b19e58d206157d8e80782709a4edb45a4fcb88946e94a" + "definition_digest": "sha256:51572c2281a052cff9e6d034a13ba16dbeb7d8474355f72714e86fbff3d06826" } } ] diff --git a/release/security/registry-render-advisory-baseline.json b/release/security/registry-render-advisory-baseline.json index e9bfa0270a..37b31d0b24 100644 --- a/release/security/registry-render-advisory-baseline.json +++ b/release/security/registry-render-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:0f49bf631740edec8c24555a88fedf59350a2ca5be5c76839f2f682c679d67c7", + "sha256:55024998e7b7ecba3230c6b1710d4153c5aeb3fce44d81bfd1b35020268a3656", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82" + "definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", - "component_layer_id": "sha256:0f49bf631740edec8c24555a88fedf59350a2ca5be5c76839f2f682c679d67c7", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", + "component_layer_id": "sha256:55024998e7b7ecba3230c6b1710d4153c5aeb3fce44d81bfd1b35020268a3656", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", - "component_layer_id": "sha256:0f49bf631740edec8c24555a88fedf59350a2ca5be5c76839f2f682c679d67c7", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", + "component_layer_id": "sha256:55024998e7b7ecba3230c6b1710d4153c5aeb3fce44d81bfd1b35020268a3656", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/registry-render; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", + "component_layer_id": "sha256:55024998e7b7ecba3230c6b1710d4153c5aeb3fce44d81bfd1b35020268a3656", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/registry-render", + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" + } + ], + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -191,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26. Render uses the Rust libz-rs-sys backend through flate2; that dependency does not load Debian zlib1g or its affected gz* write implementation.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -249,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -307,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -365,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -423,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -481,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -539,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -597,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } }, { @@ -655,8 +713,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.44.0 Linux amd64 registry-render local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-10-27", + "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +731,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:53e6530080dc563325061205506d19d7c2ade0fbbbe738cbac936c30a73e465d", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:a19a0c66883dc96cd20814459cb1a369f5c12cb60c8a39f938cc29efe53e2924", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:bf60a0f7acdcc774622689f000eec528c6488ec660d76ac4b4542c12f7bd7a82", + "runtime_definition_digest": "sha256:8f4a2791e89104fe1f16169b3d0310fa5d08b22778d41a4c150f92ccb1f73121", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1026b2cdf64920bfb49adfff513eb2a95160dcd68250c8425acc01e5859cfccc" + "sha256": "sha256:e4d11e7f8e686432c0a8cbfb0daa803cfdd276f7fb22643ffb2a72242db6bb85" } ], - "definition_digest": "sha256:f71906147b1a7398b9a448d1104ae0b13788471242f5d3d686d726301ef926d6" + "definition_digest": "sha256:7127ae21088f71dc6d959b9a75264e6ef1d9f6513582cc131621c41887060099" } } ] diff --git a/release/security/scheduling-advisory-baseline.json b/release/security/scheduling-advisory-baseline.json index 9625f57ea6..fd062d5cf2 100644 --- a/release/security/scheduling-advisory-baseline.json +++ b/release/security/scheduling-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:3bd97731707cbe9ed1a74aa7b4ddbd3eec6c1ee4b058da6f2f86c3a926e94c31", + "sha256:00c79df145e0df5c4af129279029ee9f633d5868b57eb5eb16b1f34a036f3089", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c" + "definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59" }, "policies": [ { @@ -75,7 +75,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -92,15 +92,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", - "component_layer_id": "sha256:3bd97731707cbe9ed1a74aa7b4ddbd3eec6c1ee4b058da6f2f86c3a926e94c31", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", + "component_layer_id": "sha256:00c79df145e0df5c4af129279029ee9f633d5868b57eb5eb16b1f34a036f3089", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -133,7 +133,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -150,15 +150,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", - "component_layer_id": "sha256:3bd97731707cbe9ed1a74aa7b4ddbd3eec6c1ee4b058da6f2f86c3a926e94c31", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", + "component_layer_id": "sha256:00c79df145e0df5c4af129279029ee9f633d5868b57eb5eb16b1f34a036f3089", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,68 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" + } + }, + { + "vulnerability_id": "CVE-2026-84243", + "package": "libc6", + "installed_version": "2.41-12+deb13u4", + "severity": "High", + "status": "accepted_risk", + "owner": "@jeremi", + "reviewed_at": "2026-11-01", + "expires_at": "2027-01-26", + "invalidation_triggers": [ + "candidate_image_identity_mismatch", + "candidate_rootfs_changed", + "component_layer_changed", + "expired", + "exposure_assertion_changed", + "exposure_assertion_false", + "exposure_assertion_unevaluable", + "fix_available", + "material_finding_changed", + "package_version_changed", + "rootfs_evidence_mismatch", + "runtime_base_changed", + "runtime_config_changed" + ], + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", + "component_layer_id": "sha256:00c79df145e0df5c4af129279029ee9f633d5868b57eb5eb16b1f34a036f3089", + "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 was reviewed on 2026-11-01. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/scheduling, /usr/local/bin/schedulingctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "exposure_assertion": { + "kind": "whole_image_fingerprint_equals", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", + "reference_provenance": "local_reproduction", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", + "files": [ + { + "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", + "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libc.so.6", + "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libm.so.6", + "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3" + }, + { + "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0", + "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500" + }, + { + "path": "/usr/local/bin/scheduling", + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" + } + ], + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -191,7 +249,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -208,15 +266,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +294,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -249,7 +307,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -266,15 +324,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +352,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -307,7 +365,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -324,15 +382,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +410,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -365,7 +423,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -382,15 +440,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +468,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -423,7 +481,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -440,15 +498,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +526,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -481,7 +539,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -498,15 +556,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +584,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -539,7 +597,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -556,15 +614,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +642,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -597,7 +655,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -614,15 +672,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +700,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } }, { @@ -655,7 +713,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-27", + "reviewed_at": "2026-11-01", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -672,15 +730,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", - "rationale": "Reviewed the v0.44.0 Linux amd64 scheduling local reproduction from review-only rehearsal 40517954609 on 2026-10-27. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41317676125 on 2026-11-01. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:4a1c6a51483ede716dc2bb6898574b5ff342391d4b692b2c1fd0a799634448cf", - "reference_source_revision": "4c6f484c9b01985afb30422e6b297efc122ae4d4", + "reference_image_digest": "sha256:c4e1fd050e90cd06b55688ff4d5df6444709f60f7e3d695da5dbcff8d211115d", + "reference_source_revision": "d68c3e4620bf3edbbd7c89b1e851d1e90693b60a", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:c8c0752ea934194eb36a07228f9caa3f5c46b60c46e2e93966411b0a9498fa0c", + "runtime_definition_digest": "sha256:4c44cbd368de36d8674435339ec317f4a7ee0fc694b3ffb560e0e699ae6f6a59", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +758,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:3b1b153e0b04d3ccd3f2e1b3836b11191e6a1f0a107560a5429dc8c782257bbd" + "sha256": "sha256:1fbba7540ca0c62b5deadb900ba301261a89552c6516c10131dbee5fca3b4b2a" } ], - "definition_digest": "sha256:cdc392a21e8ea542eefb086b66e85fd85c81d593baba070ad22386520c7882d8" + "definition_digest": "sha256:f99757bcc44551103cf84cec91b73bbe8dcaab96b20cd67a3cbd56318c169a28" } } ]