audit-sources --security-sources: find the recipes that cannot see CVEs at all #10

2026-08-11T20:02:23Z

autonomic-bot commented

2026-08-11 20:02:23 +00:00

The sweep the operator asked for after the nginx finding: which other projects publish CVEs somewhere the scanner cannot use?

Before the changelog-attribution fix: 20 unusable sources. After: 5 — and all five are redundant, because the same project also publishes an advisory feed (redis, gitea, minio, clickhouse). Nothing is lost through those.

One real find, the same shape as nginx. ONLYOFFICE/DocumentServer publishes no GitHub advisories, and the registry pointed its CHANGELOG.md at the GitHub blob page — 636KB of markup in which the release headings do not survive HTML-stripping. Result: 24 CVEs visible, 0 attributable. The raw URL attributes all 24.

Rather than fix one registry line, advisory-scan now normalises github.com/../blob/.. → raw.githubusercontent.com, fixing every entry present and future. lasuite-drive bumps documentserver, so this was live.

Genuinely blind after all that: mattermost-lts and mumble — no advisory feed, no attributable changelog, no CVE data anywhere the registry points. mattermost is the notable one: it does publish security bulletins, but client-side rendered, so a text sweep sees nothing. Their scans can therefore report 0 while nothing was measured, so /cve-check now renders those two as ? with the reason.

The output deliberately separates a blind recipe from an unparseable page: conflating them made 5 harmless redundancies read as 5 gaps, which is the kind of noise that gets a security signal ignored.

22 recipes · 2 with NO usable CVE source: mattermost-lts, mumble
           · 5 unparseable page(s) elsewhere (harmless where a feed covers them)

76 tests unchanged.

The sweep the operator asked for after the nginx finding: which other projects publish CVEs somewhere the scanner cannot use? **Before the changelog-attribution fix: 20 unusable sources. After: 5 — and all five are redundant**, because the same project also publishes an advisory feed (redis, gitea, minio, clickhouse). Nothing is lost through those. **One real find, the same shape as nginx.** `ONLYOFFICE/DocumentServer` publishes **no** GitHub advisories, and the registry pointed its `CHANGELOG.md` at the GitHub **blob** page — 636KB of markup in which the release headings do not survive HTML-stripping. Result: 24 CVEs visible, **0 attributable**. The raw URL attributes all 24. Rather than fix one registry line, `advisory-scan` now normalises `github.com/../blob/..` → `raw.githubusercontent.com`, fixing every entry present and future. lasuite-drive bumps documentserver, so this was live. **Genuinely blind after all that: `mattermost-lts` and `mumble`** — no advisory feed, no attributable changelog, no CVE data anywhere the registry points. mattermost is the notable one: it *does* publish security bulletins, but client-side rendered, so a text sweep sees nothing. Their scans can therefore report `0` while nothing was measured, so `/cve-check` now renders those two as **`?`** with the reason. The output deliberately separates a blind **recipe** from an unparseable **page**: conflating them made 5 harmless redundancies read as 5 gaps, which is the kind of noise that gets a security signal ignored. ``` 22 recipes · 2 with NO usable CVE source: mattermost-lts, mumble · 5 unparseable page(s) elsewhere (harmless where a feed covers them) ``` 76 tests unchanged.

autonomic-bot added 1 commit 2026-08-11 20:02:24 +00:00

audit-sources --security-sources: find the recipes that cannot see CVEs at all 46ace30b4d

Follow-up to the nginx blind spot. Sweeping all 22 recipes for sources whose CVEs
are USABLE (structured advisory feed, or a changelog attributable to releases)
rather than merely visible.

Before the changelog-attribution fix: 20 unusable sources. After: 5, and all five
are redundant - the same project also publishes an advisory feed (redis, gitea,
minio, clickhouse), so nothing is actually lost.

One real find, same shape as nginx: ONLYOFFICE/DocumentServer publishes NO GitHub
advisories, and the registry pointed its CHANGELOG.md at the GitHub *blob* page -
636KB of markup in which the release headings do not survive HTML-stripping, so 24
CVEs were visible and NONE attributable. The raw URL attributes all 24. Rather than
fix one registry line, advisory-scan now normalises github.com/../blob/.. to
raw.githubusercontent.com, which fixes every entry present and future.
lasuite-drive bumps documentserver, so this was live.

Genuinely blind after all that: mattermost-lts and mumble - no advisory feed, no
attributable changelog, no CVE data anywhere the registry points. mattermost is the
notable one: its bulletins are client-side rendered, so a regex sweep sees nothing.
Their scans can report 0 while nothing was measured, so /cve-check now renders those
recipes as ? and says why.

The audit output distinguishes a blind RECIPE from an unparseable PAGE, because
conflating them made 5 harmless redundancies look like 5 gaps.

autonomic-bot merged commit 4b9978ac02 into main

2026-08-11 20:02:24 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#10