Fail CI when a CVE exception has passed its expires date - #501
Closed
ai-collaboration-app[bot] wants to merge 4 commits into
Closed
Fail CI when a CVE exception has passed its expires date#501ai-collaboration-app[bot] wants to merge 4 commits into
ai-collaboration-app[bot] wants to merge 4 commits into
Conversation
The exceptions/ tree carries `expires` dates that nothing enforced. The scan-image evaluator does fail closed on expiry — a missing, unparseable or past date turns the exception back into a live finding — but its exit code is 0 unconditionally in `inform` mode, and that is the mode this repo's only consumer of the tree runs in (the report-only scan in build-deb.yml, since #487). The gating chart scan in StackVista/cve-reporter does not read the tree at all, so the dates were advisory. All four current entries expire 2026-09-04, two of them standing deferrals for Python advisories on the embedded 3.13.15 interpreter where no released fix exists. With this wired into the required roll-up the check goes red the day after an entry lapses, so renewing one means re-verifying upstream rather than letting a deferral drift into a silent permanent acceptance. It warns for two weeks beforehand so the red is never a surprise. The job needs no secrets and no self-hosted runner, so unlike every other job in this workflow it also covers fork pull requests. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Nothing explained the tree, so the split between the report-only scan that consumes it and the gating chart scan that ignores it was only discoverable by reading both pipelines. Someone hitting the new expiry check needs to know that the fix is to re-verify upstream, not to push the date out. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Both recorded a 2026-08-21 re-check and pointed at #489, which was opened for the OpenSSL exception and is superseded now that 3.5.8 is pinned. Re-verified against upstream CPython tags: 3.13.15 is still the newest 3.13 and 3.15 has only reached 3.15.0rc1, so the 3.15.0a6 fix CVE-2025-15367 advertises exists in no released version. Point them at the coordination ticket that actually tracks the batch. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Use the evaluator's exact YYYY-MM-DD grammar and cover divergent ISO forms with checked tests so the CI guard cannot accept an exception the scan rejects. Co-authored-by: Louis Lotter <louis.lotter@suse.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repository-local exceptions carry expiry dates, but their only image scan runs in
informmode. Add a required CI check so expired or malformed deferrals block new publication.The checker now accepts exactly the evaluator's
YYYY-MM-DDgrammar and has negative tests for alternate ISO forms and malformed documents. The four current entries expire on 2026-09-04.Tracking: #500
CVE coordination: https://github.com/StackVista/cve-reporter/issues/29
Validated with the checker test suite, the live exception tree,
git diff --check, and Zizmor.