fix: qualify upstream-fixed MariaDB scanner findings

clement commented

2026-09-25 17:14:33 +00:00

Owner

The Debian 13 feed flags six CVEs already fixed in the upstream MariaDB packages installed by these images. Generate narrowly scoped Grype rules only after attesting the staged image source, distribution and binary version; each rule matches one CVE and the exact installed package version. Publisher references and image evidence are retained with scan artifacts. All other findings, scanners and thresholds remain unchanged.

Validation: six policy tests pass. Actual Grype scans of both staged servers (11.8.9 and 12.3.3) retain every unrelated finding, with 0 critical and 7 high findings remaining. Receipts: /var/lib/compose-version-rollout/mariadb-upstream-scan-20260925T170546. Also bound Go scanner concurrency to two threads.

The Debian 13 feed flags six CVEs already fixed in the upstream MariaDB packages installed by these images. Generate narrowly scoped Grype rules only after attesting the staged image source, distribution and binary version; each rule matches one CVE and the exact installed package version. Publisher references and image evidence are retained with scan artifacts. All other findings, scanners and thresholds remain unchanged. Validation: six policy tests pass. Actual Grype scans of both staged servers (11.8.9 and 12.3.3) retain every unrelated finding, with 0 critical and 7 high findings remaining. Receipts: `/var/lib/compose-version-rollout/mariadb-upstream-scan-20260925T170546`. Also bound Go scanner concurrency to two threads.

clement added 1 commit

2026-09-25 17:14:33 +00:00

fix: qualify upstream-fixed MariaDB scanner findings 775a55f9e0

clement merged commit 99683e64d0 into main

2026-09-25 17:14:53 +00:00

clement referenced this pull request from a commit

2026-09-25 17:14:55 +00:00

fix: qualify upstream-fixed MariaDB scanner findings (#7)

Rows
Columns

fix: qualify upstream-fixed MariaDB scanner findings #7