diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py index 2aabeec9d..671b37d3a 100644 --- a/release/scripts/test_check_advisory_baselines.py +++ b/release/scripts/test_check_advisory_baselines.py @@ -31,23 +31,23 @@ ROOT / "release/security/registry-render-advisory-baseline.json", ) LIVE_REFERENCE_IMAGE_DIGESTS = { - "breg": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "casework": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "discovery": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "evidence": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "scheduling": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "breg-mcp": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "breg-review": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "evidence-oid4vci": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "messaging": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "registry-render": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", + "breg": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "casework": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "discovery": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "evidence": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "scheduling": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "breg-mcp": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "breg-review": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "evidence-oid4vci": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "messaging": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "registry-render": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", } -LIVE_REFERENCE_SOURCE_REVISION = "10e0e22997a2e59396cdadf7894be53eca261f67" +LIVE_REFERENCE_SOURCE_REVISION = "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62" # The date the live exceptions below were reviewed against, stated here rather # than derived from the baselines: deriving it from their own reviewed_at values # would make the checker's future-dated guard unreachable for the newest # exception. Move it forward by hand when the baselines are renewed. -LIVE_REVIEW_EVALUATION_DATE = "2026-10-11" +LIVE_REVIEW_EVALUATION_DATE = "2026-10-12" LIVE_REFERENCE_PROVENANCE = { "breg": "local_reproduction", "casework": "local_reproduction", diff --git a/release/security/breg-advisory-baseline.json b/release/security/breg-advisory-baseline.json index 0207aa5ca..bb4cb03c1 100644 --- a/release/security/breg-advisory-baseline.json +++ b/release/security/breg-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:207675edfb29ed0b3e5084eb008a6c10ab00bc85587d91905edfe2488712e0bf", + "sha256:fd46c67622a80eee6636fed0e8c04ebc1bfbb2363c9cb1b34a39250312c499ad", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -51,7 +51,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044" + "definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9" }, "policies": [ { @@ -74,8 +74,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -92,14 +92,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", - "component_layer_id": "sha256:207675edfb29ed0b3e5084eb008a6c10ab00bc85587d91905edfe2488712e0bf", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", + "component_layer_id": "sha256:fd46c67622a80eee6636fed0e8c04ebc1bfbb2363c9cb1b34a39250312c499ad", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -119,10 +119,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -132,8 +132,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -150,14 +150,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", - "component_layer_id": "sha256:207675edfb29ed0b3e5084eb008a6c10ab00bc85587d91905edfe2488712e0bf", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", + "component_layer_id": "sha256:fd46c67622a80eee6636fed0e8c04ebc1bfbb2363c9cb1b34a39250312c499ad", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -177,10 +177,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -190,8 +190,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -208,14 +208,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -235,10 +235,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -248,8 +248,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -266,14 +266,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -293,10 +293,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -306,8 +306,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -324,14 +324,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -351,10 +351,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -364,8 +364,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -382,14 +382,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -409,10 +409,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -422,8 +422,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -440,14 +440,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -467,10 +467,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -480,8 +480,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -498,14 +498,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -525,10 +525,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -538,8 +538,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -556,14 +556,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -583,10 +583,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -596,8 +596,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -614,14 +614,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -641,10 +641,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } }, { @@ -654,8 +654,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -672,14 +672,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:d0719e66889ac76af3549699288bcb1ef46ed5d8c618ceb656055be7500332b7", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:15046633fb4d312ba55f4f1510e8e2f767dd48d75b1713805461d24eb7aeb380", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:493d954527c893584289a870f55a70bf863a18766d821c0519dfb82061ae7044", + "runtime_definition_digest": "sha256:4b2be79f70c29d41ce114ad17a21a41b5afd1b97c3b87da1670eb9c4300b60a9", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -699,10 +699,10 @@ }, { "path": "/usr/local/bin/breg", - "sha256": "sha256:6622c6c63c3f0b8946224da61bd740dbda19deabf444636fab6ee88252cefd27" + "sha256": "sha256:c460b8afe9a8bf20d98256024cc8914049efb4e07070ddf22945d5eb90fce98c" } ], - "definition_digest": "sha256:e30fa48acc0d1e69ab1ab164dac65ca164f38a4b490b8a4bae9f5e09c23aa161" + "definition_digest": "sha256:f419707ce7e956130d98bd2945796fd4e9283d88705544ec43f3747965dc2fc6" } } ] diff --git a/release/security/breg-mcp-advisory-baseline.json b/release/security/breg-mcp-advisory-baseline.json index 93955d982..0305ae1b0 100644 --- a/release/security/breg-mcp-advisory-baseline.json +++ b/release/security/breg-mcp-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:849d7b118688c6cc5ed6bb050aead5449806f5065b72154bb2f02cf2a67bdfae", + "sha256:92b099e5e9adefbece5ce58f4919f83c6426ccab7b43d4805b9ac2b939bb9535", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364" + "definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", - "component_layer_id": "sha256:849d7b118688c6cc5ed6bb050aead5449806f5065b72154bb2f02cf2a67bdfae", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", + "component_layer_id": "sha256:92b099e5e9adefbece5ce58f4919f83c6426ccab7b43d4805b9ac2b939bb9535", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", - "component_layer_id": "sha256:849d7b118688c6cc5ed6bb050aead5449806f5065b72154bb2f02cf2a67bdfae", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", + "component_layer_id": "sha256:92b099e5e9adefbece5ce58f4919f83c6426ccab7b43d4805b9ac2b939bb9535", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-mcp local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-mcp local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f8c82164d71575ad2308078c412397c498c4cea1887317f64571fed6404d7d61", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:6621434c5b98d31cfc15f24c68fe98362af7b5fcdd0c4d1fa9231cc8022bb35b", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:228abb95c78b992ffc4c68fa1f1278807940f12708da9fefb687f24f16bf3364", + "runtime_definition_digest": "sha256:9a8b0693d7c9343bf42112e55b33c5027b4fcda4cf52251afcda706f44a25740", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/breg-mcp", - "sha256": "sha256:ffe4bcbbfcae603193d18082841746816d874a8471a9aea467a7356459fd1997" + "sha256": "sha256:90d3e3eeba71fe2e5174993051fe8e8d6fc21b22d95b083e6f12bbbc2b11d81e" } ], - "definition_digest": "sha256:cc2bc80bb23d908681745357ad85cb2c384fc41218392aedd40454df29b6faa3" + "definition_digest": "sha256:23b004c0946ce3c8f41a53618978ca63585d5df0888283b67599304c4ac908d4" } } ] diff --git a/release/security/breg-review-advisory-baseline.json b/release/security/breg-review-advisory-baseline.json index 7553b4ac2..7945730c4 100644 --- a/release/security/breg-review-advisory-baseline.json +++ b/release/security/breg-review-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:3bd5757939ef69c06be31fcb0c23d65042dbbede1d8b7bdf180ecdb307892add", + "sha256:177f4c1b7b841a43449f4c085b0ee11fe2574cb7a500143e3faea5614c2d13c2", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090" + "definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", - "component_layer_id": "sha256:3bd5757939ef69c06be31fcb0c23d65042dbbede1d8b7bdf180ecdb307892add", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", + "component_layer_id": "sha256:177f4c1b7b841a43449f4c085b0ee11fe2574cb7a500143e3faea5614c2d13c2", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", - "component_layer_id": "sha256:3bd5757939ef69c06be31fcb0c23d65042dbbede1d8b7bdf180ecdb307892add", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", + "component_layer_id": "sha256:177f4c1b7b841a43449f4c085b0ee11fe2574cb7a500143e3faea5614c2d13c2", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 breg-review local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 breg-review local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:c1beb24953f0b5e92c79bf9961b5fbf6e6c8acfa24ddc24986202f2a31ef1af1", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:477360eb4e691a004b8dd68406d21291428c593458e3bece0a6366c707d8fa9a", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:102495be452c84d0666912383bf55e2579052d0d70024b9dbe91664d555ee090", + "runtime_definition_digest": "sha256:0753f0e5ca2b17e49eb9ac353efc05d01f9e4d2065271e6546118b17a763894a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/breg-review", - "sha256": "sha256:e52971a33eecca585e19ec747aecab965859943efef47567822d84de72f615fb" + "sha256": "sha256:77affa53d0cdded9d5cc765d74c355609206f06b94b70980653bd24ae8c863fa" } ], - "definition_digest": "sha256:a5d3a5f74b558f383a0c6166022e1ce192ee58d0ea3fb9980ebeda66967a5318" + "definition_digest": "sha256:826d9ea8b0209baa7b11d2ca06a62a92a959e7b0d9d25016215b98d7fb4efd2f" } } ] diff --git a/release/security/casework-advisory-baseline.json b/release/security/casework-advisory-baseline.json index 7e00bf698..293f2435c 100644 --- a/release/security/casework-advisory-baseline.json +++ b/release/security/casework-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:91943545eef10dda23d57918bf563f2eaee5fa61fccb7cc1319089d9705c4dae", + "sha256:06e0c9b5d41157f1673967a1db28ee7183d42e4e96e9c94f02090227167ff196", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe" + "definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", - "component_layer_id": "sha256:91943545eef10dda23d57918bf563f2eaee5fa61fccb7cc1319089d9705c4dae", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", + "component_layer_id": "sha256:06e0c9b5d41157f1673967a1db28ee7183d42e4e96e9c94f02090227167ff196", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", - "component_layer_id": "sha256:91943545eef10dda23d57918bf563f2eaee5fa61fccb7cc1319089d9705c4dae", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", + "component_layer_id": "sha256:06e0c9b5d41157f1673967a1db28ee7183d42e4e96e9c94f02090227167ff196", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 casework local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 casework local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:e54e0915eb614d75afa24f439f9662406e2dee12ef7d87dd34fa9d97b98981b2", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:4ff1e15d575b3340aafc01cb2a6df75d70099d044b57d44c7828d3eed7f28663", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:006709907901853358c137a3366ca113f40f31da34736f67e33d047665576cfe", + "runtime_definition_digest": "sha256:4ed2bfff2d769f7dfd631913db28cdd71aaa2cfb161e39cde5df835d063a21f1", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/casework", - "sha256": "sha256:496271ac2adb6885be116b7a510d64b705b731e1e8c1e6237e978e0e38019407" + "sha256": "sha256:a8204893a1d69e1e563bbd1fd7a7f21fb1ae7f02a4841106061e218b7fcc3b3c" } ], - "definition_digest": "sha256:54ac947bcb4f522451d70c4073a4804a0c433add30635c94516c2b65e9890ed0" + "definition_digest": "sha256:1e080115cb1ec5104828b9016705c7ffb5acac42180aeda0e4aa864b56665b46" } } ] diff --git a/release/security/discovery-advisory-baseline.json b/release/security/discovery-advisory-baseline.json index 4fd4e646c..b67eddac5 100644 --- a/release/security/discovery-advisory-baseline.json +++ b/release/security/discovery-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:9db07c1dd635ca2594549caa7b7b3212a86ec685f3a6def214d74da7760b9bbb" + "sha256:b96216518df9846a0d705077bfceae5ac6f8254b07e1107a0f6e658862500c84" ], "config": { "user": "65532", @@ -50,7 +50,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66" + "definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48" }, "policies": [ { @@ -73,8 +73,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -91,14 +91,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", - "component_layer_id": "sha256:9db07c1dd635ca2594549caa7b7b3212a86ec685f3a6def214d74da7760b9bbb", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", + "component_layer_id": "sha256:b96216518df9846a0d705077bfceae5ac6f8254b07e1107a0f6e658862500c84", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -118,10 +118,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -131,8 +131,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -149,14 +149,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", - "component_layer_id": "sha256:9db07c1dd635ca2594549caa7b7b3212a86ec685f3a6def214d74da7760b9bbb", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", + "component_layer_id": "sha256:b96216518df9846a0d705077bfceae5ac6f8254b07e1107a0f6e658862500c84", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -176,10 +176,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -189,8 +189,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -207,14 +207,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -234,10 +234,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -247,8 +247,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -265,14 +265,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -292,10 +292,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -305,8 +305,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -323,14 +323,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -350,10 +350,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -363,8 +363,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -381,14 +381,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -408,10 +408,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -421,8 +421,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -439,14 +439,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -466,10 +466,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -479,8 +479,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -497,14 +497,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -524,10 +524,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -537,8 +537,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -555,14 +555,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -582,10 +582,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -595,8 +595,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -613,14 +613,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -640,10 +640,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } }, { @@ -653,8 +653,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 discovery local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 discovery local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/discovery.json record no review-required dynamic lookup in /usr/local/bin/discovery; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -671,14 +671,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:ab959f9ac9f49fd09a4831936e730f07d4367834cfe2b0564eff6b863246bed6", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:922e5398152e4cf4ac4e773b672ec9e5258b35d461071c4efde0faf0eb974623", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:1fbcdbde8c5ec40b645603a7db4c282119a78f7bc1009f4604faaeff6bc54e66", + "runtime_definition_digest": "sha256:402caae53c560cbeca9772f220a991b57eda660501eb6ac2b311e2a33b835c48", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -698,10 +698,10 @@ }, { "path": "/usr/local/bin/discovery", - "sha256": "sha256:2be971dcef2f1e4caca4f0d235532d36013cd6ded014c9339b668cbdf6e29787" + "sha256": "sha256:956340051e3c31d359ad823b85dfdbbc384f7affbd2bac3a2aba077d55a166db" } ], - "definition_digest": "sha256:818dd4eed4bd3899a10972821cfd570084320e4d2b5ebfc1dee510481e431c81" + "definition_digest": "sha256:d5b81102a69ab434ee81a911f4d952323c3b3114c039f3b0ef2bf2042f380936" } } ] diff --git a/release/security/evidence-advisory-baseline.json b/release/security/evidence-advisory-baseline.json index 6dd84b384..2995f6869 100644 --- a/release/security/evidence-advisory-baseline.json +++ b/release/security/evidence-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:55afaa90b71b32a7c9d0f945131645cb16310f98834f6c1f9af4ab054c66d160", + "sha256:22845473f8d95e1292cb971ecbe091758eb6983929e7ddb3d44a172e06d7fc10", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb" + "definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", - "component_layer_id": "sha256:55afaa90b71b32a7c9d0f945131645cb16310f98834f6c1f9af4ab054c66d160", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", + "component_layer_id": "sha256:22845473f8d95e1292cb971ecbe091758eb6983929e7ddb3d44a172e06d7fc10", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", - "component_layer_id": "sha256:55afaa90b71b32a7c9d0f945131645cb16310f98834f6c1f9af4ab054c66d160", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", + "component_layer_id": "sha256:22845473f8d95e1292cb971ecbe091758eb6983929e7ddb3d44a172e06d7fc10", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The Evidence exposure report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed exposure/evidence.json report retains one review-required nonconstant dlsym site, bundled SQLite's extension-symbol wrapper; its other resolved lookups select only __pthread_get_minstack, _dl_find_object, getrandom. registry-platform-sqlite denies SQL load_extension, the compiled rusqlite features omit its load_extension API, and no first-party runtime caller enables or invokes C extension loading. Runtime SQLite connections are read-only and authorizer guarded. Source review therefore closes that reported path without claiming the wrapper bytes are absent. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_config_changed", "runtime_base_changed" ], - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f094e650c793d44faf92325280807204a6209e6c34d0c5f3423c319feb2e6f6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:c2bb84193b124c75151c0daffc983d9409e83e67e9dfdeb9760d2c3d62b7a59f", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:6de0eb3128c56396e89aca1341c9885fe6d1456fc415ff37609f21bb030a2acb", + "runtime_definition_digest": "sha256:4ce7ec30647b45d04b644b90d4c72fc6c23d96fa762b27d6187c3e1547d64f6d", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/evidence", - "sha256": "sha256:bf6e203803a3a3c6f4b5952b59145c2cc61f21349310de0f7146e32e7ac220cc" + "sha256": "sha256:af4e61182de099b67e4171248fc2adb5a32ec726e055779b06137083bc2aff41" } ], - "definition_digest": "sha256:332358bfe09b5e325dc95f86d7983f668362b7edb49034df82a1a7dd95cfd7f9" + "definition_digest": "sha256:35fe7bc5626c1acaabbab8ae432f9f0eb1921392699e4bf5f18c771cb845f845" } } ] diff --git a/release/security/evidence-oid4vci-advisory-baseline.json b/release/security/evidence-oid4vci-advisory-baseline.json index 1c5c7dd24..cb60d1ff3 100644 --- a/release/security/evidence-oid4vci-advisory-baseline.json +++ b/release/security/evidence-oid4vci-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:01337ffa24b8e53129b1c1255725180d100c1f181132ac7b3cefdcbe85c65671", + "sha256:bef4c2efe912eb53fc139b01e2a2390136ab78b70b8348eee42ec92ce83161d1", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e" + "definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", - "component_layer_id": "sha256:01337ffa24b8e53129b1c1255725180d100c1f181132ac7b3cefdcbe85c65671", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", + "component_layer_id": "sha256:bef4c2efe912eb53fc139b01e2a2390136ab78b70b8348eee42ec92ce83161d1", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", - "component_layer_id": "sha256:01337ffa24b8e53129b1c1255725180d100c1f181132ac7b3cefdcbe85c65671", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", + "component_layer_id": "sha256:bef4c2efe912eb53fc139b01e2a2390136ab78b70b8348eee42ec92ce83161d1", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 evidence-oid4vci local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/evidence-oid4vci.json record no review-required dynamic lookup in /usr/local/bin/evidence-oid4vci; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:f622725f79f9b0100117c716b41bbf54115d56b99e78d239236ffe0d4a1ebada", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:237d58b9309b6db1b9eed9079c69bd4ffc1da03c4f6d01992ba8c77233e2a692", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:5e78668576e6d08ef900be221575301f38741795b109f125ad6283089018ed8e", + "runtime_definition_digest": "sha256:1cc3584460df92bd42ab6835284d4ef53cea7e837b7237814b3eab1925ada2f8", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/evidence-oid4vci", - "sha256": "sha256:0c46414e2ff60d37e7fdf7b1c177865b5d3b453d12844a78dce92faa15577128" + "sha256": "sha256:3832b7944c971921a8e9df0c97e0f2e5a9131575915ba8ec5492388ecb1a5489" } ], - "definition_digest": "sha256:ee398df4486d0e8ca984b2c3a5ebee0eca19cabcd025f7a2e62e5b09cfe61aab" + "definition_digest": "sha256:b21000f65888bb1271f0b1b5484c322444105cb3634e48b914105753cab1b5df" } } ] diff --git a/release/security/messaging-advisory-baseline.json b/release/security/messaging-advisory-baseline.json index aa08122f8..56ab49f1b 100644 --- a/release/security/messaging-advisory-baseline.json +++ b/release/security/messaging-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:753b1bdd1ce7f3405a7e39c5d082c5bb1a10100328b430c75c8e913d68bbf5ee", + "sha256:00372758674ea778e74a7b8c41805519385c9d0fd24b608cdd711a3e1149d609", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3" + "definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", - "component_layer_id": "sha256:753b1bdd1ce7f3405a7e39c5d082c5bb1a10100328b430c75c8e913d68bbf5ee", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", + "component_layer_id": "sha256:00372758674ea778e74a7b8c41805519385c9d0fd24b608cdd711a3e1149d609", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", - "component_layer_id": "sha256:753b1bdd1ce7f3405a7e39c5d082c5bb1a10100328b430c75c8e913d68bbf5ee", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", + "component_layer_id": "sha256:00372758674ea778e74a7b8c41805519385c9d0fd24b608cdd711a3e1149d609", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 messaging local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 messaging local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/messaging.json and exposure/messaging.messagingctl.json record no review-required dynamic lookup in /usr/local/bin/messaging and /usr/local/bin/messagingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:9b4205104273e984c7998a43ec86cc30b225ea8bc8c81a4de4670226c6f7a54b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:0b49ac7cae090fef7cba7e0f3b6c6ea69d8d97e522187f717204adcabf60c08d", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:b2a94ac5159c16c8b54852c7c3ae0d9d16c03c41c17a3561e9cc183b0ab344b3", + "runtime_definition_digest": "sha256:3ac51f67da83b480fa6ce0b86cb9b268d9ef49b65bfa827dca56bd9b36179305", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/messaging", - "sha256": "sha256:2518b420773b1b2f1abe43d99590f28fabc83dbd9067404e67b7898524985256" + "sha256": "sha256:8d4685af58168f99b60a85c9d91b7df98b70abbd69abc95e25652b52df158039" } ], - "definition_digest": "sha256:4787c8c23b1cc026c718d136df2868fc598905298293de6b331bd39903b1ef7e" + "definition_digest": "sha256:37ed5bc080cbdce6cf57f4afa8a3835d16543a36cf66f59f507f4f9b3c5b4af5" } } ] diff --git a/release/security/registry-render-advisory-baseline.json b/release/security/registry-render-advisory-baseline.json index 5642107b1..f761b363c 100644 --- a/release/security/registry-render-advisory-baseline.json +++ b/release/security/registry-render-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:14fb9573c9b017ce85e4858d4e959bd405937facb6113a9a9b9f2b022a4a55c6", + "sha256:bdf4c653dd7d126be8c41895c0364473765717589a6486fa116a66de9634d567", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7" + "definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f" }, "policies": [ { @@ -75,8 +75,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -93,14 +93,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", - "component_layer_id": "sha256:14fb9573c9b017ce85e4858d4e959bd405937facb6113a9a9b9f2b022a4a55c6", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", + "component_layer_id": "sha256:bdf4c653dd7d126be8c41895c0364473765717589a6486fa116a66de9634d567", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -133,8 +133,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -151,14 +151,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", - "component_layer_id": "sha256:14fb9573c9b017ce85e4858d4e959bd405937facb6113a9a9b9f2b022a4a55c6", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", + "component_layer_id": "sha256:bdf4c653dd7d126be8c41895c0364473765717589a6486fa116a66de9634d567", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -191,8 +191,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -209,14 +209,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -249,8 +249,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -267,14 +267,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -307,8 +307,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -325,14 +325,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -365,8 +365,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -383,14 +383,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -423,8 +423,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -441,14 +441,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -481,8 +481,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -499,14 +499,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -539,8 +539,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -557,14 +557,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -597,8 +597,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -615,14 +615,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } }, { @@ -655,8 +655,8 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "rationale": "Reviewed the v0.40.0 Linux amd64 registry-render local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", - "reviewed_at": "2026-10-11", + "rationale": "Reviewed the v0.41.0 Linux amd64 registry-render local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/registry-render.json record no review-required dynamic lookup in /usr/local/bin/registry-render; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -673,14 +673,14 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:7a8970fc99648458f57b0096f16c027d701698d247a01e1b69571475644eed6b", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:935d51fa775bd6829593fb3deffa46a751d2a36209b47e8aebee16ec3e11f6f6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:3c73dfb3a59488442f787693f90605ede94c6e1badf5fc5a450dc5b5b61e14f7", + "runtime_definition_digest": "sha256:1e7a54ff2a402dfbded15a89ce7d0dbef494388387849e8c4a410011ac03125f", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/registry-render", - "sha256": "sha256:1a4e1d5aeca44cf0e83acc877a421ac7b170bf9365774810c8f99f25e29b4bec" + "sha256": "sha256:282a80d82a60c69fe0c1bc8da1287a43fd7077ba075047211d8ccba514736138" } ], - "definition_digest": "sha256:c364a03930b1288f4f3f35afbfb1efc5b7a290b0dd4897e4e3440002aaa19f1f" + "definition_digest": "sha256:8fdd32ef2f256037b4160b56a1ec9491c921e72057b38a9ef516e0ddf02681b8" } } ] diff --git a/release/security/scheduling-advisory-baseline.json b/release/security/scheduling-advisory-baseline.json index b9af21543..25ea35894 100644 --- a/release/security/scheduling-advisory-baseline.json +++ b/release/security/scheduling-advisory-baseline.json @@ -27,7 +27,7 @@ "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614" ], "application_layer_ids": [ - "sha256:7b90570b4f7fd235015d43c51b576a1b35101ddd80e20b5a5cbd1a48f32ce3ee", + "sha256:e1fc6ddf53811c14d0ac9ef239767adee3b29e15cffeff96c3689856a0caba11", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "config": { @@ -52,7 +52,7 @@ ], "stop_signal": "" }, - "definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9" + "definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf" }, "policies": [ { @@ -75,7 +75,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -92,15 +92,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", - "component_layer_id": "sha256:7b90570b4f7fd235015d43c51b576a1b35101ddd80e20b5a5cbd1a48f32ce3ee", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", + "component_layer_id": "sha256:e1fc6ddf53811c14d0ac9ef239767adee3b29e15cffeff96c3689856a0caba11", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc/resolver implementation remains present. The reviewed application executables import and contain none of ns_printrrf, ns_printrr, ns_sprintrrf, ns_sprintrr or fp_nquery, and no reviewed dynamic lookup selects them. The bounded source paths do not enter the affected TSIG diagnostic-printing functions; ordinary resolver initialization does not establish that path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -120,10 +120,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -133,7 +133,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -150,15 +150,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", - "component_layer_id": "sha256:7b90570b4f7fd235015d43c51b576a1b35101ddd80e20b5a5cbd1a48f32ce3ee", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", + "component_layer_id": "sha256:e1fc6ddf53811c14d0ac9ef239767adee3b29e15cffeff96c3689856a0caba11", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libc6 2.41-12+deb13u4. The carried libc exports strfmon, strfmon_l and __strfmon_l. The reviewed application executables neither import nor contain strfmon or strfmon_l, and no reviewed dynamic lookup selects them. The bounded source paths contain no monetary-format call or caller-controlled right-justified monetary-format width path. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -178,10 +178,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -191,7 +191,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -208,15 +208,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -236,10 +236,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -249,7 +249,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -266,15 +266,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -294,10 +294,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -307,7 +307,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -324,15 +324,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -352,10 +352,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -365,7 +365,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -382,15 +382,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -410,10 +410,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -423,7 +423,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -440,15 +440,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The existing exception concerns GCC PR127656 and a C++ __gnu_pbds binary-heap template instantiation. The relevant base libraries and reviewed application executables contain no __gnu_pbds or binary_heap names. The application executables need none of libstdc++, libgcc_s or libgomp, and the bounded source and normal-dependency review found no affected template instantiation. The carried package remains vulnerable according to the scan; this is a non-reachability decision, not a dependency fix. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -468,10 +468,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -481,7 +481,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -498,15 +498,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:7db505d90756626f425c6c5468eca565c82f589b144ecaa4f411ad9bbf79e614", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for gcc-14-base 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -526,10 +526,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -539,7 +539,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -556,15 +556,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:c16b2ec4b1493bad1b1de23d659c899e60abb166bda756d02792f0a03ba54a43", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgcc-s1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -584,10 +584,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -597,7 +597,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -614,15 +614,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:1f5d28bd51650f429293f7730ede274b81dc0744aa918bc887133c4ad610258c", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libgomp1 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -642,10 +642,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } }, { @@ -655,7 +655,7 @@ "severity": "High", "status": "accepted_risk", "owner": "@jeremi", - "reviewed_at": "2026-10-11", + "reviewed_at": "2026-10-12", "expires_at": "2026-10-20", "invalidation_triggers": [ "candidate_image_identity_mismatch", @@ -672,15 +672,15 @@ "runtime_base_changed", "runtime_config_changed" ], - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "component_layer_id": "sha256:6e18ad80f3d64a8cbbcd1ff2e8a0d5ce7282cf664e816b86183a59d30a618e8a", - "rationale": "Reviewed the v0.40.0 Linux amd64 scheduling local reproduction from rehearsal 38153828761 on 2026-10-11. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select no affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", + "rationale": "Reviewed the v0.41.0 Linux amd64 scheduling local reproduction from rehearsal 38322311043 on 2026-10-12. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports wont-fix with no fixed version for libstdc++6 14.2.0-19. The carried libstdc++ aligned operator-new implementation calls posix_memalign with the unrounded requested size and imports neither aligned_alloc nor memalign. libgcc_s and libgomp define no aligned operator new; libgomp separately imports memalign for its OpenMP allocator. The reviewed application executables need none of libstdc++, libgcc_s or libgomp, import no C++ symbols and contain no aligned operator-new names. The complete representative base-ELF scan found no libstdc++ or libgomp consumer and only libstdc++ itself needing libgcc_s. Relevant base-library bytes match across all ten exports, and every application executable was checked separately. No reviewed application or dynamic lookup reaches that C++ allocation closure. The reviewed reports exposure/scheduling.json and exposure/scheduling.schedulingctl.json record no review-required dynamic lookup in /usr/local/bin/scheduling and /usr/local/bin/schedulingctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The existing owner, invalidation triggers and 2026-10-20 expiry remain unchanged.", "exposure_assertion": { "kind": "whole_image_fingerprint_equals", - "reference_image_digest": "sha256:0aaf59be46374042161994bc8a811ab23005cf4e7a462f708060fdf5c672273a", - "reference_source_revision": "10e0e22997a2e59396cdadf7894be53eca261f67", + "reference_image_digest": "sha256:e8465bb82630aa529e0aa26723d983050b87ed7bef8e2c7ef8f47e014d393af6", + "reference_source_revision": "b2c781a930d4eabb4a896a516e5d9ed4e6ebdb62", "reference_provenance": "local_reproduction", - "runtime_definition_digest": "sha256:f016669c86f64e2b1156af955291b4f991cf4337ef2ebffe20651bd2e974a2c9", + "runtime_definition_digest": "sha256:940ecd0895990e4b0a51a81edc42ee2ec1293fe30af0a0955020da5d9d6a4bdf", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -700,10 +700,10 @@ }, { "path": "/usr/local/bin/scheduling", - "sha256": "sha256:4cfd42c3ebea1718fb278f2ac21e8e2fa937e38872791c4b7dbf481d13341f55" + "sha256": "sha256:3e83001d0c2aa55f0d825cbd7fc40c51e9d7730ba1e60b75f90dc77b1d5cd493" } ], - "definition_digest": "sha256:0d9c7a8f8452e2dc75e74f398dc2613258a04a9232c82c05589a75bbfa3d7060" + "definition_digest": "sha256:ea139e16b1ce2a6acd025360661d6d0a5fff11add255b5105ee26f5c7c216775" } } ]