0 Fork 0

mirror of https://github.com/RayLabsHQ/gitea-mirror.git synced 2026-10-30 22:21:58 +01:00

Files

T

History

ARUNAVO RAY f0814c14fc fix: patch Go, git-lfs deps and npm packages flagged by Scout and Dependabot (#473 )

- git-lfs is built with Go 1.27.3, golang.org/x/net 0.61.0 and
  golang.org/x/crypto 0.58.0.
- Raise the floors for sharp, smol-toml, source-map-js and
  http-cache-semantics in the app and the site, and pin the site's vite to
  8.1.6.
- The VEX product for the published image is now
  pkg:docker/raylabshq/gitea-mirror?repository_url=ghcr.io. The old
  pkg:docker/ghcr.io/... form never matched, so the zlib CVE-2026-85091
  exception was ignored on main scans.

2026-10-23 08:57:13 +05:30

README.md

fix: patch Go, git-lfs deps and npm packages flagged by Scout and Dependabot (#473 )

2026-10-23 08:57:13 +05:30

util-linux-mount-nsenter.vex.json

fix: patch Go, git-lfs deps and npm packages flagged by Scout and Dependabot (#473 )

2026-10-23 08:57:13 +05:30

zlib-gz-vacate.vex.json

fix: patch Go, git-lfs deps and npm packages flagged by Scout and Dependabot (#473 )

2026-10-23 08:57:13 +05:30

README.md

Vulnerability exceptions for the Docker image

This folder holds OpenVEX statements for CVEs that Docker Scout reports against the image but that the image cannot reach. Each statement names the CVE, says why it does not apply, and points at the upstream and Debian status so the reason can be checked later.

The statements are used in two places:

The Docker Scout steps in .github/workflows/docker-build.yml pass vex-location: .vex together with vex-author and only-vex-affected, so the scan that feeds the Security tab leaves these CVEs out. Scout ignores statements from authors that are not listed; the default author filter only accepts *@docker.com.
The Dockerfile copies *.vex.json into /var/lib/db/ in the runner stage, so docker scout cves ghcr.io/raylabshq/gitea-mirror:latest shows the same result for anyone who scans the published image.

To check locally:

docker scout cves --vex-location .vex --vex-author developer@arunavoray.dev \
  --only-vex-affected ghcr.io/raylabshq/gitea-mirror:latest

Product IDs

Each statement lists the image under every name Scout scans it as. A docker package URL carries the registry in the repository_url qualifier, and one without it means Docker Hub, so the published image needs pkg:docker/raylabshq/gitea-mirror?repository_url=ghcr.io. Writing the registry into the path (pkg:docker/ghcr.io/raylabshq/gitea-mirror) never matches. The PR scan of the locally built gitea-mirror:scan matches pkg:docker/gitea-mirror. Leaving the version out applies a statement to every tag.

When to remove a statement

Delete the statement once the Debian package it covers is fixed in the base image (the CVE disappears from the scan on its own), or once the reasoning no longer holds, for example if the image starts running a setuid helper or a different user model. Debian's status for a CVE is at https://security-tracker.debian.org/tracker/<CVE>.

Current statements

File	CVEs	Package	Why
`util-linux-mount-nsenter.vex.json`	CVE-2026-78408, CVE-2026-78409, CVE-2026-78410	util-linux 2.41.5-0+deb13u1 (trixie, no fix planned)	nsenter and setuid mount(8) are never used; the runner stage strips setuid bits and the app runs unprivileged.
`zlib-gz-vacate.vex.json`	CVE-2026-85091	zlib 1:1.3.dfsg+really1.3.1-1 (trixie, unfixed in every Debian release)	The gz* write API (gzwrite, gzprintf) is never used: git, git-lfs and Bun only use the deflate and inflate stream functions.