mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-14 06:37:25 +00:00
kevinveenbirkenbachandClaude Opus 5.5
6b36c8579a
The runtime check judged PHP by its upstream version and failed every container on an end-of-life line. Distribution builds backport fixes without raising that number, so main run 41154895895 failed Checkmk#0 on `PHP 8.1.2-1ubuntu2.28 runs the end-of-life line 8.1`, a build Ubuntu lists as fixed for CVE-2026-109618 and CVE-2026-109619. - The role now runs Trivy, Grype and OSV-Scanner, with a Syft SBOM per target, against the host and the images of the running containers, in bounded parallel lanes. Targets, engines and the failing severities are lists in meta/services.yml; the default is every target and engine at CRITICAL and HIGH with a fix available. - Grype always scans the binary-classified packages of the SBOM, so a PHP built from source in an official php image (8.4.26) still fails on the CVEs fixed in 8.4.27, which Trivy and OSV do not see. - OSV reads an SBOM copy whose distro purls carry the source package name. - A CVE is suppressed only in the role owning the image, under services.<service>.security.suppressions with id, until and a `# nocheck: cve <reason>` marker; a lint rejects bare, malformed and expired entries. - The deploy-time run fails on its first finding: sys-service gains system_service_run_once and sys-service-terminator skips the retries only for those units. The timer runs daily at 00:00 UTC. - The PHP version floors are removed; the php_hardening check stays. - make test-security replaces make security-runtimes: Syft builds an SBOM of every pinned image straight from the GHCR mirror, cached by digest, and the three engines scan it with the role's threshold and suppressions. Part of #1324 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>