Follow-on from #16. The distroless move took hearth from 23 findings / 12 CVEs / 4 CRITICAL to 15 / 5 / 0. What's left needs the same treatment HalcyonOps/container-hardening-lab gave its images: a register, not silence.
What's open
Why this isn't just paperwork
Three of the five are stdlib, so their reachability is a question about hearth's code, not about the base image. container-hardening-lab/docs/known-findings.md is explicit that stdlib parser findings are properties of the application: they apply at full severity to anything that parses untrusted tar, HTML or XML, and the lab's own entries say so precisely because a suppression would have been inherited silently.
So each one needs an actual answer for hearth, not a copy of the lab's:
- does hearth import
tarfile, and does it ever extract an archive it didn't create?
- does it parse HTML with the stdlib parser?
- does it parse XML from any request path?
If any answer is yes, that finding is real here and needs mitigating rather than recording.
Also
decisions/0016 in R055LE/runbook means none of these starts an age clock, since none has a fix. The 90-day review clock still applies, so the register entries need a machine-readable review date from the start rather than retrofitted.- Do not add a
.trivyignore. That's the thing the register exists instead of.
Acceptance
docs/known-findings.md exists with an entry per CVE carrying evidence, not a judgement- each stdlib entry answers the reachability question about hearth specifically
- the entries say what would resolve them
- anything found genuinely reachable gets an issue of its own rather than an entry
Follow-on from #16. The distroless move took hearth from 23 findings / 12 CVEs / 4 CRITICAL to 15 / 5 / 0. What's left needs the same treatment
HalcyonOps/container-hardening-labgave its images: a register, not silence.What's open
libncursesw6,libtinfo6libuuid1Why this isn't just paperwork
Three of the five are stdlib, so their reachability is a question about hearth's code, not about the base image.
container-hardening-lab/docs/known-findings.mdis explicit that stdlib parser findings are properties of the application: they apply at full severity to anything that parses untrusted tar, HTML or XML, and the lab's own entries say so precisely because a suppression would have been inherited silently.So each one needs an actual answer for hearth, not a copy of the lab's:
tarfile, and does it ever extract an archive it didn't create?If any answer is yes, that finding is real here and needs mitigating rather than recording.
Also
decisions/0016inR055LE/runbookmeans none of these starts an age clock, since none has a fix. The 90-day review clock still applies, so the register entries need a machine-readable review date from the start rather than retrofitted..trivyignore. That's the thing the register exists instead of.Acceptance
docs/known-findings.mdexists with an entry per CVE carrying evidence, not a judgement