diff --git a/crates/registry-discovery-client/tests/compatibility_metadata.rs b/crates/registry-discovery-client/tests/compatibility_metadata.rs index a07867bfe6..705bc9cd81 100644 --- a/crates/registry-discovery-client/tests/compatibility_metadata.rs +++ b/crates/registry-discovery-client/tests/compatibility_metadata.rs @@ -23,8 +23,8 @@ fn unified_sdk_metadata_names_the_tested_discovery_patch_line_and_proof() { }, "namespaces": { "discovery": { - "testedServerBaseline": "0.45.0", - "compatibleServerPatchLine": "0.45.x", + "testedServerBaseline": "0.46.0", + "compatibleServerPatchLine": "0.46.x", "responseCompatibility": { "additiveObjectMembers": "ignored-after-duplicate-key-rejection", "unknownProblemCodes": "http-status-only", diff --git a/crates/registry-stack-client-node/compatibility.json b/crates/registry-stack-client-node/compatibility.json index 01bbd11062..f42d27a499 100644 --- a/crates/registry-stack-client-node/compatibility.json +++ b/crates/registry-stack-client-node/compatibility.json @@ -6,8 +6,8 @@ }, "namespaces": { "discovery": { - "testedServerBaseline": "0.45.0", - "compatibleServerPatchLine": "0.45.x", + "testedServerBaseline": "0.46.0", + "compatibleServerPatchLine": "0.46.x", "responseCompatibility": { "additiveObjectMembers": "ignored-after-duplicate-key-rejection", "unknownProblemCodes": "http-status-only", diff --git a/crates/registry-stack-client/compatibility.json b/crates/registry-stack-client/compatibility.json index 01bbd11062..f42d27a499 100644 --- a/crates/registry-stack-client/compatibility.json +++ b/crates/registry-stack-client/compatibility.json @@ -6,8 +6,8 @@ }, "namespaces": { "discovery": { - "testedServerBaseline": "0.45.0", - "compatibleServerPatchLine": "0.45.x", + "testedServerBaseline": "0.46.0", + "compatibleServerPatchLine": "0.46.x", "responseCompatibility": { "additiveObjectMembers": "ignored-after-duplicate-key-rejection", "unknownProblemCodes": "http-status-only", diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx index 2a8ba4abca..9a616693fa 100644 --- a/docs/site/src/content/docs/changelog.mdx +++ b/docs/site/src/content/docs/changelog.mdx @@ -18,6 +18,8 @@ relevant product pages on this site rather than duplicating release notes. ## Unreleased +## v0.46.0 beta-58 + - BREAKING: Evidence records a source 409 or 422 as a status answer. The request log and audit `safeErrorCategory` read `source-status` instead of `source-protocol`; the caller still receives `source.unavailable`. Another 4xx, such as 400 or 415, stays `source-protocol` and diff --git a/docs/site/src/data/archive-lock.yaml b/docs/site/src/data/archive-lock.yaml index e277c9b483..a9a80640a9 100644 --- a/docs/site/src/data/archive-lock.yaml +++ b/docs/site/src/data/archive-lock.yaml @@ -190,3 +190,7 @@ archives: bundle_sha256: d9ff2ce15b7e7df37b167918e524b56aef03ccb06ba0923c594d606c24e52755 root_tree_sha256: 08052e7bc324fb0de469a6ef3c784bd3eaaafd7c0a77f917769ec243d90373ed version_tree_sha256: 7e1e9074db16a44946a1b215f8befaa84a39af0aaa8d5c2482bdf60420961452 + v0.46.0: + bundle_sha256: ed92d3585d0c927a1b0a3f41051825d2f56b80fb050635295835e55b1b070aba + root_tree_sha256: 923e0a9b8cc34035eaf0b0602e3fbeac6a97b520c157b1188f4e501bbb55cd33 + version_tree_sha256: 563326ae903409557e8dfa25be53eadce90c5abae319f6c42baee86d71b6d515 diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml index 84d75d4977..03149cdb5f 100644 --- a/docs/site/src/data/docsets.yaml +++ b/docs/site/src/data/docsets.yaml @@ -44,6 +44,46 @@ docsets: registry-documents: version: main source (unreleased) ref: HEAD + - id: v0.46.0 + label: v0.46.0 + path: /v/0.46.0/ + status: archived + availability: candidate + source: registry-stack-v0.46.0 + repo_docs_source: monorepo + published_at: 2026-11-08 + description: Registry Stack v0.46.0 beta-58 candidate documentation set. + products: + registry-stack: + version: v0.46.0 + ref: v0.46.0 + registry-discovery: + version: v0.46.0 + ref: v0.46.0 + registry-manifest: + version: v0.46.0 + ref: v0.46.0 + registry-evidence: + version: v0.46.0 + ref: v0.46.0 + registry-casework: + version: v0.46.0 + ref: v0.46.0 + registry-scheduling: + version: v0.46.0 + ref: v0.46.0 + registry-render: + version: v0.46.0 + ref: v0.46.0 + registry-messaging: + version: v0.46.0 + ref: v0.46.0 + registry-breg-services: + version: v0.46.0 + ref: v0.46.0 + registry-coordinator: + version: v0.46.0 + ref: v0.46.0 - id: v0.45.0 label: v0.45.0 path: /v/0.45.0/ diff --git a/docs/site/src/data/repo-docs.yaml b/docs/site/src/data/repo-docs.yaml index d3d6126067..44befd2048 100644 --- a/docs/site/src/data/repo-docs.yaml +++ b/docs/site/src/data/repo-docs.yaml @@ -143,6 +143,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, odrl ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, odrl ] + last_reviewed: unreviewed description: Operator and integrator documentation for Registry Manifest. - src: products/manifest/docs/validate-and-render.md archive_src: docs/validate-and-render.md @@ -210,6 +213,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl ] + last_reviewed: unreviewed - src: products/manifest/docs/profile-fixtures.md archive_src: docs/profile-fixtures.md dest: products/registry-manifest/profile-fixtures @@ -273,6 +279,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ sp-dci ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ sp-dci ] + last_reviewed: unreviewed - src: products/manifest/docs/reference.md archive_src: docs/reference.md dest: products/registry-manifest/reference @@ -339,6 +348,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, cccev, odrl, w3c-did ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, cccev, odrl, w3c-did ] + last_reviewed: unreviewed - src: products/manifest/docs/itb-semic-validation.md dest: products/registry-manifest/itb-semic-validation label: ITB and SEMIC validation @@ -402,6 +414,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ dcat, bregdcat-ap, shacl, skos, json-schema, json-ld ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ dcat, bregdcat-ap, shacl, skos, json-schema, json-ld ] + last_reviewed: unreviewed registry-evidence: label: Evidence remote: https://github.com/registrystack/registry-stack @@ -473,6 +488,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ openapi, json-schema, sd-jwt-vc ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ openapi, json-schema, sd-jwt-vc ] + last_reviewed: unreviewed description: Operator and integrator documentation for Registry Evidence, the minimum-disclosure assertion service. - src: products/evidence/CONCEPT.md dest: products/registry-evidence/concept @@ -537,6 +555,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ cccev, json-schema, openapi, sd-jwt-vc ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ cccev, json-schema, openapi, sd-jwt-vc ] + last_reviewed: unreviewed description: Approved Version 1 product concept covering the boundary, data model, trust and privacy invariants, native API, and acceptance set. - src: products/evidence/reference/authoring-projects/CONFIG.md dest: products/registry-evidence/authoring-form @@ -601,6 +622,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ json-schema, openapi, sd-jwt-vc ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ json-schema, openapi, sd-jwt-vc ] + last_reviewed: unreviewed description: Complete reference for the editable Evidence authoring project, its validation layers, local key material, and access policies. - src: products/evidence/reference/authoring-projects/SOURCE-EXPORT.md dest: products/registry-evidence/source-exports @@ -665,6 +689,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [] + last_reviewed: unreviewed description: Optional native source import, customized updates, provenance and interrupted transaction recovery. - src: products/evidence/reference/request-adapter/deployment-projects/SOURCE-CREDENTIAL-ROTATION.md dest: products/registry-evidence/source-credential-rotation @@ -729,6 +756,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [] + last_reviewed: unreviewed description: Rotate source credentials with explicit overlap, bounded OAuth caches and verified restart. - src: products/evidence/FIRST-CURL-TEST.md dest: products/registry-evidence/first-curl-test @@ -793,6 +823,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [] + last_reviewed: unreviewed description: Deterministic local curl checkpoint against the Registry Evidence server with a mock source and an in-memory test JWKS. - src: products/evidence/SOURCE-TESTING.md dest: products/registry-evidence/source-testing @@ -857,6 +890,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ sd-jwt-vc ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ sd-jwt-vc ] + last_reviewed: unreviewed description: Source-testing contract with the deterministic mock matrix, opt-in public demo smoke tests, and credential handling rules. - src: products/evidence/SD-JWT-VC-DEMO.md dest: products/registry-evidence/sd-jwt-vc-demo @@ -921,6 +957,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ sd-jwt-vc ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ sd-jwt-vc ] + last_reviewed: unreviewed description: Deterministic local demo that issues one assertion in both later-verifiable formats and re-verifies the credential offline. - src: products/evidence/OPERATOR-CONTRACT.md dest: products/registry-evidence/operator-contract @@ -985,6 +1024,9 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [ openapi, sd-jwt-vc ] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [ openapi, sd-jwt-vc ] + last_reviewed: unreviewed description: Supported deployment shape, requester authority and purpose duties, required configuration and secrets, and readiness, audit, and key obligations. - src: products/evidence/PERFORMANCE.md dest: products/registry-evidence/performance @@ -1049,4 +1091,7 @@ repos: - docsets: [ v0.45.0 ] standards_referenced: [] last_reviewed: unreviewed + - docsets: [ v0.46.0 ] + standards_referenced: [] + last_reviewed: unreviewed description: Measured baseline of the audit-durability throughput trade and the deferred work that would recover most of the cost. diff --git a/products/adapter/CHANGELOG.md b/products/adapter/CHANGELOG.md index 490102f88c..2f2b46cab6 100644 --- a/products/adapter/CHANGELOG.md +++ b/products/adapter/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - A host protocol's verified response can carry one opaque attachment (`VerifiedHostProtocolResponse::with_attachment`) that the engine hands to the embedding Evidence host without reading it; the engine stays free of @@ -255,8 +257,9 @@ text and no change in behavior. - Continuation cursors are sealed and opened through the shared XChaCha20-Poly1305 primitive in `registry-platform-crypto`. The wire format is unchanged (golden - tokens pin it), so a cursor issued before the upgrade still opens, including - under the previous key after a rotation. + tokens pin it), including under the previous key after a rotation; cursors + issued before the upgrade are still refused because of the client binding + described above. - A pending direct BReg delivery is now fenced before it is retried: the job freezes the BReg binding, base URL, token endpoint, caller, TLS trust profile, access profile, Action and mode, and the mapped operation, and a retry that differs stops the pass before any diff --git a/products/breg/CHANGELOG.md b/products/breg/CHANGELOG.md index 2764ca4ab1..0efb10562f 100644 --- a/products/breg/CHANGELOG.md +++ b/products/breg/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - A `record_timer.worker.iteration_failed` warning carries a closed `error` field naming the failure class: PostgreSQL or another runtime dependency was unavailable, a concurrent change conflicted with this timer step, the diff --git a/products/casework/CHANGELOG.md b/products/casework/CHANGELOG.md index 49dafcea52..5ae1713fe3 100644 --- a/products/casework/CHANGELOG.md +++ b/products/casework/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - Each access profile may carry an optional `label` and `description`. Neither is matched against a caller, a profile that writes neither reads as before, and rewording them leaves a policy's behavioral binding unchanged. Casework keeps both in the review policy description, which any caller who may read that description, requesters included, can see. - BREAKING: This release does not read review state stored by 0.45.0 or earlier. A stored review policy that still names `role` on an access profile is refused with a message that says it was stored by an earlier release and names the member, and Casework history stored before the upgrade is not readable after it, and decided reviews still in their result window are not either. Start Casework on a new database when upgrading from 0.45.0 or earlier: activation refuses while any stored review, in any lifecycle, holds the earlier shape. diff --git a/products/coordinator/CHANGELOG.md b/products/coordinator/CHANGELOG.md index e853eafd7a..3c4930f392 100644 --- a/products/coordinator/CHANGELOG.md +++ b/products/coordinator/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - BREAKING: This release does not read workflow snapshots sealed by 0.45.0 or earlier: a snapshot whose project presentation, function or operation holds `title` is refused with `definition.snapshot`. A step `title` in the free-form `presentation.steps` map still restores and is shown as written. Finish open runs on the earlier release before upgrading. - BREAKING: The authored `title` of a project, function, operation and step is diff --git a/products/discovery/CHANGELOG.md b/products/discovery/CHANGELOG.md index 7053ef331b..4f88d6a7bc 100644 --- a/products/discovery/CHANGELOG.md +++ b/products/discovery/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - The serving binary installs its stop-signal handlers before it binds the listener, so a handler that cannot be installed refuses startup. If a signal stream later ends because the runtime's signal driver is gone, shutdown now diff --git a/products/evidence/CHANGELOG.md b/products/evidence/CHANGELOG.md index 6eb92e2a8d..f7ef579c3b 100644 --- a/products/evidence/CHANGELOG.md +++ b/products/evidence/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - Experimental public certificate check. An assertion definition may declare `publicCheck` (`checkCodeFact`, `statusOutput`, `fieldsOutput`) and a target authority may activate it with `publicCheck.definition`. Once activated, diff --git a/products/manifest/CHANGELOG.md b/products/manifest/CHANGELOG.md index 6eaf099166..579b3af98a 100644 --- a/products/manifest/CHANGELOG.md +++ b/products/manifest/CHANGELOG.md @@ -7,6 +7,8 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm ## [Unreleased] +## [0.46.0] - 2026-11-08 + ## [0.45.0] - 2026-11-03 - BREAKING: `registry-manifest` adopts the shared report envelope. Machine-readable diff --git a/products/manifest/docs/release-notes.md b/products/manifest/docs/release-notes.md index b23cae38f4..fe8fc6540d 100644 --- a/products/manifest/docs/release-notes.md +++ b/products/manifest/docs/release-notes.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 + ## 0.45.0 ## 0.44.0 diff --git a/products/messaging/CHANGELOG.md b/products/messaging/CHANGELOG.md index 91089957c4..8369473b2f 100644 --- a/products/messaging/CHANGELOG.md +++ b/products/messaging/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - Each access profile may carry an optional `label` and `description`, accepted for authoring and tooling; Messaging does not serve them until a view exists. Neither is matched against a caller, and a profile that writes neither reads as before. - BREAKING: Messaging access profiles rename `role` to `actsAs`; the values are unchanged; the schema definition `AccessRole` is now `ActsAs`. Migration: in each `accessProfiles` entry, write `actsAs: VALUE` where the file wrote `role: VALUE`. A file that still writes `role` is refused with `config.removed-key` naming `actsAs`. diff --git a/products/platform/CHANGELOG.md b/products/platform/CHANGELOG.md index ba6a92788c..45fddf7cac 100644 --- a/products/platform/CHANGELOG.md +++ b/products/platform/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - `registry-platform-text`: `TextStep::StripNonspacingMarksIn` replaces `StripCombiningMarks`. It strips General_Category Mn characters only inside caller-named code point ranges (1 to 64, `MAX_MARK_RANGES`; an empty, inverted diff --git a/products/render/CHANGELOG.md b/products/render/CHANGELOG.md index 349c6193bf..f621269ad2 100644 --- a/products/render/CHANGELOG.md +++ b/products/render/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - The serving adapter installs its SIGTERM and Ctrl-C handlers together before it accepts requests. The startup error for a handler that cannot be installed now reads "cannot install the stop signal handlers", and a Ctrl-C handler that diff --git a/products/scheduling/CHANGELOG.md b/products/scheduling/CHANGELOG.md index c42419b95d..5b13f21de1 100644 --- a/products/scheduling/CHANGELOG.md +++ b/products/scheduling/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.46.0 - 2026-11-08 + - A holiday set's `label` is optional, as in the Casework holiday-set file; the id names a set that writes none. - BREAKING: This release does not read state stored by 0.45.0 or earlier. A stored policy that still holds `holidaySets[*].because` is refused with a message that says it was stored by an earlier release and names the member. Put Scheduling on a new database. diff --git a/release/manifests/registry-stack-beta-58.yaml b/release/manifests/registry-stack-beta-58.yaml new file mode 100644 index 0000000000..3adc394d38 --- /dev/null +++ b/release/manifests/registry-stack-beta-58.yaml @@ -0,0 +1,93 @@ +stack: + release: beta-58 + version: 0.46.0 + source_repo: registrystack/registry-stack + source_tag: v0.46.0 + +artifacts: + registry-manifest: 0.46.0 + evidence: 0.46.0 + evidencectl: 0.46.0 + evidence-oid4vci: 0.46.0 + evidencectl-installer: 0.46.0 + registry-docs: 0.46.0 + discovery: 0.46.0 + discoveryctl: 0.46.0 + discovery-installer: 0.46.0 + breg: 0.46.0 + bregctl: 0.46.0 + breg-mcp: 0.46.0 + breg-mcp-installer: 0.46.0 + breg-review: 0.46.0 + breg-review-installer: 0.46.0 + breg-installer: 0.46.0 + casework: 0.46.0 + caseworkctl: 0.46.0 + casework-installer: 0.46.0 + scheduling: 0.46.0 + schedulingctl: 0.46.0 + scheduling-installer: 0.46.0 + messaging: 0.46.0 + messagingctl: 0.46.0 + messaging-installer: 0.46.0 + registry-render: 0.46.0 + registry-render-installer: 0.46.0 + registry-manifest-installer: 0.46.0 + coordinator: 0.46.0 + coordinatorctl: 0.46.0 + coordinator-installer: 0.46.0 + adapter: 0.46.0 + adapterctl: 0.46.0 + adapter-installer: 0.46.0 + rstack: 0.46.0 + rstack-installer: 0.46.0 + registry-client-node: 0.46.0 + registry-client-python: 0.46.0 + +identifier_catalog: + path: products/identifiers/generated/catalog.v1.json + sha256: 998d5eb865af548d0b8890838f616af036541245f967c2142409f219addae693 + entry_count: 328 + +external: + thunderid: + kind: image-pin + repo: thunder-id/thunderid + ref: 12f517c4384004e360e26eb7eb1ab0501b678bb2 + version: 1.0.1 + images: + thunderid: ghcr.io/thunder-id/thunderid:1.0.1@sha256:d3c0613ff447a551fd440768a15bdfb6668948e80809cbb50f82d6752f22ab3e + esignet-relay-authenticator: + kind: image-pin + repo: registrystack/esignet-relay-authenticator + ref: 9030f38aac2c85b2e7a2980ec23e2f8e72da97ff + version: 0.6.1 + images: + authenticator: ghcr.io/registrystack/esignet-relay-authenticator:0.6.1@sha256:826ff864a981379dbbdd9bff0f663cd4c1952a1f1fa7c84a076bccce58931dd4 + oidc-ui: ghcr.io/registrystack/esignet-oidc-ui:0.6.1@sha256:2629150e0733ad443d1e563d48790922c88968e93bbf5989a1b9c1974bc109c7 + +warnings: + - code: fresh-state-casework-scheduling + classification: breaking-change + detail: Casework does not read review state stored by v0.45.0 or earlier, and its activation refuses while any stored review holds the earlier shape; Scheduling refuses a stored policy that still holds holidaySets[*].because. Start Casework and Scheduling on new databases. Evidence and Messaging database state is read forward, and the upgrade rehearsal covers only those two products. See release/notes/v0.46.0.md. + - code: coordinator-redefinition-and-admission + classification: breaking-change + detail: The Coordinator Function interpreter ABI is v3, so every definition v0.45.0 froze is refused with definition.abi, and a workflow snapshot that holds title is refused with definition.snapshot. A live run whose definition does not restore is held, a pinned package that does not restore stops startup, and a cancel-review-request step must map the whole output of a submit-review-request step in the same workflow. Admission accepts only a token whose exact sub is listed in the caller policy's subjects and refuses any token with an act claim. Settle runs with the v0.45.0 binaries, check and promote every project again with v0.46.0, and add subjects to every deployment.authentication.policies entry. See release/notes/v0.46.0.md. + - code: deterministic-script-engine + classification: breaking-change + detail: BReg Action plans and hook programs, Messaging provider scripts, Adapter pack scripts, and Evidence Source pack scripts run on a deterministic Rhai engine without timestamp, elapsed, sleep, exit, take, tag, set_tag, parse_json, or get_fn_metadata_list; string pad with an empty padding string fails, and curry no longer compiles, including in Coordinator Functions. The BReg runtime refuses to load an earlier package that calls a removed function, and adapterctl check does not flag affected pack scripts. Remove those calls, pass any time a BReg plan needs as an action input, and rebuild packages. See release/notes/v0.46.0.md. + - code: config-vocabulary-renames + classification: breaking-change + detail: Casework, Messaging, and Document Store access profiles write actsAs instead of role; Coordinator projects, functions, operations, and steps write label instead of title; a Casework holiday-set file writes id instead of holidaySet and a Scheduling holiday set writes label instead of because; the Render runtime writes authentication instead of auth; and evidence-oid4vci writes offers.allowedClients instead of offers.authorizedClients. No old key has an alias, and the caseworkctl dev and messagingctl reports carry actsAs. BReg manifestProjection also requires authorities and publicService.competentAuthority. Update configuration and report readers, then check and rebuild packages with v0.46.0 tools. See release/notes/v0.46.0.md. + - code: evidence-assertion-channel + classification: breaking-change + detail: registry.assertion-evidence/v1 carries a required signed channel member, so assertions signed before this release are refused as malformed payloads, verification policies accept only source by default, and a BReg governed Action accepts only channel source. Evidence evaluate routes answer 400 request.selector-invalid for a selector the Source inputs schema refuses, a source 409 or 422 is recorded as source-status, evidencectl exits 1 with evidence.project.not-found for a missing project, and a fixture without common or privacyExpectation is refused. Reissue assertions, rebuild relying-party bindings and golden fixtures, and update callers, audit readers, alerts, scripts, and fixtures together. See release/notes/v0.46.0.md. + - code: identity-subject-rederivation + classification: breaking-change + detail: Identity generation derives every principal sub and the scope trees from the exact issuer string, so every sub changes once and changing the issuer re-keys every principal; there is no compatibility shim. registry-thunderid-tooling also refuses a machine-client JWKS with private or symmetric key members in development mode and accepts only conforming RSA, EC, and OKP public keys. Update every stored sub, token mapping, and scope reference from identity-receipt.json. See release/notes/v0.46.0.md. + - code: adapter-source-build-changes + classification: breaking-change + detail: For Adapter projects and jobs built from v0.45.0 source, the replay-window response header, the configured govstack-consultation profile, and the dhis2-govstack example are removed; Lookup and Search use the invalid-content problem type; dhis2-tracker paging routes require tie_breaker_attribute; local file sources must declare how a file is complete; the kobotoolbox pack authenticates with an API token; the Kobo workflow finishes an unresolved revision as unresolved-reviewed; job codes are renamed without alias; and earlier cursors and ETags are refused. Before upgrading, settle direct BReg items left pending by v0.45.0 or keep their destination and mapping unchanged; then update projects, jobs, and credentials, repin pack digests, and re-lock. See release/notes/v0.46.0.md. + - code: client-and-crate-api-changes + classification: breaking-change + detail: The Coordinator Rust client RunListQuery is non_exhaustive, the Render Rust client requires a v0.46.0 server and reports an uncertain exchange through is_outcome_unknown, and Render refuses a package without SHA256SUMS as render.package-checksums-missing. registry-platform-script replaces RhaiBaseEngine Standard with Deterministic, registry-platform-sdjwt no longer exports the holder-proof functions, and registry-mcp-edge renames jsonwebtoken to to_jsonwebtoken. Upgrade clients with their servers and update Rust callers and refusal matchers. See release/notes/v0.46.0.md. diff --git a/release/notes/v0.46.0.md b/release/notes/v0.46.0.md new file mode 100644 index 0000000000..9822dec5d3 --- /dev/null +++ b/release/notes/v0.46.0.md @@ -0,0 +1,555 @@ +# Registry Stack v0.46.0 + +Registry Stack v0.46.0 is the beta-58 release. Releases now publish the +Registry Adapter binaries `adapter` and `adapterctl`. Rhai scripts in Base +Registry Engine (BReg), Messaging, the Adapter, and Evidence run on a +deterministic engine, and the products share one configuration vocabulary for +access profiles, display labels, and holiday sets. Registry Render seals +documents with PAdES baseline B-B and B-T signatures. Registry Evidence can +take facts from a wallet-presented credential, adds an OpenID4VP verifier +front end, and adds an experimental public certificate check. BReg names the +competent authority in its Registry Manifest and matches Unicode-equivalent +spellings in blind-index lookups. Registry Coordinator admits callers by exact +subject and holds a run it cannot restore instead of stopping. `rstack` +generates hosted ThunderID configuration from each product's identity facts. + +## Compatibility and upgrade + +Use matching v0.46.0 runtimes, tools, and clients. Back up each deployment and +follow [upgrade and retire](https://docs.registrystack.org/operate/advanced/upgrade-and-retire/). + +BREAKING: Casework and Scheduling start fresh state: + +- Casework does not read review state stored by v0.45.0 or earlier. A stored + review policy that names `role` on an access profile is refused with a + message naming the member, and Casework history and decided reviews still + in their result window are not readable after the upgrade. Start Casework + on a new database; activation refuses while any stored review, in any + lifecycle, holds the earlier shape. +- Scheduling does not read state stored by v0.45.0 or earlier: a stored + policy that still holds `holidaySets[*].because` is refused. Put Scheduling + on a new database. + +BREAKING: the Coordinator does not restore what v0.45.0 froze. The pure +Function interpreter ABI is now `v3`, so every definition frozen by v0.45.0 +records `v2` and is refused with `definition.abi`, whether or not it uses +`curry`. A workflow snapshot whose project presentation, function, or +operation holds `title` is refused with `definition.snapshot`. Settle open +runs with the v0.45.0 binaries, then check and promote every project again +with v0.46.0. A live run whose retained definition this release does not +restore is held alone instead of stopping the deployment; a pinned package it +does not restore still stops startup. + +BREAKING: Coordinator admission accepts a token only when its exact `sub` is +listed in the caller policy's `subjects`, and refuses any token that carries +an `act` claim; both answer 403 `operation.not-authorized`. Add `subjects` +to every `deployment.authentication.policies` entry: the +client's own service-account subject for a producer, and each operator's +subject for an operator policy. + +This release reads the Evidence and Messaging database state v0.45.0 kept. +The release upgrade rehearsal starts from that state, re-authors the +Messaging project for `actsAs`, repackages it, and activates it over the +retained database. The rehearsal covers Evidence and Messaging only. For +BReg, rebuild the package of each project that the Manifest authority or +script engine change below affects; the Manifest change rewrites no stored +row. + +BREAKING: Rhai scripts run on a deterministic engine, so the deadline or +budget each product sets holds for every call a script can make. The engine +no longer provides `timestamp`, `elapsed`, `sleep`, `exit`, `take`, `tag`, +`set_tag`, `parse_json`, or `get_fn_metadata_list`; string `pad` with an +empty padding string, which never returned, now fails; and a script that uses +the `curry` keyword no longer compiles. Remove those calls. This covers: + +- BReg Action plans and Rhai hook programs. `bregctl check` and the package + compile refuse a call by literal name (direct, as a method, or through + `Fn("name")`) with `breg.action.plan-function-unavailable`, naming the + function and its line. The runtime rederives a package when it loads it, so + it refuses to load a package an earlier release built with such a call. A + call the compile cannot see fails the invocation with + `action.handler.execution`, and a hook program that makes one fails its + delivery attempt. Pass any time a plan needs as an action input, and + rebuild the package. +- Messaging provider `prepare`, `interpret`, and `receipt` scripts. A + `prepare` script that makes such a call fails the delivery with + `provider.prepare-failed` and sends nothing. +- Adapter pack scripts, including the packs Evidence Sources run. A script + that makes such a call fails like any failing script, and + `adapterctl check` does not flag it. + +BREAKING: Coordinator Functions can no longer call `curry`; +`coordinatorctl check` refuses a source that uses it and suggests passing the +value as an argument. + +BREAKING: the products share one configuration vocabulary, with no alias. +Rename these keys before you check, package, or activate with v0.46.0 tools. +Each old key is refused with `config.removed-key` naming its replacement, +unless noted: + +- Casework, Messaging, and Document Store access profiles write `actsAs` + where they wrote `role`, with unchanged values. The schema definitions + `CaseworkRole` and `AccessRole` are now `CaseworkActsAs` and `ActsAs`, the + diagnostic `casework.access-profile.missing-role` is now + `casework.access-profile.missing-acts-as`, and the `caseworkctl dev` and + `messagingctl` reports carry `clients[].actsAs` and + `accessProfiles[].actsAs`. +- A Casework holiday-set file names itself with `id` where it wrote + `holidaySet`; a calendar still names its set in + `calendars..holidaySet`. A Scheduling holiday set writes `label` where + it wrote `because`, and the schema definition `HolidaySetPolicy` is now + `HolidaySet`; `because` is unchanged on every other Scheduling item. +- A Coordinator project, function, operation, and step write `label` where + they wrote `title`. `check --explain` reports `presentation.label`, and the + duplicate-title diagnostics are now + `coordinator.project.duplicate-function-label`, + `coordinator.project.duplicate-operation-label`, and + `coordinator.project.duplicate-step-label`. +- The Render runtime file's `auth` block is `authentication`; its `oidc` and + `apiKeyRef` members are unchanged. A file that still says `auth` is refused + at `/auth`. +- The `evidence-oid4vci` runtime member `offers.authorizedClients` is + `offers.allowedClients`. The old name is refused as an unknown key. + +BREAKING: `registry.assertion-evidence/v1` carries a required, signed +`channel` member, `source` or `holder-presented`. Assertions signed before +this release lack it and are refused as malformed payloads; reissue them. +Verification policies accept only `source` unless they list another channel +in `acceptedChannels`, and a BReg governed Action accepts only +`channel: source`, refusing others through `action.evidence_failed`. Rebuild +relying-party bindings and regenerate golden fixtures that carry assertions +without a `channel`. + +## Registry Adapter + +Registry Stack releases now publish the Adapter's `adapter` facade and its +`adapterctl` tool for Linux amd64, Linux arm64, and macOS arm64, with an +`adapter-v0.46.0-install.sh` installer and an `adapter` component for +`rstack install`. `rstack adapter` runs `adapterctl`. There is no Adapter +container image, and the `adapter-job` ingestion host is not released yet: +build it from the tagged source. `adapter` gains `--version`, and +`adapter-job --version` reports the Registry Stack display version. + +The facade serves GovStack Digital Registries Read and direct Write from +source packs. The Write path (direct Create and conditional Update) is +experimental; `CONSULTATION.md` lists what a source must offer to back it, +and BReg is the one maintained source that does. + +BREAKING for Adapter projects and jobs built from v0.45.0 source: + +- The facade no longer sends the + `x-registry-idempotency-replay-window-seconds` response header. Capability + discovery publishes the window as `write.idempotencyReplayWindow` on every + Create and Update entry; a read-only deployment publishes none. +- Lookup and Search answer an invalid field or value with the problem type + `https://govstack.global/problems/digital-registries/invalid-content` + instead of `.../invalid-field`, the type Write already used. +- The configured `govstack-consultation` profile, the `dhis2-govstack` + example, and its fixtures are removed. Declare a `consultation:` section in + the project to use the built-in GovStack Consultation profile (see + `examples/dhis2-consultation`); a configured profile named + `govstack-consultation` no longer gets any GovStack behaviour. +- The `dhis2-tracker` routes `page-tracked-entities` and + `page-tracked-entities-by-org-unit` take a required `tie_breaker_attribute`, + the UID of a unique program attribute, because DHIS2 2.43 refuses + `trackedEntity` as a sort key. Add it to each templated route that uses + them and re-lock the project. +- A local file job source must declare how it knows a file is complete: + `doneFileName`, `readLock: changed`, or `producerAtomicHandover: true`. + `adapterctl job check` and `adapter-job` startup refuse a source with none. + `readLock: changed` suits a producer you do not control. +- The `kobotoolbox` pack authenticates with the account's API token + (`static-authorization`, `scheme: Token`) instead of Basic, so a leaked + credential no longer signs in to the Kobo web UI. Replace the `kobo-api` + credential's `usernameRef` and `passwordRef` with + `type: static-authorization` and a `tokenRef`, bind the token of an account + restricted to the form, and repin the pack digest in `project.yaml` and the + job file. To keep Basic, pin your own copy of the pack with `type: basic`. +- The Kobo Coordinator workflow finishes an unresolved-lookup revision as + `unresolved-reviewed` instead of `revised-reviewed`. A client that matches + that outcome must match the new one. +- Job item and check codes are renamed with no alias. A destination's + refusal is stored as `adapter.job.breg.` or + `adapter.job.coordinator.`; rows written by an earlier release keep + the old spelling, so match both until those rows are settled. + `adapter.job.trigger-hook-unserved` splits into + `adapter.job.trigger-hook-binding`, `adapter.job.trigger-hook-path`, and + `adapter.job.trigger-member`. Postgres send member faults move to + `adapter.job.postgres-send-members`, and the missing JSONL key pointer to + `adapter.job.poll-key-pointer`. The host code + `adapter.job.hook-configuration` splits into + `adapter.job.hook-configuration-trigger`, + `adapter.job.hook-configuration-ingress-missing`, + `adapter.job.hook-configuration-ingress-unused`, + `adapter.job.hook-configuration-binding`, and + `adapter.job.hook-configuration-path`, and + `adapter.job.hook-not-compiled` into + `adapter.job.hook-not-compiled-trigger` and + `adapter.job.hook-not-compiled-ingress`. + +Also when upgrading a source build: + +- Continuation cursors are bound to the client the caller acts through + (`azp` or `client_id`) as well as the issuer and subject. Cursors issued + before the upgrade are refused with `invalid-cursor`; restart the traversal + from its first page. +- GovStack Update ETags also bind the companion read's route and the pack's + code maps, under closure domain `v3`. ETags issued before the upgrade + return 412 and need a fresh companion read. +- A pending direct BReg delivery is fenced before it is retried, and a retry + whose destination or mapped operation differs stops the pass before any + BReg call as `adapter.job.breg-receiver-changed` or + `adapter.job.breg-body-changed`. A direct BReg item left pending by v0.45.0 + has no recorded identity, so its first retry under this release adopts the + current destination and mapping: settle those items with v0.45.0, or keep + the destination and mapping unchanged, before upgrading. A row staged + before store schema 103 stops as `adapter.job.breg-identity-unrecorded`. +- A pack route's `writeSupport` is flat: `type` is `create-one` or + `conditional-update-one`, with `replayWindowSeconds`, and the single-value + `identity`, `replay`, and `precondition` members are removed. The unused + `range`, `set-membership`, and `prefix` source comparisons are removed; + only `equality` remains. +- The `dhis2-tracker` pack's Evidence lookups send `orgUnitMode=SELECTED` + with their organisation unit. The `dhis2-tracker` and `kobotoolbox` pack + digests change. +- Regenerate committed `generated/openapi.json` files with + `adapterctl compile`: the GovStack OpenAPI declares the `recordId` and + `Idempotency-Key` bounds the facade enforces. + +Mapping, authoring, and the facade: + +- Add the declarative AdapterMapping format (`kind: AdapterMapping`). + `adapterctl mapping check`, `mapping generate`, and `mapping preview` check + a mapping against the target schema, generate the pinned Rhai script from + it, and preview it over sample inputs, all offline, and + `adapterctl job lock` rewrites a job's mapping digest pin. + `mapping check` reports the target schema as `targetTree` and its root + `title` as `targetTitle`, each finding about one field names it in + `target`, and the `adapter.mapping.script-drift` warning names its `cause`. +- Preview samples can record their expected result in + `preview/expected.yaml`; a result that differs raises + `adapterctl.mapping-preview-mismatch` and exits 1. `mapping preview` also + takes `--deny-warnings`. +- A quoted selector key or filter literal takes any Unicode character except + a control character, a text-direction control, or a line or paragraph + separator, so a source key such as `prénom` can be mapped. Keys compare + byte for byte. +- `adapterctl job check` warns with `adapter.job.mapping-unprojected` when a + generated `direct-breg` mapping reads a source key that the job's + `projection.fields` does not list. +- A project needs less configuration: a Consultation collection's `view` + defaults to its `dataSchema`, its `transform` applies to every Retrieve, + Lookup, List, and Search binding of that record type unless + `bindingTransforms` names one, `recordTypes` entries with no fields are + derived from the collections, `maximumUpstreamCalls` defaults to 4, and a + Write Update's `companionRead` is inferred when exactly one Retrieve or + `writable-read` binding serves the record type. The explicit forms stay + valid. A job profile may omit `read` when + its source route reads no file and no PostgreSQL row. +- `adapterctl check` and the Adapter's load refuse a `writable-read` binding + that no Write Update names, instead of stopping the Adapter. The mapping + commands refuse a `mapping.targetSchema` that a symbolic link resolves + outside the model's directory, and an integer constant above 2^53 that only + rounds to a target `enum` or `const` member (it used to fail every record + at run time). A job pass stops as + `adapter.job.projection-flat-dotted-name`, before staging any item, when a + dotted projection field misses as a path but the row has a flat member of + that name. +- GovStack Update replays its stored answer for a retry under the same + `Idempotency-Key` and fingerprint even when its If-Match no longer opens, + no longer returns 406, and refuses an object-valued merge-patch member with + 422 `invalid-content`. A Lookup identifier that cannot travel as a source + path segment answers 404 `record-not-available` instead of 500. + +## Evidence wallet presentations and public checks + +- An assertion definition's `acquisition` accepts an optional + `holderPresented: {source, selectorProfiles}` block beside `source`, and a + request's selector profile selects exactly one channel, with no fallback. + The built-in `wallet-presentation-v1` host protocol reads a holder's + presentation from the wallet protocol service, verifies it in Evidence, and + hands the route only the declared claims. Holder binding is always + required, a `status` of `required` is refused until status checking is + available (state `not-checked`), a holder-presented definition answers only + as a signed JWS assertion, and `maximumCredentialAgeSeconds` accepts up to + ten years. For a definition granted on both channels, the Discovery entry + states its `channel` and, for an entitled caller, an `alternatives` member + with the holder-presented shape. No wallet is claimed until a reviewed + real-wallet receipt exists. +- Add the `registry-evidence-oid4vp` OpenID4VP verifier front end, with + `x509-san-dns`, `x509-hash`, `decentralized-identifier` (`did:web`), and + `pre-registered` client identifiers. It implements OpenID4VP 1.0 and the + HAIP 1.0 verifier flow profile and is not certified. A presentation is + consumed by its first successful read. Rate limit its wallet-facing paths + per source at your ingress. +- `evidence-oid4vci` adds an optional OpenID4VCI Draft 13 compatibility + profile (`draft13Profile: {}`) for wallets that accept third-party issuance + only over Draft 13. It is served at its own issuer identifier beside the + 1.0 Final profile, whose routes and wire behaviour are unchanged. +- `evidence-oid4vci` sends the shared security headers, bounds request + bodies, and rate limits requests, answering 429 `temporarily_unavailable` + with `Retry-After` past a budget. The optional `rateLimits` block sets the + budgets (defaults: `offersPerPrincipalPerMinute` 600, `offerBurst` 60, + `walletRequestsPerMinute` 3000, `walletRequestBurst` 300); check that they + suit your wallet traffic before upgrading a busy deployment. Framework + rejections answer in the service's JSON error shape, and a token form that + cannot be decoded answers 400 `invalid_request` instead of 422. +- A bundle's signing block takes an optional `signing.certificateChainFile`. + With it, issued SD-JWT VC credentials and the served JWKS entry for the + active key carry the chain as `x5c`; without it, issued headers and the key + set are unchanged. +- Experimental public certificate check: a target authority activates a + definition's `publicCheck`, and `POST /v1/public-check` answers, without + authentication, the status, printed fields, and evaluation time of one + certificate from a `documentNumber` and a 24-character `checkCode`. The + answer is unsigned and Evidence does not rate limit the route: expose it + only through a path-restricted proxy that limits each client and keeps no + client addresses. See `examples/public-check/`. +- `normalise_name(profile, value)` is a Rhai primitive for one exact name + comparison under the `name-match-v1` profile, which keeps the marks that + are part of a spelling, such as a Devanagari virama, nukta, or anusvara. +- BREAKING: a source that answers 409 or 422 is recorded as a status answer. + The request log and audit `safeErrorCategory` read `source-status` instead + of `source-protocol`, and a 409 or 422 no longer counts toward + `evidence_source_shape_drift_total`. The caller still receives + `source.unavailable`. Update audit readers, log queries, and alerts that + match `source-protocol` for a source 409 or 422. +- BREAKING: on the single and batch evaluate routes, a selector value that + passes its profile but that the Source's inputs schema refuses answers + `400 request.selector-invalid` instead of `503 service.unavailable`. It + counts against the caller's selector-failure budget, and one such item + refuses the whole batch. A caller that retried that 503 should correct the + selector instead. +- BREAKING: `evidencectl check`, `test`, and the other project commands + refuse a directory with no `evidence.yaml` with exit 1 and + `evidence.project.not-found`, where they exited 3. Update scripts that + match exit status 3 for a missing project. +- BREAKING: `evidencectl check` and bundle loading refuse a fixture without a + `common` or `privacyExpectation` mapping as `evidence.fixture.missing-block`; + a coequal acceptance fixture needs only `privacyExpectation`. Add + `common: {}` and `privacyExpectation: {}` to a fixture that lacks them. +- `evidencectl target new --local` declares the source connections and + extract bindings of the project's `local-target.yaml`, so a fresh starter + checks and packages against it, and `target new` accepts a bare file or + directory name. The `evidencectl package --format json` report carries + `requirements[]` with each requirement's `configurationRevision`. +- Startup and `evidencectl doctor` name the source, endpoint, and broken rule + when a pack source does not compile against its connection, reported as + `evidence.deployment.refused`. A malformed `pack.yaml` is reported at its + file, line, and key, and a Source `route` the pack does not declare as + `evidence.pack.route-missing`. + +## BReg + +BREAKING: `manifestProjection` declares the identified public authorities +the Registry Manifest names in a required `authorities` list (`id`, `name`, +optional `iri` and `authorityType`, shaped like `catalog.publisher`), and +`publicService` names the authority legally competent for it in a required +`competentAuthority`. The Manifest carries them in `authorities[]` and +`public_services[].competent_authority`, so CPSV-AP renders +`hasCompetentAuthority` for that authority instead of the catalogue +publisher. A project without either key is refused with `config.missing-key`; +an empty list with `breg.manifest-projection.authorities-empty`; a repeated +id with `breg.manifest-projection.authority-duplicate`; an empty name with +`breg.manifest-projection.authority-name-empty`; a lookalike id with +`breg.manifest.authority-id-collision`; and an id that names no authority +with `breg.manifest-projection.competent-authority-dangling`. To keep the +previous Manifest output, copy the publisher as the single authority: + +```yaml +manifestProjection: + authorities: + - id: + name: + publicService: + competentAuthority: +``` + +Carry `iri` and `authorityType` across when the publisher writes them. Dataset +`owner` is unchanged, and `bregctl init --from` writes both keys. Rebuild the +package. The artifact revisions of a project that projects a Manifest +change; its SQL, Action fingerprints, and stored rows do not. + +- Blind-index `lookup.normalization` gains `nfc` and `case-fold`, so the + composed and decomposed spellings of one name match and a `unique` index no + longer accepts both. List `nfc` first for name-like fields; existing steps + keep their digests. +- Changing only the `normalization` list of an encrypted lookup is now a + reviewed `field-encryption-backfill` re-index. The registry stays in + maintenance and serves no Record reads or writes for the whole re-index, + and once the first chunk commits the target cannot be reverted, only + resumed by retrying the same `apply`. `bregctl field-encryption preflight` + reports each step's row count and the records that would collide, and + holds an `ACCESS EXCLUSIVE` lock on the Record type's table for the whole + scan: run it in a quiet window. +- A reviewed plan whose authored SQL writes a blind-index column is refused + with `BlindIndexWrite`, a re-index step over its `maxTotalRows` is refused + before any write, and a `field-encryption-backfill` step whose object names + another Record type is refused as an invalid descriptor. Every + field-encryption check runs before the apply commits anything, so a + refused flip stays `revertible`. +- `breg.access-profile.task-grant-rows-unbound` flags a task-grant profile + that binds no rows on a non-public Record type. +- A `record_timer.worker.iteration_failed` warning carries a closed `error` + field naming the failure class, never a record, SQL, or handler value. +- An infinite metric value renders `+Inf` or `-Inf`, as the Prometheus text + format requires. + +## Coordinator + +- BREAKING: a live run whose retained definition this release does not + restore is held alone instead of stopping the deployment. It shows state + `attention` with failure code `definition-refused`. Nothing runs for it, + and `retry-same`, `reconcile`, and `cancel` refuse it with 409 + `run.definition-incompatible`. Startup, readiness, admissions, apply, and + every other run continue; `attention=true`, doctor (`state.heldRunCount`, + `state.heldRuns`), and `deployment-status` (`heldRuns`) list held runs. A + pinned package this release does not restore still stops startup. +- Restore refusals give operator context: a pinned package refusal names its + package digest and workflow, and a held run names its run id and workflow. +- BREAKING: `coordinatorctl check` refuses a + `casework.cancel-review-request/v1` step unless its `request` maps the + whole output of a `casework.submit-review-request/v1` step in the same + workflow (`definition.review-request-not-run-owned`). The service does not + start on a pinned package that breaks the rule, and a run admitted under + such a definition is held. +- BREAKING: the Rust client's `RunListQuery` is `#[non_exhaustive]`, so a + struct literal no longer compiles. Build it with `RunListQuery::new(limit)` + and chain `with_cursor`, `with_state`, `with_attention`, `with_proposal`, + `with_turn`, and `with_outcome`. +- `GET /v1/runs` and `coordinatorctl list` take `outcome=` + (`--outcome`), and the Node.js and Python `list` take it as a last + argument. +- A Proposal wait whose read shows BReg applying the Proposal automatically + (`submitted`, `turn: nobody`) reads again at the read floor (default 30 + seconds) instead of after `resultCheckSeconds` (default 900). +- `workflow.eventTriggers.` takes an optional `label` and `description`, + which never change the `workflowRevision`. + +## Render document seals + +- Add optional PAdES sealing at baseline B-B and B-T. A document type names a + `seal` in its manifest, and the runtime file's `signing.seals` binds each + seal to a signer, a certificate chain file, a timestamp policy + (`timestampAuthority` for B-T, or `withoutTimestamp` for B-B), and the OIDC + clients allowed to use it. The signer is an ECDSA P-256 key in Vault or + OpenBao Transit, reached through a signing proxy on a Unix socket and + pinned by `mount`, `keyName`, and `keyVersion`, or, under the `local` + profile, a `local-jwk` key file. +- A runtime that declares a seal also declares `assuranceProfile`. + `production` seals sign only through Transit; `local` seals sign only with + a `local-jwk` key file and are test seals, marked so in the answer, an + `X-Registry-Seal-Test-Only` header, `/ready`, and the audit. +- `POST /v1/seal/{type}` needs the `render:seal` scope, which `render:render` + does not imply and the legacy API key never has. It answers the sealed PDF + with labelled digests. A failing timestamp fails the request and never + falls back to B-B. Seal requests add the problem kinds + `signing-unavailable` (26), `seal-certificate-invalid` (27), + `timestamp-failed` (28), `document-not-sealable` (29), and + `seal-client-not-allowed` (30). +- `registry-render keygen` writes a seal key and a PKCS #10 certificate + request, or has a Transit key sign the request, and + `compile --preview-seal` renders a template's sealed variant offline. +- Render makes no eIDAS qualification claim. `EVIDENCE.md` records the + pyHanko, EU DSS, and veraPDF runs on sealed files. +- BREAKING: a package without its `SHA256SUMS` is refused as + `package-checksums-missing` (HTTP code `render.package-checksums-missing`) + instead of `bundle-unsealed`; the exit code stays 5. +- The render route adds `pdfDigest` and `dataDigest`, and the + `X-Registry-Pdf-Digest` and `X-Registry-Data-Digest` headers; `pdfSha256`, + `dataSha256`, and their headers are deprecated and still sent. + `registry-render-client`'s `RenderedDocument` requires the new members, so + it needs a v0.46.0 server. `RenderClientError` reports an uncertain + exchange through `is_outcome_unknown()` in place of a public field, and the + seal types are `#[non_exhaustive]`. +- Every render worker starts from an empty environment apart from the + dynamic loader's library search paths, so a credential in the parent's + environment, `RAYON_NUM_THREADS`, and `MALLOC_ARENA_MAX` no longer reach + it. On Linux, `serve` marks itself non-dumpable. The render timeout also + bounds a worker's exit after it answers. + +## Hosted identity generation + +- `rstack identity generate thunderid --deployment FILE --output NEW_DIR` + runs each selected product's `generate identity-facts` command, merges the + facts, and writes the hosted ThunderID configuration. Select products with + `--breg-project` and `--breg-runtime-config`, `--casework-project` and + `--casework-runtime-config`, `--evidence-project` and `--evidence-target`, + and `--messaging-runtime-config`. The driven tools must be the same release + as `rstack`. No secret is read or printed, and an existing output directory + is refused. `rstack identity check` checks an identity facts document or + deployment file offline. +- `bregctl`, `caseworkctl`, `evidencectl`, and `messagingctl` add + `generate identity-facts`, which writes a `registry.identity-facts/v1` + document from the product's configuration, so the generator gives each + principal the claims and actor kind the product requires or refuses the + grant. +- BREAKING: identity generation derives every principal `sub` and the scope + trees from the issuer, in separate namespaces for machine clients, browser + apps, users, extension user types, connections, organization units, and + roles. Every `sub` changes once, and a product keyed on `sub` sees new + principals: update every stored `sub`, token mapping, and scope reference + from `identity-receipt.json`. No compatibility shim exists. Changing the + issuer string, even by a trailing slash, re-keys every principal. +- BREAKING: `registry-thunderid-tooling` refuses a machine-client JWKS with + private or symmetric key members in development mode too, and accepts only + RSA, EC, and OKP public keys with a unique, non-empty `kid` and the lengths + ThunderID requires. + +## Other changes + +- Every runtime image overlays zlib1g `1:1.3.dfsg+really1.3.1-1+deb13u1` + from DSA-6613-1 for CVE-2026-76844, CVE-2026-85091, and CVE-2026-27171, + beside the libc6 and libssl3t64 overlays. +- BReg, Casework, Coordinator, Document Store, Messaging, and Scheduling each + publish a `SECURITY-MODEL.md`. +- The products share the platform access-token algorithm roster, + framework-rejection normalization, stop-signal handling, and Prometheus + exposition; the accepted access-token algorithms are unchanged. BReg, + `breg-mcp`, `registry-mcp`, Discovery, Evidence, `evidence-oid4vci`, and + Render now refuse startup when a stop-signal handler cannot be installed. + `breg-mcp`, `registry-mcp`, Coordinator, Document Store, and Messaging + install SIGINT at startup alongside SIGTERM. +- Messaging bounds `messaging_http_requests_total` at 512 series and + `messaging_authentication_refusals_total` at 8, logging a warning by metric + name past the bound. +- Casework, Messaging, Document Store, and Evidence target-authority access + profiles take an optional `label` and `description`, and a Scheduling + holiday set's `label` is optional. +- BREAKING for Rust platform crate users: `registry-platform-script` replaces + `RhaiBaseEngine::Standard` with `RhaiBaseEngine::Deterministic`, and + `registry-platform-hooks` hook programs run on it; + `registry-platform-sdjwt` no longer exports the holder-proof functions and + types, which moved to `registry_evidence_verifier::holder_proof`; and + `registry-mcp-edge` re-exports the `registry-platform-oidc` + `AccessTokenAlgorithm`, whose `jsonwebtoken()` is now `to_jsonwebtoken()`. +- New platform crates `registry-platform-text`, `registry-platform-metrics`, + and `registry-platform-x509`. `registry-platform-crypto` adds compact JWS, + ECDH-ES JWE decryption, XChaCha20-Poly1305 sealing, and the opt-in + `cms-signing` feature for PAdES signatures. + +Registry Document Store remains source-only in v0.46.0, as do the Adapter's +`adapter-job` host and `evidence-oid4vp`. + +See the [changes since v0.45.0](https://github.com/registrystack/registry-stack/compare/v0.45.0...v0.46.0) +and the principal changes in +[#2552](https://github.com/registrystack/registry-stack/pull/2552), +[#2554](https://github.com/registrystack/registry-stack/pull/2554), +[#2558](https://github.com/registrystack/registry-stack/pull/2558), +[#2561](https://github.com/registrystack/registry-stack/pull/2561), +[#2562](https://github.com/registrystack/registry-stack/pull/2562), +[#2566](https://github.com/registrystack/registry-stack/pull/2566), +[#2569](https://github.com/registrystack/registry-stack/pull/2569), +[#2573](https://github.com/registrystack/registry-stack/pull/2573), +[#2574](https://github.com/registrystack/registry-stack/pull/2574), +[#2575](https://github.com/registrystack/registry-stack/pull/2575), +[#2577](https://github.com/registrystack/registry-stack/pull/2577), +[#2578](https://github.com/registrystack/registry-stack/pull/2578), +[#2581](https://github.com/registrystack/registry-stack/pull/2581), +[#2589](https://github.com/registrystack/registry-stack/pull/2589), +[#2594](https://github.com/registrystack/registry-stack/pull/2594), +[#2600](https://github.com/registrystack/registry-stack/pull/2600), +[#2606](https://github.com/registrystack/registry-stack/pull/2606), +[#2610](https://github.com/registrystack/registry-stack/pull/2610), +[#2611](https://github.com/registrystack/registry-stack/pull/2611), and +[#2612](https://github.com/registrystack/registry-stack/pull/2612). diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index 7e7834a32e..97b0b0d2fc 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -31,23 +31,23 @@ ROOT / "release/security/registry-render-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "breg": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "casework": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "discovery": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "evidence": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "scheduling": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "breg-mcp": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "breg-review": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "evidence-oid4vci": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "messaging": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "registry-render": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", + "breg": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "casework": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "discovery": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "evidence": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "scheduling": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "breg-mcp": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "breg-review": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "evidence-oid4vci": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "messaging": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "registry-render": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", } -LIVE_REFERENCE_SOURCE_REVISION = "e1f2772def2febbc477854ba2e8a5c447eef9893" +LIVE_REFERENCE_SOURCE_REVISION = "a0830b887341de03c32be7f74c15d45c2b9379a4" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest # exception. Move it forward by hand when the baselines are renewed. -LIVE_REVIEW_EVALUATION_DATE = "2026-11-03" +LIVE_REVIEW_EVALUATION_DATE = "2026-11-08" LIVE_REFERENCE_PROVENANCE = { "breg": "local_reproduction", "casework": "local_reproduction", diff --git a/release/security/breg-advisory-baseline.json b/release/security/breg-advisory-baseline.json index 46c80aadce..33e20872d9 100644 --- a/release/security/breg-advisory-baseline.json +++ b/release/security/breg-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:cd8adb0ebc617c0f556100dd5f053741492a86e4c1b87f3a9b737de79efc13b0", + "sha256:bae206e87669b0ac10b7b7ca276e838ff4dca7f9c73b0b9137a78711b112d3fe", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -51,7 +51,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866" + "definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951" }, "policies": [ { @@ -74,8 +74,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -92,14 +92,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", - "component_layer_id": "sha256:cd8adb0ebc617c0f556100dd5f053741492a86e4c1b87f3a9b737de79efc13b0", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", + "component_layer_id": "sha256:bae206e87669b0ac10b7b7ca276e838ff4dca7f9c73b0b9137a78711b112d3fe", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -119,10 +119,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -132,8 +132,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -150,14 +150,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", - "component_layer_id": "sha256:cd8adb0ebc617c0f556100dd5f053741492a86e4c1b87f3a9b737de79efc13b0", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", + "component_layer_id": "sha256:bae206e87669b0ac10b7b7ca276e838ff4dca7f9c73b0b9137a78711b112d3fe", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -177,10 +177,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -190,8 +190,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg, /usr/local/bin/bregctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg, /usr/local/bin/bregctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -208,14 +208,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", - "component_layer_id": "sha256:cd8adb0ebc617c0f556100dd5f053741492a86e4c1b87f3a9b737de79efc13b0", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", + "component_layer_id": "sha256:bae206e87669b0ac10b7b7ca276e838ff4dca7f9c73b0b9137a78711b112d3fe", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -235,10 +235,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -248,8 +248,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -266,14 +266,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -293,10 +293,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -306,8 +306,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -324,14 +324,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -351,10 +351,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -364,8 +364,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -382,14 +382,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -409,10 +409,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -422,8 +422,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -440,14 +440,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -467,10 +467,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -480,8 +480,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -498,14 +498,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -525,10 +525,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -538,8 +538,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -556,14 +556,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -583,10 +583,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -596,8 +596,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -614,14 +614,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -641,10 +641,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } }, { @@ -654,8 +654,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -672,14 +672,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:24aa7ea7e1b9059a2a567727dacbc5952ecfae0cb5bf5edf6565f82f63020be8", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866", + "runtime_definition_digest": "sha256:15dafd4460bde29e5aabaf461bf76e1c4b4175de2277d036afdbdfc765415951", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -699,10 +699,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b" + "sha256": "sha256:d67f93827d3039df6b8424ed229b258a53132f13c6b3be3b63dfb983d939f56d" } ], - "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef" + "definition_digest": "sha256:14d144cb4ff8e7c7d4263a25676bef02c969c327777fc03259fed10aea8f7c64" } } ] diff --git a/release/security/breg-mcp-advisory-baseline.json b/release/security/breg-mcp-advisory-baseline.json index 78317ac514..123cea0530 100644 --- a/release/security/breg-mcp-advisory-baseline.json +++ b/release/security/breg-mcp-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:f06d74eba5af906458781c97bf89853d2d1b2e613dd23908b0483a5ae0deeb4e", + "sha256:c939c5e8d22887b59e8525a75f0ef546546cc6732112d9d4420b545a3bd6caaa", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27" + "definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", - "component_layer_id": "sha256:f06d74eba5af906458781c97bf89853d2d1b2e613dd23908b0483a5ae0deeb4e", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", + "component_layer_id": "sha256:c939c5e8d22887b59e8525a75f0ef546546cc6732112d9d4420b545a3bd6caaa", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", - "component_layer_id": "sha256:f06d74eba5af906458781c97bf89853d2d1b2e613dd23908b0483a5ae0deeb4e", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", + "component_layer_id": "sha256:c939c5e8d22887b59e8525a75f0ef546546cc6732112d9d4420b545a3bd6caaa", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg-mcp; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg-mcp; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", - "component_layer_id": "sha256:f06d74eba5af906458781c97bf89853d2d1b2e613dd23908b0483a5ae0deeb4e", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", + "component_layer_id": "sha256:c939c5e8d22887b59e8525a75f0ef546546cc6732112d9d4420b545a3bd6caaa", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:ab168f3d8b12451892fff53ac7ee2f4e577ae947b65a756a5c98db627ced2b1f", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27", + "runtime_definition_digest": "sha256:0576ed3c5e30542d0187dcc592d7856ea812daf37d27420f6c4ee0fda1d65525", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463" + "sha256": "sha256:38c89045f851037f77c032e83668019567a219d4d790b0fc7b94cb19f5df203f" } ], - "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a" + "definition_digest": "sha256:4f7b1cf850ef4fce9e63effd56ecabe60aa30fcd00d12b40f602dc3b9eed7103" } } ] diff --git a/release/security/breg-review-advisory-baseline.json b/release/security/breg-review-advisory-baseline.json index ec798d813c..337faa0699 100644 --- a/release/security/breg-review-advisory-baseline.json +++ b/release/security/breg-review-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:c04d31edfdf8dc74ae19411a26264588292f073627af1f709df893d7d6b82043", + "sha256:db6154604955f303b5a587622ae0e8e53c2af5f425f9c2e2cde4e12c136a18e4", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b" + "definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", - "component_layer_id": "sha256:c04d31edfdf8dc74ae19411a26264588292f073627af1f709df893d7d6b82043", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", + "component_layer_id": "sha256:db6154604955f303b5a587622ae0e8e53c2af5f425f9c2e2cde4e12c136a18e4", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", - "component_layer_id": "sha256:c04d31edfdf8dc74ae19411a26264588292f073627af1f709df893d7d6b82043", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", + "component_layer_id": "sha256:db6154604955f303b5a587622ae0e8e53c2af5f425f9c2e2cde4e12c136a18e4", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg-review; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/breg-review; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", - "component_layer_id": "sha256:c04d31edfdf8dc74ae19411a26264588292f073627af1f709df893d7d6b82043", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", + "component_layer_id": "sha256:db6154604955f303b5a587622ae0e8e53c2af5f425f9c2e2cde4e12c136a18e4", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 breg-review local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1d09071cfda8be8d46a1c5d08411ab463f57b561d153aa19e857ccdadc9cc01b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b", + "runtime_definition_digest": "sha256:285323331deb2722a73da5351e8ff0b50234f85f9008f86312152d689cb2e19d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28" + "sha256": "sha256:fc2b5f8399610d322aff008f6fef3a316502dc7760d7f372f4faa51d61fee1d5" } ], - "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe" + "definition_digest": "sha256:a434fb27da67ed27a9da413960fe02ac795a89d4a61cfab98674aacb74ba825f" } } ] diff --git a/release/security/casework-advisory-baseline.json b/release/security/casework-advisory-baseline.json index 1f87335eed..57e9ab810d 100644 --- a/release/security/casework-advisory-baseline.json +++ b/release/security/casework-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:89da70b6437c6bbb91432fc44666b997143e5ce24620031a333e271859142473", + "sha256:8f24e106eef310fe9568f0a3a544e831e41953b2dbba4be11337827e779f6cbd", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132" + "definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", - "component_layer_id": "sha256:89da70b6437c6bbb91432fc44666b997143e5ce24620031a333e271859142473", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", + "component_layer_id": "sha256:8f24e106eef310fe9568f0a3a544e831e41953b2dbba4be11337827e779f6cbd", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", - "component_layer_id": "sha256:89da70b6437c6bbb91432fc44666b997143e5ce24620031a333e271859142473", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", + "component_layer_id": "sha256:8f24e106eef310fe9568f0a3a544e831e41953b2dbba4be11337827e779f6cbd", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/casework, /usr/local/bin/caseworkctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/casework, /usr/local/bin/caseworkctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", - "component_layer_id": "sha256:89da70b6437c6bbb91432fc44666b997143e5ce24620031a333e271859142473", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", + "component_layer_id": "sha256:8f24e106eef310fe9568f0a3a544e831e41953b2dbba4be11337827e779f6cbd", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 casework local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:8166b0d95dbc7616781a421a4edbd53159c34e4a3408a6cc633f78a8481f2b50", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132", + "runtime_definition_digest": "sha256:7fb9853c791f614af7393ebbda4b18a7afad050b1d575e4661a25d5b0137035d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988" + "sha256": "sha256:52d641ce43891de2271cd6ef844cd7777f0f79baf4b2e9f55814fafdd105cb0b" } ], - "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096" + "definition_digest": "sha256:422270a3c0173fe82368c886c40ef9a5b91c0bfe31cf4f94ac029b3db02c9dd8" } } ] diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json index 8ac47050f0..82732fb147 100644 --- a/release/security/discovery-advisory-baseline.json +++ b/release/security/discovery-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:9369cd68d2878a874fea4f730ea46b1aa4364b307fa0e56afa9100b87e8948e2" + "sha256:e924cf8ffdf043b0e2847a1d0bedefb876e7cb1c2f479925a46ae1dbf372afd4" ], "config": { "user": "65532", @@ -50,7 +50,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584" + "definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043" }, "policies": [ { @@ -73,8 +73,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -91,14 +91,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", - "component_layer_id": "sha256:9369cd68d2878a874fea4f730ea46b1aa4364b307fa0e56afa9100b87e8948e2", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", + "component_layer_id": "sha256:e924cf8ffdf043b0e2847a1d0bedefb876e7cb1c2f479925a46ae1dbf372afd4", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -118,10 +118,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -131,8 +131,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -149,14 +149,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", - "component_layer_id": "sha256:9369cd68d2878a874fea4f730ea46b1aa4364b307fa0e56afa9100b87e8948e2", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", + "component_layer_id": "sha256:e924cf8ffdf043b0e2847a1d0bedefb876e7cb1c2f479925a46ae1dbf372afd4", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -176,10 +176,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -189,8 +189,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/discovery; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/discovery; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -207,14 +207,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", - "component_layer_id": "sha256:9369cd68d2878a874fea4f730ea46b1aa4364b307fa0e56afa9100b87e8948e2", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", + "component_layer_id": "sha256:e924cf8ffdf043b0e2847a1d0bedefb876e7cb1c2f479925a46ae1dbf372afd4", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -234,10 +234,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -247,8 +247,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -265,14 +265,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -292,10 +292,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -305,8 +305,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -323,14 +323,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -350,10 +350,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -363,8 +363,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -381,14 +381,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -408,10 +408,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -421,8 +421,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -439,14 +439,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -466,10 +466,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -479,8 +479,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -497,14 +497,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -524,10 +524,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -537,8 +537,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -555,14 +555,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -582,10 +582,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -595,8 +595,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -613,14 +613,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -640,10 +640,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } }, { @@ -653,8 +653,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 discovery local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 discovery local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -671,14 +671,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:cad2660ce51c4900755ee986f567aafd541f272fc12b70847643d07530b5e549", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:9ab38c047f650692f5eca2f2f9d8c75df753e99c8d4611de38bdcdb758c7396b", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:fe39c0934b4bb662f21b83de729b16d22805cec83de4ac3d9a06e885293ce584", + "runtime_definition_digest": "sha256:b2ce1899d48eda81df1b7af6658d7d662fb4d8cdefea624ec6b346ea5c5a7043", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -698,10 +698,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:6b3c49614aa22cbb34283700caf85cd4e878571cd92e3ed2a2560db3b54aeb6e" + "sha256": "sha256:2a053511badc85e56035d68dc535a9c0b1c1346ad63858c30faa0c722e7e7277" } ], - "definition_digest": "sha256:be50ba55b108457c12b0f808af6d0f9cae16631d11ea3081b77672d485675893" + "definition_digest": "sha256:6f60a30f902d9f6008a0715d5855f0f86d51f2936eaa3ccb75331cebbe47f525" } } ] diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index 0b6d803c53..ee5c99ce20 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:e8f552a909049743bf857c01a66ee25a82898144e3db417567a029225cc1dec0", + "sha256:2bd189ab29af878655431b6ec47b785e5c808ee7db8c85dee761fdf1c959d147", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62" + "definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", - "component_layer_id": "sha256:e8f552a909049743bf857c01a66ee25a82898144e3db417567a029225cc1dec0", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", + "component_layer_id": "sha256:2bd189ab29af878655431b6ec47b785e5c808ee7db8c85dee761fdf1c959d147", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", - "component_layer_id": "sha256:e8f552a909049743bf857c01a66ee25a82898144e3db417567a029225cc1dec0", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", + "component_layer_id": "sha256:2bd189ab29af878655431b6ec47b785e5c808ee7db8c85dee761fdf1c959d147", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/evidence; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The Evidence report retains one nonconstant dlsym wrapper in bundled SQLite. Source review found no first-party C extension loader call, rusqlite omits its load_extension feature, and registry-platform-sqlite denies SQL load_extension; the latent C loader is not an enabled runtime path. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/evidence; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The Evidence report retains one nonconstant dlsym wrapper in bundled SQLite. Source review found no first-party C extension loader call, rusqlite omits its load_extension feature, and registry-platform-sqlite denies SQL load_extension; the latent C loader is not an enabled runtime path. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", - "component_layer_id": "sha256:e8f552a909049743bf857c01a66ee25a82898144e3db417567a029225cc1dec0", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", + "component_layer_id": "sha256:2bd189ab29af878655431b6ec47b785e5c808ee7db8c85dee761fdf1c959d147", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Adapter pack Sources link the hickory DNS resolver through registry-platform-httputil, adding gethostname, sendto and recvfrom imports for ordinary socket I/O; they reach no libc resolver printing, monetary-format, gettext or locale entrypoint. The PostgreSQL status ledger is library code uncalled by the shipped entrypoint; its Rust protocol clients add no libpq or dynamic C-library edge. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:557430e9481165604caa66910970d1af35f6e8232d32edccf32b4d83a1ed3577", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:1be3312ec9869100a9da1370d65d84a87b2673a27643d3c6d5d94f74d78dc756", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:07ad6c2597b1fc4cc350af091e71154bcecaa79700e19b282f5c06432edf5a62", + "runtime_definition_digest": "sha256:bd22028b2f8762de9530186cb53d3d48d2b373ddf22eb4686d26004e4f5b5466", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:46149d2ff161bd84175694ff86559c318ce732bf108c1017d5e2598d2c237181" + "sha256": "sha256:7a2404be565256637f4c5c6b6bc69aec6f94233f28a0d863e5bf436f34087d7d" } ], - "definition_digest": "sha256:2a2a8fa327f6a4f7ac6f2f25fcde7c4f6e105be0322c5ef2d36131cedabfd19b" + "definition_digest": "sha256:cf075c80e3e9cda0e64bef2760d60e88d716fb995c3b7a09fe5effff8835f7ab" } } ] diff --git a/release/security/evidence-oid4vci-advisory-baseline.json b/release/security/evidence-oid4vci-advisory-baseline.json index 16c649272a..efae7d24db 100644 --- a/release/security/evidence-oid4vci-advisory-baseline.json +++ b/release/security/evidence-oid4vci-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:f87a2a6ee8782a5ad47fd4a5baa280a4672b2948d8794f784dde05fd6635f194", + "sha256:09d080bc4eae011bea5f13aa8f114138c6f506ec822f946bc561ff4c5d18165d", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf" + "definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", - "component_layer_id": "sha256:f87a2a6ee8782a5ad47fd4a5baa280a4672b2948d8794f784dde05fd6635f194", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", + "component_layer_id": "sha256:09d080bc4eae011bea5f13aa8f114138c6f506ec822f946bc561ff4c5d18165d", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", - "component_layer_id": "sha256:f87a2a6ee8782a5ad47fd4a5baa280a4672b2948d8794f784dde05fd6635f194", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", + "component_layer_id": "sha256:09d080bc4eae011bea5f13aa8f114138c6f506ec822f946bc561ff4c5d18165d", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/evidence-oid4vci; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/evidence-oid4vci; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", - "component_layer_id": "sha256:f87a2a6ee8782a5ad47fd4a5baa280a4672b2948d8794f784dde05fd6635f194", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", + "component_layer_id": "sha256:09d080bc4eae011bea5f13aa8f114138c6f506ec822f946bc561ff4c5d18165d", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 evidence-oid4vci local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The shipped load path selects the process-local OfferStore; the PostgreSQL and sealing backend is neither called by that entrypoint nor selectable in configuration. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:27acee403efc76f30fecfd1a8c4b2d1a4a33cefb704b029bb9d9fa7778fc9183", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:6a4f71e7652593e7f757392a6a9975401ab57758ac302428be80063b85f0fe57", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:59aa603d3611bc9b9e02022c7b2a63f2034af82442abe4064fdfa7c78c0e71cf", + "runtime_definition_digest": "sha256:0ba57e772f25c2ca4f73446f6d10bab233181c9d3af80326c9fff82be0e45da6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:cb25a23a4ba89ea1dad784e2e68c796e0d05e7dd64cee0f674939927445213cb" + "sha256": "sha256:6a33c4b0c621b633d0c2d2fbda5a8fd9454401a45e0b8632cfd449bae81c15ac" } ], - "definition_digest": "sha256:2769fa01d6b006efdbe8577156c7db2894e68b0103b3af815666fd8d1e2b8690" + "definition_digest": "sha256:85ad69641117462e94a65cca56d97d691d63d5d5c1cc3a85a13fb821b9af1893" } } ] diff --git a/release/security/messaging-advisory-baseline.json b/release/security/messaging-advisory-baseline.json index 836a45c865..7243bd836f 100644 --- a/release/security/messaging-advisory-baseline.json +++ b/release/security/messaging-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:58d40d7d3d95cea0a5e2a25a8a7c57abc4b1cc830851af4dbad6c07db8f64404", + "sha256:36090b6198e7f5e2d7114d4abc3d36ff7cb28526921314fd1c21f4fd2e1cf8b6", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1" + "definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", - "component_layer_id": "sha256:58d40d7d3d95cea0a5e2a25a8a7c57abc4b1cc830851af4dbad6c07db8f64404", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", + "component_layer_id": "sha256:36090b6198e7f5e2d7114d4abc3d36ff7cb28526921314fd1c21f4fd2e1cf8b6", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", - "component_layer_id": "sha256:58d40d7d3d95cea0a5e2a25a8a7c57abc4b1cc830851af4dbad6c07db8f64404", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", + "component_layer_id": "sha256:36090b6198e7f5e2d7114d4abc3d36ff7cb28526921314fd1c21f4fd2e1cf8b6", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/messaging, /usr/local/bin/messagingctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/messaging, /usr/local/bin/messagingctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", - "component_layer_id": "sha256:58d40d7d3d95cea0a5e2a25a8a7c57abc4b1cc830851af4dbad6c07db8f64404", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", + "component_layer_id": "sha256:36090b6198e7f5e2d7114d4abc3d36ff7cb28526921314fd1c21f4fd2e1cf8b6", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 messaging local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 messaging local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:1f05e5dd954feb4a341a8281cfe61c12aff009c86de997c9ba6ed5faeaee2093", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:da27344ac8ef2b57de0292710f9bbd2adf282ba96237b1583e74d446a85435e2", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:79d4649066057e8688a6d96facf0fff4bc35fc965d11932db69efedc1e7e96e1", + "runtime_definition_digest": "sha256:4d4152da6066cc92d7390511bfa07a866f85a7638135c95759c4fcbfaf6d93a3", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:4e888904e261e36cc1f0efe4dfd4fffae3d8a2782c6ff4cd0866ada5d53214f1" + "sha256": "sha256:ffac00b7cfb49d7148715d1edabe339c0ef9965beca1306b725f973ddd4a9516" } ], - "definition_digest": "sha256:99477cd7b41dff871ce17f8be48a8c7944fb4df6b928c44a6fec7aab2d327fca" + "definition_digest": "sha256:c8f4da2f09094d4316a25796dbedef42cab19f0c4bf61c05daf1c958e1998904" } } ] diff --git a/release/security/registry-render-advisory-baseline.json b/release/security/registry-render-advisory-baseline.json index 3e4e4cac91..0a84b76c25 100644 --- a/release/security/registry-render-advisory-baseline.json +++ b/release/security/registry-render-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:f0ac112f036c8f07917db899be5d6d0529698f45174d7efafc00a487ea8a0726", + "sha256:d1cafe4faebab7e45eb0db6495505bd877502791468db698ea31575cd5492870", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e" + "definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", - "component_layer_id": "sha256:f0ac112f036c8f07917db899be5d6d0529698f45174d7efafc00a487ea8a0726", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", + "component_layer_id": "sha256:d1cafe4faebab7e45eb0db6495505bd877502791468db698ea31575cd5492870", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", - "component_layer_id": "sha256:f0ac112f036c8f07917db899be5d6d0529698f45174d7efafc00a487ea8a0726", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", + "component_layer_id": "sha256:d1cafe4faebab7e45eb0db6495505bd877502791468db698ea31575cd5492870", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/registry-render; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/registry-render; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", - "component_layer_id": "sha256:f0ac112f036c8f07917db899be5d6d0529698f45174d7efafc00a487ea8a0726", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", + "component_layer_id": "sha256:d1cafe4faebab7e45eb0db6495505bd877502791468db698ea31575cd5492870", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.45.0 Linux amd64 registry-render local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", - "reviewed_at": "2026-11-03", + "rationale": "Reviewed the v0.46.0 Linux amd64 registry-render local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:3d8931c0d157060fd9aaea4b66589224ed18281f933b0279eda29766a784de08", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:536bffc9841d19d55d2cae1dd04097fef688f14fb3a5d971626ecac1a0c24554", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:7136208443aab7143db3c7bbcb78dc600707a3c6e8e84b0a8e47032657a7c97e", + "runtime_definition_digest": "sha256:49bb3c35d30af47473a815cc57b5a66912e406f1cfa63b8249363f941f91b4ca", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:d2b2165770242d1ab27f12bef9cb9da4cb8377cea2bc687cc2648e22b175be32" + "sha256": "sha256:be04339ba16f4f74712b01d1aaf6462920e4b653231c7190346892dde06338b2" } ], - "definition_digest": "sha256:bdf4bd53056293d3f6dc52ad137935129202fe82437007ae671fe26688ee8076" + "definition_digest": "sha256:3c565f4567725863310a90506a289ecae07822005670bab8eb5fca9c40a4d617" } } ] diff --git a/release/security/scheduling-advisory-baseline.json b/release/security/scheduling-advisory-baseline.json index eb150de4f2..e3f912e7bf 100644 --- a/release/security/scheduling-advisory-baseline.json +++ b/release/security/scheduling-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:78483a6f2df4539fa4a915544c1dc8b3f2d7da40b15b99cdfa6bab0e81ae63ec", + "sha256:42479fc36abb256dc47367a0eacd12df28b0b0e68830b2422a38f27a8aa941da", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd" + "definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6" }, "policies": [ { @@ -75,7 +75,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -92,15 +92,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", - "component_layer_id": "sha256:78483a6f2df4539fa4a915544c1dc8b3f2d7da40b15b99cdfa6bab0e81ae63ec", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", + "component_layer_id": "sha256:42479fc36abb256dc47367a0eacd12df28b0b0e68830b2422a38f27a8aa941da", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -133,7 +133,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -150,15 +150,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", - "component_layer_id": "sha256:78483a6f2df4539fa4a915544c1dc8b3f2d7da40b15b99cdfa6bab0e81ae63ec", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", + "component_layer_id": "sha256:42479fc36abb256dc47367a0eacd12df28b0b0e68830b2422a38f27a8aa941da", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -191,7 +191,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -208,15 +208,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", - "component_layer_id": "sha256:78483a6f2df4539fa4a915544c1dc8b3f2d7da40b15b99cdfa6bab0e81ae63ec", - "rationale": "Proposed risk acceptance for owner review: the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 was reviewed on 2026-11-04. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/scheduling, /usr/local/bin/schedulingctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", + "component_layer_id": "sha256:42479fc36abb256dc47367a0eacd12df28b0b0e68830b2422a38f27a8aa941da", + "rationale": "Proposed risk acceptance for owner review: the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 was reviewed on 2026-11-08. Native Grype reports CVE-2026-84243 as High and not-fixed with no fixed version for libc6 2.41-12+deb13u4; Debian also still lists this package as vulnerable without a fixed version. The affected gettext implementation remains in libc and can be reached internally by ordinary error reporting. Exploitation additionally requires non-C LC_MESSAGES, attacker-controlled LANGUAGE across an environment trust boundary, and a crafted readable .mo catalog. In the exact Debian glibc source, guess_category_value reads the current category and returns for C or C. before consulting LANGUAGE; POSIX is stopped before catalog loading. Programs start in C, and libc does not call setlocale itself. Independently cross-checked GNU and LLVM ELF reports cover /usr/local/bin/scheduling, /usr/local/bin/schedulingctl; their loaded closure is only the executable, loader, libc, libm and libpthread. Neither the applications nor their non-libc loaded libraries import global or thread locale setters, and source review found no compiled locale-changing path or such constructor. pg_query NLS is compiled out where present; AWS-LC constructors perform CPU and cryptographic initialization. The exact exports contain no locale catalogs, and the pinned nonroot OCI processes set only PATH and SSL_CERT_FILE. These reviewed processes retain their startup C locale; locale environment variables alone do not change it. The runtime and operator-tool reports, where present, have no review-required or unlocated dynamic lookup. All resolved application dlsym lookups select only __pthread_get_minstack, _dl_find_object and getrandom, not locale or gettext entrypoints. The exact ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exported rootfs. The whole application-layer binding covers every shipped operator tool as well as the entrypoint. Locale/gettext calls, a changed runtime or tool dependency closure, deployment-supplied native libraries, or plugin/extension enablement require re-review under the existing exposure-assertion and runtime invalidation rules. This is a conditional exposure decision for the reviewed Linux amd64 processes, not a dependency fix. The proposed owner is @jeremi and expiry remains 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -249,7 +249,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -266,15 +266,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -307,7 +307,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -324,15 +324,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -365,7 +365,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -382,15 +382,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -423,7 +423,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -440,15 +440,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -481,7 +481,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -498,15 +498,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -539,7 +539,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -556,15 +556,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -597,7 +597,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -614,15 +614,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } }, { @@ -655,7 +655,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-11-03", + "reviewed_at": "2026-11-08", "expires_at": "2027-01-26", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -672,15 +672,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", - "rationale": "Reviewed the v0.45.0 Linux amd64 scheduling local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", + "rationale": "Reviewed the v0.46.0 Linux amd64 scheduling local reproduction from review-only rehearsal 42482707973 on 2026-11-08. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. Debian's trixie tracker still marks this CVE vulnerable and records (Minor issue); Grype's wont-fix enum is a scanner representation, not a promise that Debian will never fix it. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0f949457892cc7c35e2171a120289fe4217f65a192aacebbd8d8b358b2be1fea", - "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893", + "reference_image_digest": "sha256:3e24d5766182f24da1244a78ea8272ceca3cd801cb0f33e2ee24564e2c4ecad4", + "reference_source_revision": "a0830b887341de03c32be7f74c15d45c2b9379a4", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:e793a735d54d33c1c3730504bd3c5861e78e05aa8aefa384c578850b2d8be1bd", + "runtime_definition_digest": "sha256:b6d15aa44f6d03f17f7988b5c9260db0b20c9e379f180d5aa42d3742499098e6", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:2efe2d595007622c6e205eb8bd24cd6876d10caf4015e892428d729afe01a896" + "sha256": "sha256:1ab20b674b6cc4cd4b7416f967749a2e90459aaa6a1faa6ec5156ae26479a5eb" } ], - "definition_digest": "sha256:a6bc2c6aca867b343a065e5dd0e98226272ee2cce0be7a11a088e168ac031255" + "definition_digest": "sha256:26ac1f143d7279615ea4a7f2549fdc5d5b01b5285593d1206d4308175f233add" } } ]