Repository navigation
Qualify exact glibc component scope without hiding nscd findings - #364
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-89092 affects the standalone nscd daemon modules. The qualified libc6, libc-bin and libc-gconv-modules-extra archives do not contain those modules; libc IPC client helpers may still be present. A source-package match must not be treated as a blanket image exemption or as an applied nscd fix.
Bind the reviewed Ubuntu source/patch, native object/link and exact archive/payload closure to one code-absence statement for those three complete versioned PURLs. All other statements retain the fixed-only policy, and the independent nscd package and old libc version remain outside this scope. The existing immutable OCI producer metadata checksums still bind consumer evidence.
Add native Trivy positive/negative matcher controls in PR checks and production qualification; preserve raw reports and require that only the three scoped pairs disappear. Source-only test receipts cannot authorize production. Anonymous publication keeps an exact-manifest/readback gate after a bounded visibility/propagation wait; existing-tag refusal is unchanged.
Validation: 43 focused Python tests, syntax/workflow checks and three actual retained payload bindings pass. Native Trivy semantics remains required in this PR before merge. Unchanged compiler, native package suites and VM installer controls are carried forward rather than rerun.