Skip to content

Commit 2864fa3

Browse files
piyush-jenapiyush-jena
committed
test commit
Signed-off-by: Piyush Jena <[email protected]>
1 parent cd6b045 commit 2864fa3

File tree

3 files changed

+150
-0
lines changed

3 files changed

+150
-0
lines changed

‎.github/workflows/check-advisories.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: RPM Advisory Build & Verify
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'advisories/**/BRSA-*.toml'
7+
8+
jobs:
9+
find-changes:
10+
name: Find Changed Advisories
11+
runs-on: ubuntu-latest
12+
outputs:
13+
changed_files: ${{ steps.changed-files.outputs.all_changed_files || '[]' }}
14+
steps:
15+
- uses: actions/checkout@v4
16+
with:
17+
fetch-depth: 0
18+
- name: Get changed files
19+
id: changed-files
20+
uses: tj-actions/changed-files@v47
21+
with:
22+
json: true
23+
escape_json: false
24+
files_ignore_deleted_files: true
25+
files: |
26+
advisories/staging/**.toml
27+
- name: List all changed advisories files
28+
if: steps.changed-files.outputs.any_changed == 'true'
29+
env:
30+
ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
31+
run: |
32+
for file in ${ALL_CHANGED_FILES}; do
33+
echo "$file was changed"
34+
done
35+
build-and-verify:
36+
name: Build & Verify
37+
needs: find-changes
38+
runs-on: ubuntu-latest
39+
container:
40+
image: public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.65.1
41+
options: --user 0
42+
43+
# Only run this job if the 'find-changes' job actually found files
44+
if: needs.find-changes.outputs.changed_files != '[]'
45+
strategy:
46+
fail-fast: false # Don't cancel all jobs if one file fails
47+
matrix:
48+
arch: [aarch64]
49+
advisory_file: ${{ fromJson(needs.find-changes.outputs.changed_files) }}
50+
steps:
51+
# This builds the current packages and kits.
52+
- uses: actions/checkout@v4
53+
with:
54+
fetch-depth: 0
55+
- name: Install yq
56+
run: |
57+
echo "Installing yq..."
58+
sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
59+
sudo chmod +x /usr/bin/yq
60+
yq --version
61+
- name: Build, Find, and Verify RPMs
62+
run: |
63+
#!/usr/bin/env bash
64+
65+
echo "Processing advisory: ${{ matrix.advisory_file }}"
66+
cp /usr/lib/rpm/platform/${{ matrix.arch }}-bottlerocket/macros ~/.rpmmacros
67+
68+
if [[ ! -f "${{ matrix.advisory_file }}" ]]; then
69+
echo "::warning::File ${{ matrix.advisory_file }} does not exist. Skipping."
70+
exit 0
71+
fi
72+
73+
while IFS=$'\t' read -r package_name package_epoch package_version; do
74+
rpmspec_file="packages/${package_name}/${package_name}.spec"
75+
package_metadata=$(rpmspec --parse --query --qf "%{Name}:%{Epoch}:%{Version}\n" ${rpmspec_file})
76+
77+
while IFS=: read -r subpackage_name subpackage_epoch subpackage_version; do
78+
if [ ${subpackage_epoch} == "(none)" ]; then
79+
subpackage_epoch="0"
80+
fi
81+
82+
if [[ "${subpackage_name}" = *"${package_name}" ]]; then
83+
echo "Package metadata in ${{ matrix.advisory_file }}: ${package_name}, epoch: ${package_epoch}, version: ${package_version}"
84+
echo "Package metadata in the rpm: ${subpackage_name}, epoch: ${subpackage_epoch}, version: ${subpackage_version}"
85+
86+
if [ "${subpackage_epoch}" = "${package_epoch}" ] && \
87+
[ "${subpackage_version}" = "${package_version}" ]; then
88+
echo "Package metadata in the Advisory is validated."
89+
exit 0
90+
fi
91+
fi
92+
done < <(echo "$package_metadata")
93+
done < <(yq -o tsv '.advisory.products[] | [ .["package-name"], .["patched-epoch"], .["patched-version"] ]' ${{ matrix.advisory_file }})
94+
95+
exit 1

‎advisories/staging/BRSA-mavhpoajhdy8.toml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
[advisory]
2+
id = "BRSA-mavhpoajhdy8"
3+
title = "containerd CVE-2024-25621"
4+
cve = "CVE-2024-25621"
5+
severity = "moderate"
6+
description = """
7+
An overly broad default permission vulnerability was found in containerd. Directory paths /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim were all created with incorrect permissions."""
8+
9+
[[advisory.products]]
10+
package-name = "containerd-1.7"
11+
patched-version = "1.7.29"
12+
patched-epoch = "1"
13+
14+
[[advisory.products]]
15+
package-name = "containerd-2.0"
16+
patched-version = "2.0.7"
17+
patched-epoch = "1"
18+
19+
[[advisory.products]]
20+
package-name = "containerd-2.1"
21+
patched-version = "2.1.5"
22+
patched-epoch = "0"
23+
24+
[updateinfo]
25+
author = "kssessio"
26+
issue-date = 2025-11-13T15:40:31Z
27+
arches = ["x86_64", "aarch64"]
28+
version = "11.0.0"

‎advisories/staging/BRSA-s6xothqqu5vw.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[advisory]
2+
id = "BRSA-s6xothqqu5vw"
3+
title = "containerd CVE-2025-64329"
4+
cve = "CVE-2025-64329"
5+
severity = "moderate"
6+
description = "A bug was found in containerd's CRI Attach implementation that causes goroutine leaks. Repetitive calls to CRI Attach can exhaust memory on the host."
7+
8+
[[advisory.products]]
9+
package-name = "containerd-1.7"
10+
patched-version = "1.7.29"
11+
patched-epoch = "1"
12+
13+
[[advisory.products]]
14+
package-name = "containerd-2.0"
15+
patched-version = "2.0.7"
16+
patched-epoch = "1"
17+
18+
[[advisory.products]]
19+
package-name = "containerd-2.1"
20+
patched-version = "2.1.5"
21+
patched-epoch = "0"
22+
23+
[updateinfo]
24+
author = "kssessio"
25+
issue-date = 2025-11-13T15:40:31Z
26+
arches = ["x86_64", "aarch64"]
27+
version = "11.0.0"

0 commit comments

Comments
 (0)