Files

T

autonomic-bot 985dc06e47 advisory-scan: NVD by CPE, so mattermost and mumble stop scanning as '?'

Two recipes could not see CVEs at all. mattermost-lts has an empty GitHub advisory
feed and renders its security bulletins client-side, so a text sweep finds nothing;
mumble publishes nothing anywhere the registry points. Both returned '?' - nothing
measured - which is honest but useless.

NVD is CPE-indexed and carries structured version ranges, so it answers where the
vendor does not. Declared per recipe as 'nvd-cpe: <image> = <cpe:2.3:...>'.

  mattermost-lts 10.5.0  -> 10.12.4   165 CVEs
  mattermost-lts 10.11.22 -> 10.12.4    0 CVEs  (measured, not unknown)
  mumble         1.3.0   -> 1.6.870      2 CVEs

Both NVD range forms are used: versionEndExcluding is a patched version;
versionEndIncluding means the fix version is unpublished but the upgrade delivers
it whenever it crosses X.

That 0 for the actual mattermost upgrade is the interesting one, and it needed a
new rule to be correct: a fix on the line you upgrade FROM was already yours.
mattermost patches every maintained line at once, so 10.11.22 -> 10.12.4 crosses
10.12.1 while 10.11.22 already had the 10.11.4 backport. Without the rule the scan
claimed 12 CVEs the upgrade did not deliver.

The rule is skipped for placeholders: '7.4.X' parses to a bare 7.4 and would read
as 'already fixed at 7.4', which silently dropped redis CVE-2024-46981 and took
discourse 140 -> 139 before I caught it.

79 tests. discourse 140 / gitea 2 / mailu 2 / keycloak 12 / plausible 6 unchanged.
Fleet sweep: 0 recipes with no usable CVE source, down from 2.

2026-08-11 22:16:37 +00:00

2.0 KiB

Raw Blame History

Upstream sources — mumble

service	image	source repo	releases / changelog
app	mumblevoip/mumble-server	https://github.com/mumble-voip/mumble	https://github.com/mumble-voip/mumble/releases
web	rankenstein/mumble-web	https://github.com/rankenstein/mumble-web	https://github.com/rankenstein/mumble-web/releases

Standing notes

This file was missing entirely until 2026-08-11. Without it the advisory scan had no source to query, and still printed "0 identified by the deterministic scan" — which was then published as a clean 0 in the 2026-08-11 CVE check. The scan now refuses to emit a count when it has no usable source (it reports UNKNOWN), and audit-sources.py flags a missing registry file directly.
mumblevoip/mumble-server tracks the upstream server releases and DOES publish GitHub security advisories, so it is the recipe's primary CVE source.
rankenstein/mumble-web is a fork of the original Johni0702/mumble-web, which has been dormant since 2023-05. The fork itself last pushed 2023-07 and its Docker tag 0.5 was last built well over five years ago. Neither is archived, but treat the web client as effectively unmaintained: if a CVE lands there, expect no upstream fix and plan a replacement rather than an upgrade.
The server image tag is v<version>-<build> (e.g. v1.6.870-4); the trailing number is the image build, not an app version, and moves independently of upstream releases — abra recipe upgrade reports "no new versions" for it, so use resolve-images.py to see those bumps.

NVD CPE fallback

This project publishes nothing machine-readable we can reach — no GitHub advisory feed, no release-attributable changelog — so its CVE count was ? (nothing measured). NVD is CPE-indexed and carries structured version ranges, so it can answer where the vendor cannot. It LAGS the vendor, so it is a fallback, never the primary source.

nvd-cpe: mumble-server = cpe:2.3:a:mumble:mumble::::::::

2.0 KiB Raw Blame History

Upstream sources — mumble

Standing notes

NVD CPE fallback

2.0 KiB

Raw Blame History