Support stable GO/Debian advisory IDs and scoped occurrence reviews #63

Merged

gitchegumi merged 2 commits from kiyi/stable-upstream-risk-review into main

2026-09-27 13:14:04 -05:00

kiyi commented

2026-09-27 01:18:23 -05:00

Member

Changes

Extend exact vulnerability selectors to GO, DLA and DSA IDs, with optional stable target/count maps.
Add schema 2 image configuration reviews keyed by Dockerfile rule ID, image repository, owning package/version, component, severity and exact stable target/count. Schema 1 remains supported for existing reviews and rejects configuration entries.
Preserve reviews across source-line, temporary archive and release-provenance changes. Changed findings and excess counts remain blocking.
Accept package contexts supplied by the owning caller from verified archived metadata. Missing context remains blocking.
Allow bounded partial counts during image preflight so malware and SBOM follow-ups still run; final evaluation requires exact counts. Secret, malware, scanner-error and unreviewed-finding gates remain required.

Validation

49 source tests passed: 36 policy/security, 6 mocked image-preflight and 7 reporting tests. Tests cover schema migration, stable rule/path identity, archive and provenance movement, package/version changes, missing context, count changes and required follow-ups. git diff --check passed. No local container/runtime tests were run.

Adoption

Prepared for v1.23.0 after review/merge and operator-controlled publication; no released tag is claimed. The current implementation is a9ac5bd5ad813854a666451930134bfb590e6d1f. Migrate consumers and policy schemas together. Platform is preparing the six owner-accepted Core/init configuration findings from run 4675, expiring 2026-10-27; these are risk acceptances, not false-positive or remediation claims.

## Changes - Extend exact vulnerability selectors to GO, DLA and DSA IDs, with optional stable target/count maps. - Add schema 2 image configuration reviews keyed by Dockerfile rule ID, image repository, owning package/version, component, severity and exact stable target/count. Schema 1 remains supported for existing reviews and rejects configuration entries. - Preserve reviews across source-line, temporary archive and release-provenance changes. Changed findings and excess counts remain blocking. - Accept package contexts supplied by the owning caller from verified archived metadata. Missing context remains blocking. - Allow bounded partial counts during image preflight so malware and SBOM follow-ups still run; final evaluation requires exact counts. Secret, malware, scanner-error and unreviewed-finding gates remain required. ## Validation 49 source tests passed: 36 policy/security, 6 mocked image-preflight and 7 reporting tests. Tests cover schema migration, stable rule/path identity, archive and provenance movement, package/version changes, missing context, count changes and required follow-ups. `git diff --check` passed. No local container/runtime tests were run. ## Adoption Prepared for v1.23.0 after review/merge and operator-controlled publication; no released tag is claimed. The current implementation is `a9ac5bd5ad813854a666451930134bfb590e6d1f`. Migrate consumers and policy schemas together. Platform is preparing the six owner-accepted Core/init configuration findings from run 4675, expiring 2026-10-27; these are risk acceptances, not false-positive or remediation claims.

kiyi added 1 commit

2026-09-27 01:18:23 -05:00

Support stable advisory IDs and scoped vulnerability occurrence reviews

Workflow acceptance / acceptance (pull_request) Successful in 1m52s

Details

Repository security / security-1 (pull_request) Successful in 4m56s

Details

Library checks / tests (pull_request) Successful in 4m55s

Details

247f4d259a

kiyi added 1 commit

2026-09-27 10:10:33 -05:00