Skip to content

Commit 986a2f1

Browse files
piyush-jenapiyush-jena
committed
test commit
Signed-off-by: Piyush Jena <[email protected]>
1 parent cd6b045 commit 986a2f1

File tree

6 files changed

+293
-0
lines changed

6 files changed

+293
-0
lines changed

‎.github/workflows/check-advisories.yaml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: RPM Advisory Build & Verify
2+
3+
on:
4+
push:
5+
paths:
6+
- 'advisories/**/BRSA-*.toml'
7+
pull_request:
8+
paths:
9+
- 'advisories/**/BRSA-*.toml'
10+
11+
jobs:
12+
find-changes:
13+
name: Find Changed Advisories
14+
runs-on: ubuntu-latest
15+
outputs:
16+
changed_files: ${{ steps.changed-files.outputs.all_changed_files || '[]' }}
17+
steps:
18+
- uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 0
21+
- name: Get changed files
22+
id: changed-files
23+
uses: tj-actions/changed-files@v47
24+
with:
25+
json: true
26+
escape_json: false
27+
files_ignore_deleted_files: true
28+
files: |
29+
advisories/staging/**.toml
30+
- name: List all changed advisories files
31+
if: steps.changed-files.outputs.any_changed == 'true'
32+
env:
33+
ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
34+
run: |
35+
for file in ${ALL_CHANGED_FILES}; do
36+
echo "$file was changed"
37+
done
38+
build-and-verify:
39+
name: Build & Verify
40+
needs: find-changes
41+
runs-on: ubuntu-latest
42+
43+
# Only run this job if the 'find-changes' job actually found files
44+
if: needs.find-changes.outputs.changed_files != '[]'
45+
strategy:
46+
fail-fast: false # Don't cancel all jobs if one file fails
47+
matrix:
48+
advisory_file: ${{ fromJson(needs.find-changes.outputs.changed_files) }}
49+
steps:
50+
- name: Install yq (for parsing TOML)
51+
run: |
52+
echo "Installing yq..."
53+
sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
54+
sudo chmod +x /usr/bin/yq
55+
yq --version
56+
- run: sudo apt -y install rpm jq build-essential openssl libssl-dev pkg-config liblz4-tool
57+
shell: bash
58+
- run: cargo install cargo-make
59+
shell: bash
60+
# This installs twoliter.
61+
- run: make prep
62+
# This fetches any external kit dependencies.
63+
- run: make fetch
64+
# This fetches Rust crate and Go module dependencies.
65+
- run: make twoliter fetch
66+
# This builds the current packages and kits.
67+
- uses: actions/checkout@v4
68+
with:
69+
fetch-depth: 0
70+
- name: Build, Find, and Verify RPMs
71+
run: |
72+
#!/usr/bin/env bash
73+
74+
version=$(yq -o tsv '.release-version' Twoliter.toml)
75+
echo "Processing advisory: ${{ matrix.advisory_file }}"
76+
if [[ ! -f "${{ matrix.advisory_file }}" ]]; then
77+
echo "::warning::File ${{ matrix.advisory_file }} does not exist. Skipping."
78+
exit 0
79+
fi
80+
81+
errors_found=false
82+
while IFS=$'\t' read -r package_name package_version package_epoch; do
83+
spec_file="packages/${package_name}/${package_name}.spec"
84+
if [[ -f "${spec_file}" ]]; then
85+
actual_epoch=$(grep -E "^Epoch:" "${spec_file}" | sed 's/Epoch:[[:space:]]*//' || echo "0")
86+
[[ -z "${actual_epoch}" ]] && actual_epoch="0"
87+
fi
88+
89+
echo "Package Name: ${package_name}"
90+
echo "Package Version : ${package_version}"
91+
echo "Package Epoch: ${package_epoch}"
92+
93+
PACKAGE="${package_name}" make twoliter build-package
94+
95+
RPM_DIR="build/rpms/$pkg_name"
96+
if [ ! -d "$RPM_DIR" ]; then
97+
echo "::error::RPM directory $RPM_DIR not found after build."
98+
exit 1
99+
fi
100+
101+
# Check that at least one RPM was produced
102+
RPM_COUNT=$(find "$RPM_DIR" -name "*.rpm" | wc -l)
103+
if [ "$RPM_COUNT" -eq 0 ]; then
104+
echo "::error::No RPM files found in $RPM_DIR for package $pkg_name"
105+
exit 1
106+
fi
107+
108+
echo "Found $RPM_COUNT RPM(s) in $RPM_DIR. Verifying all..."
109+
110+
find "$RPM_DIR" -name "*.rpm" -print0 | while IFS= read -r -d '' RPM_FILE; do
111+
112+
echo "--- Verifying RPM: $RPM_FILE ---"
113+
114+
# --- 4. Extract info from the RPM file ---
115+
# Use rpm --queryformat to get the exact fields
116+
# %{EPOCH} returns "(none)" if not set, so we must handle that.
117+
RPM_EPOCH_RAW=$(rpm -q --queryformat '%{EPOCH}' -p "$RPM_FILE")
118+
RPM_VERSION=$(rpm -q --queryformat '%{VERSION}' -p "$RPM_FILE")
119+
120+
# Default epoch to 0 if it's not set in the RPM
121+
RPM_EPOCH=0
122+
if [ "$RPM_EPOCH_RAW" != "(none)" ] && [ -n "$RPM_EPOCH_RAW" ]; then
123+
RPM_EPOCH="$RPM_EPOCH_RAW"
124+
fi
125+
126+
echo " Found RPM Version: $RPM_VERSION"
127+
echo " Found RPM Epoch: $RPM_EPOCH"
128+
129+
# --- 5. Compare RPM info to advisory info ---
130+
# Check 1: Epoch
131+
if [ "$RPM_EPOCH" != "${package_epoch}" ]; then
132+
echo "::error::Epoch mismatch for $RPM_FILE!"
133+
echo " Advisory requires epoch: ${package_epoch}"
134+
echo " Built RPM has epoch: $RPM_EPOCH"
135+
exit 1
136+
fi
137+
138+
# Check 2: Version
139+
if [ "$RPM_VERSION" != "${package_version}" ]; then
140+
echo "::error::Version mismatch for $RPM_FILE!"
141+
echo " Advisory requires version: ${package_version}"
142+
echo " Built RPM has version: $RPM_VERSION"
143+
exit 1
144+
fi
145+
146+
echo " SUCCESS: RPM $RPM_FILE matches advisory."
147+
148+
done # End of RPMs loop
149+
150+
echo "All $RPM_COUNT RPM(s) for $pkg_name verified successfully."
151+
echo
152+
153+
if [ ${package_epoch} -ne ${actual_epoch} ]; then
154+
echo "ERROR in ${file}: Package ${package_name} has epoch ${package_epoch}, should be ${actual_epoch}"
155+
errors_found=true
156+
fi
157+
done < <(yq -o tsv '.advisory.products[] | [ .["package-name"], .["patched-version"], .["patched-epoch"] ]' ${{ matrix.advisory_file }})
158+
159+
if ${errors_found}; then
160+
echo "Advisory validation FAILED!"
161+
exit 1
162+
else
163+
echo "Advisory validation PASSED!"
164+
fi

‎.github/workflows/validate-brsa.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Validate Epoch field in BRSA
2+
on:
3+
pull_request:
4+
branches: [develop]
5+
paths:
6+
# Bottlerocket Security Advisories
7+
- 'advisories/**'
8+
jobs:
9+
validate:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
# Install dependencies for twoliter and cargo-make.
14+
- name: Install yq (for parsing TOML)
15+
run: |
16+
echo "Installing yq..."
17+
sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
18+
sudo chmod +x /usr/bin/yq
19+
yq --version
20+
- run: ./tools/check-advisories
21+

‎.github/workflows/verify-signature.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Enforce Signed Commits
2+
3+
on:
4+
pull_request:
5+
branches: [develop]
6+
7+
jobs:
8+
check_signed_commits:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4
13+
14+
- name: Verify all commits in push are signed
15+
run: |
16+
git log ${{ github.event.before }}..${{ github.sha }} --pretty="%H %G?" --no-merges | while read commit_hash signature_status; do
17+
if [ "$signature_status" != "U" ]; then
18+
echo "Error: Unsigned commit found: $commit_hash"
19+
exit 1
20+
fi
21+
done

‎advisories/staging/BRSA-mavhpoajhdy8.toml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
[advisory]
2+
id = "BRSA-mavhpoajhdy8"
3+
title = "containerd CVE-2024-25621"
4+
cve = "CVE-2024-25621"
5+
severity = "moderate"
6+
description = """
7+
An overly broad default permission vulnerability was found in containerd. Directory paths /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim were all created with incorrect permissions."""
8+
9+
[[advisory.products]]
10+
package-name = "containerd-1.7"
11+
patched-version = "1.7.29"
12+
patched-epoch = "1"
13+
14+
[[advisory.products]]
15+
package-name = "containerd-2.0"
16+
patched-version = "2.0.7"
17+
patched-epoch = "1"
18+
19+
[[advisory.products]]
20+
package-name = "containerd-2.1"
21+
patched-version = "2.1.5"
22+
patched-epoch = "0"
23+
24+
[updateinfo]
25+
author = "kssessio"
26+
issue-date = 2025-11-13T15:40:31Z
27+
arches = ["x86_64", "aarch64"]
28+
version = "11.0.0"

‎advisories/staging/BRSA-s6xothqqu5vw.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[advisory]
2+
id = "BRSA-s6xothqqu5vw"
3+
title = "containerd CVE-2025-64329"
4+
cve = "CVE-2025-64329"
5+
severity = "moderate"
6+
description = "A bug was found in containerd's CRI Attach implementation that causes goroutine leaks. Repetitive calls to CRI Attach can exhaust memory on the host."
7+
8+
[[advisory.products]]
9+
package-name = "containerd-1.7"
10+
patched-version = "1.7.29"
11+
patched-epoch = "1"
12+
13+
[[advisory.products]]
14+
package-name = "containerd-2.0"
15+
patched-version = "2.0.7"
16+
patched-epoch = "1"
17+
18+
[[advisory.products]]
19+
package-name = "containerd-2.1"
20+
patched-version = "2.1.5"
21+
patched-epoch = "0"
22+
23+
[updateinfo]
24+
author = "kssessio"
25+
issue-date = 2025-11-13T15:40:31Z
26+
arches = ["x86_64", "aarch64"]
27+
version = "11.0.0"

‎tools/check-advisories‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/usr/bin/env bash
2+
3+
yq --version
4+
version=$(yq -o tsv '.release-version' Twoliter.toml)
5+
readarray -t files < <(find advisories/${version} advisories/staging -name "BRSA-*.toml")
6+
7+
errors_found=false
8+
for file in "${files[@]}"; do
9+
while IFS=$'\t' read -r package_name package_version package_epoch; do
10+
spec_file="packages/${package_name}/${package_name}.spec"
11+
if [[ -f "${spec_file}" ]]; then
12+
actual_epoch=$(grep -E "^Epoch:" "${spec_file}" | sed 's/Epoch:[[:space:]]*//' || echo "0")
13+
[[ -z "${actual_epoch}" ]] && actual_epoch="0"
14+
fi
15+
16+
echo "Package Name: ${package_name}"
17+
echo "Package Version : ${package_version}"
18+
echo "Package Epoch: ${package_epoch}"
19+
20+
if [ ${package_epoch} -ne ${actual_epoch} ]; then
21+
echo "ERROR in ${file}: Package ${package_name} has epoch ${package_epoch}, should be ${actual_epoch}"
22+
errors_found=true
23+
fi
24+
done < <(yq -o tsv '.advisory.products[] | [ .["package-name"], .["patched-version"], .["patched-epoch"] ]' ${file})
25+
done
26+
27+
if ${errors_found}; then
28+
echo "Advisory validation FAILED!"
29+
exit 1
30+
else
31+
echo "Advisory validation PASSED!"
32+
fi

0 commit comments

Comments
 (0)