autonomic-bot
985dc06e47
Two recipes could not see CVEs at all. mattermost-lts has an empty GitHub advisory feed and renders its security bulletins client-side, so a text sweep finds nothing; mumble publishes nothing anywhere the registry points. Both returned '?' - nothing measured - which is honest but useless. NVD is CPE-indexed and carries structured version ranges, so it answers where the vendor does not. Declared per recipe as 'nvd-cpe: <image> = <cpe:2.3:...>'. mattermost-lts 10.5.0 -> 10.12.4 165 CVEs mattermost-lts 10.11.22 -> 10.12.4 0 CVEs (measured, not unknown) mumble 1.3.0 -> 1.6.870 2 CVEs Both NVD range forms are used: versionEndExcluding is a patched version; versionEndIncluding means the fix version is unpublished but the upgrade delivers it whenever it crosses X. That 0 for the actual mattermost upgrade is the interesting one, and it needed a new rule to be correct: a fix on the line you upgrade FROM was already yours. mattermost patches every maintained line at once, so 10.11.22 -> 10.12.4 crosses 10.12.1 while 10.11.22 already had the 10.11.4 backport. Without the rule the scan claimed 12 CVEs the upgrade did not deliver. The rule is skipped for placeholders: '7.4.X' parses to a bare 7.4 and would read as 'already fixed at 7.4', which silently dropped redis CVE-2024-46981 and took discourse 140 -> 139 before I caught it. 79 tests. discourse 140 / gitea 2 / mailu 2 / keycloak 12 / plausible 6 unchanged. Fleet sweep: 0 recipes with no usable CVE source, down from 2.
30 lines
2.0 KiB
Markdown
30 lines
2.0 KiB
Markdown
# Upstream sources — mumble
|
|
|
|
| service | image | source repo | releases / changelog |
|
|
|---------|-------|-------------|----------------------|
|
|
| app | mumblevoip/mumble-server | https://github.com/mumble-voip/mumble | https://github.com/mumble-voip/mumble/releases |
|
|
| web | rankenstein/mumble-web | https://github.com/rankenstein/mumble-web | https://github.com/rankenstein/mumble-web/releases |
|
|
|
|
## Standing notes
|
|
- This file was **missing entirely** until 2026-08-11. Without it the advisory scan had no source to
|
|
query, and still printed "0 identified by the deterministic scan" — which was then published as a
|
|
clean `0` in the 2026-08-11 CVE check. The scan now refuses to emit a count when it has no usable
|
|
source (it reports UNKNOWN), and `audit-sources.py` flags a missing registry file directly.
|
|
- `mumblevoip/mumble-server` tracks the upstream server releases and DOES publish GitHub security
|
|
advisories, so it is the recipe's primary CVE source.
|
|
- `rankenstein/mumble-web` is a **fork** of the original `Johni0702/mumble-web`, which has been
|
|
dormant since 2023-05. The fork itself last pushed 2023-07 and its Docker tag `0.5` was last built
|
|
well over five years ago. Neither is archived, but treat the web client as effectively unmaintained:
|
|
if a CVE lands there, expect no upstream fix and plan a replacement rather than an upgrade.
|
|
- The server image tag is `v<version>-<build>` (e.g. `v1.6.870-4`); the trailing number is the image
|
|
build, not an app version, and moves independently of upstream releases — `abra recipe upgrade`
|
|
reports "no new versions" for it, so use `resolve-images.py` to see those bumps.
|
|
|
|
## NVD CPE fallback
|
|
This project publishes nothing machine-readable we can reach — no GitHub advisory feed,
|
|
no release-attributable changelog — so its CVE count was `?` (nothing measured). NVD is
|
|
CPE-indexed and carries structured version ranges, so it can answer where the vendor
|
|
cannot. It LAGS the vendor, so it is a fallback, never the primary source.
|
|
|
|
- nvd-cpe: mumble-server = cpe:2.3:a:mumble:mumble:*:*:*:*:*:*:*:*
|