fix: fail closed on incomplete weekly image and CVE surveys #33

2026-11-02T19:09:23Z

autonomic-bot commented

2026-11-02 19:09:23 +00:00

Why

The weekly upgrade skill trusted abra recipe upgrade for normal surveys. It emits a parse warning for CryptPad version-YYYY.M.D tags, so a newer image could be labelled UPTODATE unless an agent remembered a manual exception. The CVE scanner also emitted numeric zero when a changed sidecar had no matched advisory source, and audit-sources hid failed API calls behind a feed count.

Changes

Require an independent registry resolution for every image in every recipe, unioned with abra. An incomplete lookup, floating or templated tag, or truncated registry listing is UNVERIFIED, never UPTODATE. Retry OCI 429/503 responses.
Make CVE counts UNKNOWN when a source fails, no usable source is checked, or a changed image window has no matching source. Keep identified CVEs as an explicit floor. Ignore prose-only https://… placeholders.
Audit security source coverage on every weekly run and label the report column CVEs fixed, clarifying that zero is not a vulnerability-free certification. Surface missing GitHub token and rate-limit failures.

Evidence

81 offline advisory tests and 3 resolver tests pass; Python compilation and report rendering pass.
Live resolver sweep covered 23 recipes / 85 image references. It detects newer images in 15 recipes; CryptPad's current PR checkout is already on version-2026.10.0. It explicitly flags floating tags, a templated Ghost overlay, one GHCR HTTP 429, and a Docker Hub listing that exhausted 4,000 recent tags.
Live source audit found RustDesk Server has no verified CVE source. The cc-ci host lacks /srv/cc-ci/.github-token; after anonymous GitHub API rate-limit exhaustion the CryptPad advisory scan now returns UNKNOWN rather than a numeric zero.

Remaining dependency

A read-only GitHub API token at /srv/cc-ci/.github-token is needed for complete weekly GitHub advisory coverage. The code fails closed until configured. RustDesk Server remains explicitly unknown until a usable vendor/advisory source exists.

## Why The weekly upgrade skill trusted `abra recipe upgrade` for normal surveys. It emits a parse warning for CryptPad `version-YYYY.M.D` tags, so a newer image could be labelled UPTODATE unless an agent remembered a manual exception. The CVE scanner also emitted numeric zero when a changed sidecar had no matched advisory source, and `audit-sources` hid failed API calls behind a feed count. ## Changes - Require an independent registry resolution for every image in every recipe, unioned with abra. An incomplete lookup, floating or templated tag, or truncated registry listing is UNVERIFIED, never UPTODATE. Retry OCI 429/503 responses. - Make CVE counts UNKNOWN when a source fails, no usable source is checked, or a changed image window has no matching source. Keep identified CVEs as an explicit floor. Ignore prose-only `https://…` placeholders. - Audit security source coverage on every weekly run and label the report column CVEs fixed, clarifying that zero is not a vulnerability-free certification. Surface missing GitHub token and rate-limit failures. ## Evidence - 81 offline advisory tests and 3 resolver tests pass; Python compilation and report rendering pass. - Live resolver sweep covered 23 recipes / 85 image references. It detects newer images in 15 recipes; CryptPad's current PR checkout is already on `version-2026.10.0`. It explicitly flags floating tags, a templated Ghost overlay, one GHCR HTTP 429, and a Docker Hub listing that exhausted 4,000 recent tags. - Live source audit found RustDesk Server has no verified CVE source. The cc-ci host lacks `/srv/cc-ci/.github-token`; after anonymous GitHub API rate-limit exhaustion the CryptPad advisory scan now returns UNKNOWN rather than a numeric zero. ## Remaining dependency A read-only GitHub API token at `/srv/cc-ci/.github-token` is needed for complete weekly GitHub advisory coverage. The code fails closed until configured. RustDesk Server remains explicitly unknown until a usable vendor/advisory source exists.

autonomic-bot added 1 commit 2026-11-02 19:09:24 +00:00

fix: fail closed on incomplete weekly image and CVE surveys b41eeaed75

autonomic-bot merged commit 371546d1f8 into main

2026-11-02 19:09:49 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#33