From 74117c22607abca43a5dc61b2d67532cf31764b0 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Tue, 11 Aug 2026 22:16:52 +0000 Subject: [PATCH] cve-check: record the remedy for a blind recipe, not just the symptom The skill said to render a sourceless recipe as '?'. It now says how to stop it being sourceless: declare an NVD CPE in the registry. That is what took the fleet from two blind recipes to zero, and it is the first thing to try when the sweep flags another. --- .claude/skills/cve-check/SKILL.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.claude/skills/cve-check/SKILL.md b/.claude/skills/cve-check/SKILL.md index 4dc4d97..8527039 100644 --- a/.claude/skills/cve-check/SKILL.md +++ b/.claude/skills/cve-check/SKILL.md @@ -109,9 +109,18 @@ CRITICAL came from, and an image with no window is not counted at all. python3 cc-ci-plan/audit-sources.py --security-sources ``` A recipe whose sources yield **no CVE data at all** cannot produce a meaningful `0` — nothing was -measured, the same way a missing registry file cannot. As of 2026-08-11 that is **mattermost-lts** -(its GitHub advisory feed is empty and its security bulletins are client-side rendered) and -**mumble**. Render those as **`?`**, not `0`, and say why in the notes. +measured, the same way a missing registry file cannot. Render those as **`?`**, not `0`. + +**The fleet is currently at zero such recipes.** The last two — `mattermost-lts` (empty advisory +feed, client-side-rendered bulletins) and `mumble` (nothing published anywhere) — were fixed by +declaring an NVD CPE in their registry: +``` +- nvd-cpe: mattermost-team-edition = cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* +``` +**If this sweep ever reports a blind recipe again, that is the fix**: find the product's CPE at +nvd.nist.gov and add the line. Prefer a real advisory feed or an attributable changelog when one +exists — NVD lags the vendor — but a lagging source beats no source, and it turns a `?` into a +number. An *unparseable page* is NOT the same thing: it is harmless when the same project also publishes an advisory feed (redis, gitea, minio, clickhouse all do). Only "no usable source for this image" counts.