diff --git a/.claude/skills/cve-check-and-upgrade/SKILL.md b/.claude/skills/cve-check-and-upgrade/SKILL.md new file mode 100644 index 0000000..6f8f8b3 --- /dev/null +++ b/.claude/skills/cve-check-and-upgrade/SKILL.md @@ -0,0 +1,91 @@ +--- +name: cve-check-and-upgrade +description: Security-driven upgrade run. Does a full /cve-check sweep first (per-image advisory scan of every recipe's available upgrade, with adjudication), then runs /recipe-upgrade ONLY on the recipes whose upgrade fixes at least one CVE — worst severity first — opening a verified recipe PR for each, and finally publishes one report covering both the sweep and the PRs. Recipes with no CVEs are left alone; that is the point. NEVER merges. Invoke as /cve-check-and-upgrade [recipe ...] [--min-severity high] [--capacity N] [--dry-run]. +--- + +# cve-check-and-upgrade + +`/upgrade-all` upgrades everything that *has* an upgrade. **This upgrades what has a reason.** It runs +the `/cve-check` sweep, then spends CI time only on the recipes where an upgrade actually closes a +vulnerability, handling the worst first. + +Use it when you want to act on security rather than churn the whole fleet: after a vendor announcement, +when CI capacity is short, or between weekly runs. When you only want to *know*, use `/cve-check`. When +you want everything current regardless of CVEs, use `/upgrade-all`. + +**Creates PRs. Never merges.** Every PR is verified green on cc-ci and left for a human. + +## Arguments +- ` …` — restrict the whole run to these recipes. +- `--min-severity critical|high|medium|low` — only upgrade recipes whose fixed CVEs reach this + severity. Default **`low`** (any CVE at all justifies the upgrade). `--min-severity high` is the + useful "just the urgent ones" setting. +- `--capacity N` — subagent pool size; defaults to the live `DRONE_RUNNER_CAPACITY` (the drone + runner's slots), matching `/upgrade-all`'s rolling-pool behaviour. +- `--dry-run` — do the whole sweep and print exactly which recipes *would* be upgraded and why, then + stop without spawning a single upgrade. **Publishes no report and opens no PR.** + +## Procedure + +### 1. Sweep — run `/cve-check` in full +Follow `.claude/skills/cve-check/SKILL.md` steps 1–5 exactly: candidate list, per-image upgrade windows, +the advisory scan per recipe, pass-2 adjudication of anything undecided, and the severity classification. +**Do not publish its report** — this run produces one combined report at the end instead. + +Keep, per recipe: the windows scanned, the CVE count, the CVE ids with severities, and whether the count +is a floor (undetermined advisories remain) or unknown. + +### 2. Decide what to upgrade +`RECIPES_TO_UPGRADE` = recipes where **the scan found ≥1 CVE** at or above `--min-severity`. + +Deliberate exclusions, each recorded in the report with its reason: +- **0 CVEs** — an upgrade may exist, but nothing security-relevant. Left alone; that is the point of + this skill. `/upgrade-all` is what sweeps those up. +- **`external` tier** — swept for visibility, **never upgraded here**; someone else maintains it. Flag + it loudly in the report if it has a critical, since the action is to tell them, not to open a PR. +- **`UPTODATE`** — nothing available. +- **count `?` / UNKNOWN** — do **not** upgrade blind, and do **not** treat it as clean. Put it in the + Addendum as needing a look. An unknown is a gap in our knowledge, not evidence of safety. + +Order the queue by **worst severity first** (critical → high → …), count breaking ties. If `--dry-run`, +print this queue with each recipe's CVE ids and severities, and STOP here. + +### 3. Upgrade each one — via `/recipe-upgrade` subagents +Run `/recipe-upgrade ` per queued recipe as a **subagent**, in the queue order above, as a +**rolling pool** keeping `--capacity` (default `DRONE_RUNNER_CAPACITY`) running at once and starting the +next as each finishes — the same concurrency discipline as `/upgrade-all` §3, and safe for the same +reason (per-run recipe trees + app-domain locks). + +Each subagent does the full job: plan, implement the bump, verify green on cc-ci with `!testme`, and +open a recipe PR. **Default mode — no `--with-tests`**: a genuinely stale test gets an explanatory PR +comment, not a test edit. + +**Tell each subagent which CVEs justify its upgrade**, with ids and severities, so the PR description +says why it exists. That is most of this skill's value to a reviewer: a PR that names the CVSS-9.8 RCE +it closes gets merged today, an unexplained version bump waits a fortnight. + +Collect per recipe: PR url + number, the `!testme` verdict and build number, and any failure. + +### 4. Report — one page covering sweep AND PRs +Write `/tmp/cve-spec-.json` per `/cve-check` step 6, with these differences: +- Rows for upgraded recipes carry the real `ci` (`build N ✓` / `RED N · `) + `ci_url`, and + `pr`/`pr_url`. `status` is the CI verdict (`GREEN`/`FAILED`/`STALE`); the live PR-status column + derives itself from `recipe` + `pr`. +- Rows for swept-but-not-upgraded recipes keep `PENDING`/`UPTODATE` with empty `ci`/`pr`, and a + `notes` reason (`0 CVEs — not upgraded`, `external — maintained elsewhere`, `below --min-severity`). +- Include `changes[]` — one entry per recipe that got a PR, describing what the upgrade changes **and + the CVEs it closes**. +- Keep `"kind": "cve"`: it titles the page "The Recipe Report — CVE check" and files it as + `cve-.html`, alongside the weekly editions in the same archive index. + +Then render + publish exactly as `/cve-check` step 7, and verify as its step 8. Print the report URL, +`N swept · M upgraded · K PRs green · J failed`, and `CVE CHECK AND UPGRADE COMPLETE`. + +## Guardrails +- **NEVER merge.** Create and verify; a human merges. Never push to true upstream. +- **Never weaken a test** to make a PR green, and never edit a test without `--with-tests`. +- **Never upgrade a recipe whose CVE count is unknown** on the assumption it is fine — surface it. +- **Never upgrade an `external` recipe** here, even with a critical; report it instead. +- **Public-safe report only** — no secrets, tokens, internal hostnames, raw logs, or spend figures. +- If the sweep finds **nothing** at or above `--min-severity`, that is a good outcome: publish the + report saying so and open no PRs. Do not manufacture work. diff --git a/.claude/skills/cve-check/SKILL.md b/.claude/skills/cve-check/SKILL.md new file mode 100644 index 0000000..8f2d683 --- /dev/null +++ b/.claude/skills/cve-check/SKILL.md @@ -0,0 +1,170 @@ +--- +name: cve-check +description: Fleet-wide CVE sweep WITHOUT upgrading anything. For every recipe cc-ci deploys, works out what upgrade is available (current pinned tag → newest supported tag, per image including sidecars), runs the deterministic advisory scan over that window, adjudicates whatever the scan could not decide, and publishes a CVE report to report.ci.commoninternet.net as cve-.html. READ-ONLY — opens no PRs, edits no recipes, runs no CI, merges nothing. Answers "what are we exposed to that an upgrade would fix?" in minutes rather than the hours a full upgrade run takes. Invoke as /cve-check [recipe ...] [--weekly-only]. +--- + +# cve-check + +A **security sweep, not an upgrade run.** It answers one question for every recipe cc-ci deploys: + +> If we upgraded this recipe today, how many CVEs would that fix, and how bad are they? + +It is the cheap, safe half of `/upgrade-all`: the same version research and the same advisory scan, +with **no implementation, no CI, and no PRs**. Use it when you want the security picture now — after a +vendor announcement, before deciding what to prioritise, or between weekly runs. When you want the PRs +too, use **`/cve-check-and-upgrade`**. + +**Read-only, absolutely.** Never edit a recipe, never open or comment on a PR, never merge, never +deploy. The only thing it writes is its own log and the published report page. + +## Arguments +- ` …` — sweep only these recipes (else every recipe in `cc-ci-plan/used-recipes.md`). +- `--weekly-only` — skip rows tagged `external`. **Off by default on purpose**: an `external` recipe is + still deployed and still exposes us, so a security sweep that silently skipped it would misreport the + fleet's exposure. Externals are swept and clearly marked "maintained elsewhere" in the report. + +## Procedure + +> ### ⚠️ Run abra over a pseudo-TTY (or it FATAs `inappropriate ioctl for device`) +> `abra` needs a TTY. Wrap every abra call: `ssh cc-ci 'script -qec "abra -n" /dev/null'`. +> (`git` and other commands do NOT need the wrapper.) + +### 1. Build the candidate list +Read `cc-ci-plan/used-recipes.md` — the canonical inventory. Take every row (both tiers), recording the +tier per recipe; with `--weekly-only`, drop the `external` rows. An explicit recipe argument overrides +any skip. + +### 2. Per recipe — establish the upgrade window WITHOUT upgrading + +This is `/recipe-upgrade` step 1's research, stopping before it implements anything. + +> ⚠️ **The same four things that silently skip recipes apply here — handle ALL FOUR:** +> 1. **pseudo-TTY** — per the box above. +> 2. **go-git auth to git.autonomic.zone** — recipes on the private mirror FATA +> `authentication required: Unauthorized`. Bake creds into origin first (idempotent, only when +> origin is on git.autonomic.zone): +> `git -C ~/.abra/recipes/ remote set-url origin "https://$GITEA_USERNAME:$GITEA_PASSWORD@git.autonomic.zone/recipe-maintainers/.git"` +> 3. **dirty worktree** — usually just the untracked cc-ci overlay; `git stash -u` before, `stash pop` +> after. Only a genuinely dirty TRACKED tree is a skip. +> 4. **tag+digest pins abra cannot parse** — abra FATAs and aborts the WHOLE recipe (immich). This is +> **not** "not fetchable": enumerate the compose's `image:` refs yourself and check the upstream +> registry directly for the ones abra could not read, picking the newest tag the app version +> supports rather than the numerically highest. + +**Reconcile the mirror from true upstream FIRST — ALWAYS, no exceptions.** This is the same reconcile +`/upgrade-all` does. Do not skip it in the name of keeping the sweep read-only: skipping it makes you +research a stale checkout, and on the first real run that produced **two recipes with no survey output +at all**, which is indistinguishable from "no upgrades" unless you check. It is safe — recipe work +lives in **branches**, never directly on `main`, so a force-sync of `main` to upstream discards +nothing; it also auto-closes mirror PRs whose changes upstream has already merged. + +> ### ⚠️ The default branch may be `master`, not `main` — check, do not assume +> Several coopcloud recipes keep a **stale `main` alongside the real default `master`**. gitea is one: +> `main` sits at 1.24.2-rootless while `master` has 1.27.1-rootless plus the merged PRs and the 3.6.3 +> release. Reading `main` there tells you the recipe is three releases behind and missing two CVSS-9.8 +> RCE fixes — a false alarm that reads exactly like a real one. Resolve the default branch from the +> API (`/api/v1/repos/coop-cloud/` → `default_branch`) before reading any file, and never +> `git reset --hard origin/main` on a checkout that tracks `master`. + +Then read versions: +``` +set -a; . /srv/cc-ci/.testenv; set +a +ssh cc-ci "GITEA_USERNAME='$GITEA_USERNAME' GITEA_PASSWORD='$GITEA_PASSWORD' GITEA_URL='$GITEA_URL' bash -s --reconcile-only" \ + < /srv/cc-ci/.claude/skills/recipe-upgrade/open-recipe-pr.sh +ssh cc-ci 'export PATH=/run/current-system/sw/bin:$PATH; R=; \ + git -C ~/.abra/recipes/$R stash -u >/dev/null 2>&1 || true; \ + script -qec "abra recipe fetch $R --force -n" /dev/null; \ + script -qec "abra recipe upgrade $R -m -n" /dev/null; \ + git -C ~/.abra/recipes/$R stash pop >/dev/null 2>&1 || true' +``` + +For each recipe produce **one window per image**: `current pinned tag → newest supported tag`. You need +the sidecars (redis, postgres, nginx …), not just the app — a sidecar bump is where discourse's only +CRITICAL came from, and an image with no window is not counted at all. + +- **No upgrade available** → the recipe is `UPTODATE`; its CVE count is **`0`**, not `?`. There is + nothing an upgrade could fix. Record it and move on. +- **No output at all is NOT "no upgrade".** An abra call that times out, FATAs, or prints nothing + leaves the recipe **unverified** — treat it as a distinct outcome, never fold it into up-to-date. + Re-run it, and if it still yields nothing, resolve the versions by direct registry check (box item 4). + Only report `?` once BOTH the abra check and the direct check have failed. On the first real run this + distinction was the difference between two false zeros and the truth (both recipes turned out fine, + but nothing in the survey said so). + +### 3. Run the advisory scan over that window +``` +python3 /srv/cc-ci/cc-ci-plan/advisory-scan.py --from --to \ + [--image =:]... +``` +**One call per recipe with every image in it** — the count is a union across images, and the +UNKNOWN guarantee only holds when a single run sees them all. Paste the markdown block verbatim into +the per-recipe log at `/srv/cc-ci/.cc-ci-logs/cve-check//.md`. + +### 4. Adjudicate what the scan could not decide (pass 2) +If the block reports advisories it **could NOT judge**, or the count is **UNKNOWN**, re-run with +`--adjudicate` and decide each open case yourself: + +``` +python3 /srv/cc-ci/cc-ci-plan/advisory-scan.py … --adjudicate +``` + +Answer **FIXED / NOT-FIXED / STILL-UNKNOWN** per case, each with a one-line reason **citing the +evidence shown** — never from memory of the project, which is the exact failure that let two CVSS-9.8 +gitea RCEs be published as "none". Every FIXED is added to the count; pass 1's number is a floor. The +block also lists what pass 1 already decided — if a verdict looks wrong given its evidence, say so. +Record your verdicts in the per-recipe log so the number is auditable. + +### 5. Classify severity and priority +For each recipe collect the CVE ids with **severities** (the scan gives them, with GHSA ids). Sort the +report rows by what an operator should deal with first: +1. recipes with a **critical**, then **high**, then anything else with CVEs (more CVEs higher within a band); +2. then `?` (a count that could not be established — investigate, do not ignore); +3. then recipes with an upgrade available but **0** CVEs; +4. then `UPTODATE`. + +Severity outranks raw count: 2 CVSS-9.8 RCEs matter more than 120 medium plugin advisories. + +### 6. Write the report spec +`/tmp/cve-spec-.json`, same shape as `/recipe-report` (see `recipe-report.py`'s header), with: +- **`"kind": "cve"`** — titles the page "The Recipe Report — CVE check" and files it as + `cve-.html`. It appears in the SAME archive index as the weekly editions, suffixed + "— CVE check" so the two are told apart at a glance. Without this field you would overwrite that + date's weekly edition. +- `date`, `subtitle` "CVE check ", +- `lead` — **one short paragraph**: fleet exposure in a sentence and what to do first. +- `table[]` — every recipe swept. `recipe`; `change` = the window you scanned, e.g. + `1.27.0 → 1.27.1 · redis 7.4 → 8.10`; `status` = `UPTODATE` when nothing is available, else + `PENDING` (an upgrade exists and is not yet taken); **`cve`** = the count (integer, `?` only per the + rules below); `notes` = severity mix, whether the number is a floor, and `maintained elsewhere` for + `external` rows. **Leave `ci`/`pr` empty — nothing was built and no PR exists.** +- `addendum[]` — real anomalies only: registry URLs that failed, recipes whose window could not be + established, a scan whose count is a floor with many undetermined advisories. +- `security[]` — one entry per **critical/high** finding: recipe · CVE id(s) + severity · what it fixes + · **which image** it is in. Name the image: `CVE-2025-49844` is a redis flaw, and an operator reading + "discourse" needs to know that. +- `changes[]` — **omit** (nothing changed; there are no PRs). + +**`?` must stay RARE.** Use it only when a scan ran and reported genuinely failed sources, or the count +came back UNKNOWN and adjudication could not settle it. Never `none` for an unknown — a blank reads as +clean. A recipe with no upgrade available is `0`, not `?`. Many `?` is a bug for the Addendum. + +### 7. Render and publish — via the script only +``` +python3 /srv/cc-ci/cc-ci-plan/recipe-report.py render /tmp/cve-spec-.json /tmp/cve-.html +python3 /srv/cc-ci/cc-ci-plan/recipe-report.py publish /tmp/cve-.html cve +``` +All layout is owned by `recipe-report.py`. Never hand-write or post-process HTML; if `render` errors, +fix the spec JSON and re-render. **Public page — no secrets, tokens, internal hostnames, raw logs, or +any billing/spend figures.** + +### 8. Verify and stop +`curl -fsS https://report.ci.commoninternet.net/cve-.html` renders and the index lists it. Print +the URL, a one-line summary (`N recipes swept · M with CVEs · K critical`), and `CVE CHECK COMPLETE`, +then go idle. One-shot — do not loop, and do not start upgrading anything. + +## Guardrails +- **Read-only.** No PRs, no edits, no merges, no deploys, no CI runs. If a recipe looks urgent, say so + in the report — do not act on it. `/cve-check-and-upgrade` is the skill that acts. +- **Never report `0` for something you could not scan.** `0` means checked-and-clean; unknown is `?`. +- A count with undetermined advisories is a **floor** — say so in the notes rather than rounding away. +- **Public-safe output only.** diff --git a/.opencode/skills/cc-ci-status/SKILL.md b/.opencode/skills/cc-ci-status/SKILL.md index 21649d5..0366ef7 100644 --- a/.opencode/skills/cc-ci-status/SKILL.md +++ b/.opencode/skills/cc-ci-status/SKILL.md @@ -106,6 +106,12 @@ systemctl --failed --no-legend; df -h / | tail -1; tmux ls 1. → / (or operator action) … ``` +When a finding is that the fleet's **security exposure is unknown** — the last weekly run failed or +is stale, so nobody has scanned for CVEs recently — the recommended step is **`/cve-check`** (read-only, +minutes, no PRs). If it is instead that a known CVE is sitting unpatched, recommend +**`/cve-check-and-upgrade`** (add `--min-severity high` when only the urgent ones matter). Prefer +`/cve-check` over waiting for the next weekly run whenever the question is "are we exposed?". + `ALL HEALTHY` requires: recent successful weekly run + published report, no stale tests, no CVE PR open >14 days, both hosts <30 days behind their channel, zero failed units, disk under thresholds, bridge clean, maintained-set consistent. Anything else is a finding — even minor diff --git a/.opencode/skills/help/SKILL.md b/.opencode/skills/help/SKILL.md index 519ddfb..aef266b 100644 --- a/.opencode/skills/help/SKILL.md +++ b/.opencode/skills/help/SKILL.md @@ -31,6 +31,14 @@ Then present the roster grouped as follows, and close with the situation guide. PR). `--with-tests` also fixes that recipe's stale test. - **/recipe-report** — (re)generate the weekly report page for report.ci.commoninternet.net. +**Security (CVEs)** +- **/cve-check** — fleet-wide CVE sweep with **no upgrading**: for every recipe, work out what + upgrade is available (per image, sidecars included), scan it for CVEs, and publish a CVE report. + Read-only and quick — the "what are we exposed to?" answer without an upgrade run. +- **/cve-check-and-upgrade** — the same sweep, then open verified PRs **only** for the recipes whose + upgrade actually fixes a CVE, worst severity first. `--min-severity high` for just the urgent ones. + Never merges. + **Tests** - **/cc-ci-tests-update** — fleet-wide stale-test cleanup: find tests broken by legitimate upstream changes, fix without weakening, verify, merge the test PRs. @@ -73,6 +81,9 @@ ARM skills never touch cc-ci infra. After a submodule bump run `scripts/gen-ccte | "Run the weekly upgrades now" | `/upgrade-all` (or `systemctl start cc-ci-upgrade-all.service`) | | "Upgrade just " | `/recipe-upgrade ` | | "The report site is stale/missing a week" | `/recipe-report` | +| "What CVEs are we exposed to right now?" | `/cve-check` (read-only, no PRs) | +| "A CVE just dropped — check and patch it" | `/cve-check-and-upgrade` (add `--min-severity high` to skip the noise) | +| "Is vulnerable?" | `/cve-check ` | | "Tests are red because upstream changed" | `/cc-ci-tests-update` (fleet) or `/recipe-upgrade --with-tests` | | "A CI run failed and I don't know why" | `/ci-test-review` | | "Update the CI server OS/deps" | `/cc-ci-server-update` | diff --git a/cc-ci-plan/advisory-scan.py b/cc-ci-plan/advisory-scan.py index 1c9697a..622f741 100755 --- a/cc-ci-plan/advisory-scan.py +++ b/cc-ci-plan/advisory-scan.py @@ -333,6 +333,19 @@ def _releases(owner: str, repo: str, max_pages: int = 4) -> list[tuple[str, str] return out +def _source_repo(source: str) -> tuple[str, str] | None: + """(owner, repo) for a source, whether it is an advisory feed or a vendor page on GitHub. + + A CVE that appears ONLY on a vendor page still deserves the release-note method when that page + lives on GitHub — mailu announces its Roundcube CVEs on github.com/Mailu/Mailu/releases and + nowhere structured, so requiring an advisory feed sent a deterministic case to pass 2.""" + if source.startswith("github-advisories:"): + owner, _, repo = source.split(":", 1)[1].partition("/") + return (owner, repo) if owner and repo else None + m = re.match(r"https?://github\.com/([^/]+)/([^/#?]+)", source) + return (m.group(1), m.group(2).removesuffix(".git")) if m else None + + def release_fix_versions(source: str, cve: str) -> list[str]: """Release tags whose notes NAME this CVE — a deterministic fix version when the advisory has none. @@ -342,10 +355,10 @@ def release_fix_versions(source: str, cve: str) -> list[str]: (CVE-2025-32023 → 6.2.19, 7.2.10, 7.4.5, 8.0.3, 8.2.0). Ignoring that evidence undercounted discourse by 12 CVEs, so this is checked BEFORE giving up on an advisory. """ - if not source.startswith("github-advisories:"): + ref = _source_repo(source) + if not ref: return [] - owner, _, repo = source.split(":", 1)[1].partition("/") - return [tag for tag, body in _releases(owner, repo) if cve in body] + return [tag for tag, body in _releases(*ref) if cve in body] def advisory_text(ghsa: str, source: str | None = None) -> dict: @@ -707,17 +720,31 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str, # THIRD METHOD: before declaring an advisory undecidable, look for the CVE id in the project's # own release notes. A tag that names it, inside the window, IS the fix version the advisory # failed to publish. Deterministic and citable — not a judgement call. - resolved_by_release = {} - for cve in sorted(indeterminate - fixed_set): + # A window is keyed by advisory-feed source; map it to its repo so a vendor page on the SAME + # repo can be judged by the same window. + win_by_repo = {} + for wsrc, wv in windows.items(): + ref = _source_repo(wsrc) + if ref: + win_by_repo[ref] = wv + resolved_by_release, already_fixed = {}, set() + candidates = set(indeterminate) | { + c for c in unknown + if not any(s in windows for s in report["cves"][c]["sources"]) + and any(_source_repo(s) in win_by_repo for s in report["cves"][c]["sources"]) + } + for cve in sorted(candidates - fixed_set): e = report["cves"][cve] for src in e["sources"]: - if src not in windows: + ref = _source_repo(src) + if src not in windows and ref not in win_by_repo: continue - wf, wt = windows[src] + wf, wt = windows[src] if src in windows else win_by_repo[ref] kf, kt = _vkey(wf), _vkey(wt) if not (kf and kt): continue - hits = [t for t in release_fix_versions(src, cve) if _within(kf, kt, _vkey(t))] + naming = release_fix_versions(src, cve) + hits = [t for t in naming if _within(kf, kt, _vkey(t))] if hits: fixed_set.add(cve) resolved_by_release[cve] = sorted(hits) @@ -725,10 +752,23 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str, f"{', '.join(sorted(hits))}) via {src}") e["fix_versions_from_release_notes"] = sorted(hits) break + # Naming releases exist but ALL predate the version we were already on: the fix shipped + # before this upgrade, so the upgrade did not deliver it. That is a DECISION, not an + # unknown — mailu's redis 8.8.0 → 8.10.0 crosses 12 advisories all fixed by 8.6.3 or + # earlier, and reporting them as "could not judge" overstates the uncertainty. + if naming and all(_vkey(t) and not _within(kf, kt, _vkey(t)) for t in naming) \ + and max(_vkey(t) for t in naming if _vkey(t)) <= kf: + e["classification"] = ("outside-window: fixed in " + f"{', '.join(sorted(naming))}, all at or before {wf}") + e["fix_versions_from_release_notes"] = sorted(naming) + already_fixed.add(cve) + break if resolved_by_release: report["resolved_by_release_notes"] = resolved_by_release - indeterminate -= fixed_set + indeterminate -= fixed_set | already_fixed + if already_fixed: + report["already_fixed_before_upgrade"] = sorted(already_fixed) for cve in indeterminate: report["cves"][cve]["classification"] = "indeterminate: no fix version published" unknown = [c for c in unknown if c not in fixed_set] diff --git a/cc-ci-plan/recipe-report.py b/cc-ci-plan/recipe-report.py index 6c42772..b124996 100755 --- a/cc-ci-plan/recipe-report.py +++ b/cc-ci-plan/recipe-report.py @@ -9,7 +9,11 @@ Subcommands (the /recipe-report agent runs them around its own review/classifica survey [DATE] JSON of the run + every recipe's open PRs + CI verdict + per-recipe upgrade notes (breaking-change/CVE analysis), and the /upgrade-all summary. render SPEC.json OUT.html render the agent's report spec -> a self-contained newspaper HTML page - publish OUT.html DATE copy to cc-ci:/var/lib/cc-ci-reports/week-DATE.html and regen the archive index + publish OUT.html DATE [KIND] copy to cc-ci:/var/lib/cc-ci-reports/-DATE.html and regen the + archive index. KIND is `week` (default, the weekly /recipe-report) or `cve` + (a /cve-check advisory sweep). BOTH kinds appear in the SAME archive index, + newest first, each row suffixed "full report" or "CVE check"; the distinct + filename prefix just stops a sweep overwriting a weekly edition. Page order: short lead → the full wire table (priority-sorted, CVEs column) → Addendum → Security Bulletin → per-recipe "What changed". @@ -44,6 +48,10 @@ LOGDIR = "/srv/cc-ci/.cc-ci-logs" TESTENV = "/srv/cc-ci/.testenv" INFRA = {"cc-ci", "cc-ci-orchestrator", "cc-ci-secrets"} HOST_REPORTS = "/var/lib/cc-ci-reports" +# Both kinds live in ONE archive, distinguished by a suffix on a common title. +# prefix -> (page title, index label) +KINDS = {"week": ("The Recipe Report", "Week of {d} — full report"), + "cve": ("The Recipe Report — CVE check", "{d} — CVE check")} def _env(): @@ -215,8 +223,16 @@ def _table(rows, repo_url=None): if repo_url and r.get("recipe") in repo_url: name = f'{name}' cve = r.get("cve") - cve_cell = (f'{int(cve)}' if isinstance(cve, (int, float)) and cve - else 'none') + # "?" = advisory scan absent or had failed sources → count NOT authoritative. Per the + # /recipe-report guardrail this must NEVER render as "none" (a blank-that-reads-clean is + # exactly how two CVSS-9.8 gitea RCEs were misreported as "none" on 2026-08-07). A positive + # int is the confirmed CVE count; 0/omit is a confirmed-clean scan. + if isinstance(cve, str) and cve.strip() == "?": + cve_cell = '?' + elif isinstance(cve, (int, float)) and cve: + cve_cell = f'{int(cve)}' + else: + cve_cell = 'none' ci = _esc(r.get("ci")) if r.get("ci_url"): ci = f'{ci}' @@ -270,8 +286,10 @@ def _mast(): def render(spec_path, out_path): s = json.load(open(spec_path)) + kind = s.get("kind", "week") + title = KINDS.get(kind, KINDS["week"])[0] gen = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC") - sub = s.get("subtitle", "Week of " + s["date"]) + sub = s.get("subtitle", ("Week of " if kind == "week" else "CVE check ") + s["date"]) lead = s.get("lead", "") or "" # Auto-link recipe-name mentions in the lead to their mirror repos. gitea = _env().get("GITEA_URL", "git.autonomic.zone") @@ -285,7 +303,9 @@ def render(spec_path, out_path): f'report.ci.commoninternet.net{gen}' f'
{lead}
') # 1) the full wire — every recipe, in the agent's recommended priority order (CVEs first); CVEs column. - body += f'

The full wire — every recipe, in priority order

{_table(s.get("table"), repo_url)}' + wire = ("The full wire — every recipe, in priority order" if kind == "week" + else "Advisory sweep — every recipe, worst first") + body += f'

{wire}

{_table(s.get("table"), repo_url)}' # 2) addendum — special issues to look into (normal-size header); omitted entirely if there are none. add = [a for a in (s.get("addendum") or []) if str(a).strip()] if add: @@ -298,19 +318,30 @@ def render(spec_path, out_path): # 4) what changed — a short section per recipe that has a PR if s.get("changes"): body += f'

What changed

{_changes(s.get("changes"), repo_url)}' - body += (f'