0 Fork 0

mirror of https://github.com/RayLabsHQ/gitea-mirror.git synced 2026-10-30 22:21:58 +01:00

Files

T

ARUNAVO RAY 7d17194e51 fix: review follow-ups for the organizations dialog and multi-source gating (#406 )

Review follow-ups after #403 and #404: dialog copy and placeholder, forge-aware owner parser, GitHub only mirror switches available while any connected source is GitHub, configuration header copy, self-contained encryption test. Also builds the Sources card token settings link from validated URL parts (CodeQL alert) and adds a VEX statement for CVE-2026-85091 in zlib, which nothing in the image can reach.

2026-09-07 06:49:21 +05:30

README.md

fix: review follow-ups for the organizations dialog and multi-source gating (#406 )

2026-09-07 06:49:21 +05:30

util-linux-mount-nsenter.vex.json

fix(security): clear the util-linux and git-lfs scan alerts (#402 )

2026-09-04 07:53:47 +05:30

zlib-gz-vacate.vex.json

fix: review follow-ups for the organizations dialog and multi-source gating (#406 )

2026-09-07 06:49:21 +05:30

README.md

Vulnerability exceptions for the Docker image

This folder holds OpenVEX statements for CVEs that Docker Scout reports against the image but that the image cannot reach. Each statement names the CVE, says why it does not apply, and points at the upstream and Debian status so the reason can be checked later.

The statements are used in two places:

The Docker Scout steps in .github/workflows/docker-build.yml pass vex-location: .vex together with vex-author and only-vex-affected, so the scan that feeds the Security tab leaves these CVEs out. Scout ignores statements from authors that are not listed; the default author filter only accepts *@docker.com.
The Dockerfile copies *.vex.json into /var/lib/db/ in the runner stage, so docker scout cves ghcr.io/raylabshq/gitea-mirror:latest shows the same result for anyone who scans the published image.

To check locally:

docker scout cves --vex-location .vex --vex-author developer@arunavoray.dev \
  --only-vex-affected ghcr.io/raylabshq/gitea-mirror:latest

When to remove a statement

Delete the statement once the Debian package it covers is fixed in the base image (the CVE disappears from the scan on its own), or once the reasoning no longer holds, for example if the image starts running a setuid helper or a different user model. Debian's status for a CVE is at https://security-tracker.debian.org/tracker/<CVE>.

Current statements

File	CVEs	Package	Why
`util-linux-mount-nsenter.vex.json`	CVE-2026-78408, CVE-2026-78409, CVE-2026-78410	util-linux 2.41.5-0+deb13u1 (trixie, no fix planned)	nsenter and setuid mount(8) are never used; the runner stage strips setuid bits and the app runs unprivileged.
`zlib-gz-vacate.vex.json`	CVE-2026-85091	zlib 1:1.3.dfsg+really1.3.1-1 (trixie, unfixed in every Debian release)	The gz* write API (gzwrite, gzprintf) is never used: git, git-lfs and Bun only use the deflate and inflate stream functions.