From 57319ea8f8c917ca5b4ebb8694d4803f09075045 Mon Sep 17 00:00:00 2001 From: Adam Hernandez <31273212+DeusExTaco@users.noreply.github.com> Date: Sat, 17 Oct 2026 14:15:18 -0700 Subject: [PATCH 1/2] fix(getcomics): retain issue coverage in download pack headings --- .../src/pullbox_provider_getcomics/parser.py | 8 +-- tests/unit/test_getcomics_parser.py | 51 +++++++++++++++++++ tests/unit/test_getcomics_service.py | 41 +++++++++++++++ 3 files changed, 97 insertions(+), 3 deletions(-) diff --git a/providers/getcomics/src/pullbox_provider_getcomics/parser.py b/providers/getcomics/src/pullbox_provider_getcomics/parser.py index 0f584a6..8382500 100644 --- a/providers/getcomics/src/pullbox_provider_getcomics/parser.py +++ b/providers/getcomics/src/pullbox_provider_getcomics/parser.py @@ -22,6 +22,7 @@ _SIZE = re.compile(r"\bSize\s*:\s*(\d+(?:\.\d+)?)\s*(KB|MB|GB)\b", re.IGNORECASE) _QUALITY_VARIANT = re.compile(r"\s*\((?:HD|SD)[-\s]*Digital\)\s*", re.IGNORECASE) +_DOWNLOAD_SUFFIX = re.compile(r"\s+Free\s+Download\s*$", re.IGNORECASE) _CONTROL_PREFIX = re.compile( r"^(?:(?:DOWNLOAD NOW|READ ONLINE|PIXELDRAIN|MEGA|MEGANZ|ROOTZ|MEDIAFIRE|" r"TERABOX|DATANODES|VIKINGFILE)\s+)+", @@ -201,7 +202,7 @@ def parse_release_html( continue group_text = " ".join(group.text_parts) title = _release_title(group.text_parts, source_url) - evidence = parse_comic_title(_QUALITY_VARIANT.sub(" ", title)) + evidence = parse_comic_title(_DOWNLOAD_SUFFIX.sub("", _QUALITY_VARIANT.sub(" ", title))) size_bytes = _parse_size(group_text) artifacts.append( Artifact( @@ -317,9 +318,10 @@ def _release_title(text_parts: list[str], source_url: str) -> str: def _looks_like_release_metadata(text: str) -> bool: - evidence = parse_comic_title(text) + evidence = parse_comic_title(_DOWNLOAD_SUFFIX.sub("", text)) return bool( - _SIZE.search(text) + _DOWNLOAD_SUFFIX.search(text) + or _SIZE.search(text) or evidence.issue_numbers or evidence.volume or evidence.year is not None diff --git a/tests/unit/test_getcomics_parser.py b/tests/unit/test_getcomics_parser.py index 63628c2..1997c62 100644 --- a/tests/unit/test_getcomics_parser.py +++ b/tests/unit/test_getcomics_parser.py @@ -13,6 +13,57 @@ FIXTURES = Path(__file__).parents[1] / "fixtures" / "getcomics" +@pytest.mark.parametrize("dash", ["-", "\u2013"]) +def test_download_suffix_keeps_adjacent_pack_groups_separate(dash: str) -> None: + html = f"""
+

House of M #1-8 (2005)

+

House of M #1{dash}4 Free Download

+ DOWNLOAD NOW +

House of M #5{dash}8 Free Download

+ DOWNLOAD NOW +
""" + artifacts = parse_release_html(html, source_url="https://getcomics.org/marvel/pack/") + assert [a.coverage.issue_numbers for a in artifacts] == [ + ["1", "2", "3", "4"], + ["5", "6", "7", "8"], + ] + assert [len(a.mirrors) for a in artifacts] == [1, 1] + + +@pytest.mark.parametrize( + "heading", + [ + "House of M Free Download", + "House of M #1-8 Free Download unavailable", + "House of M #1-8 and other comics Free Download", + ], +) +def test_download_suffix_never_borrows_page_coverage(heading: str) -> None: + html = f"""

House of M #1-8 (2005)

+

{heading}
Size : 400 MB

+ DOWNLOAD NOW +
""" + artifacts = parse_release_html(html, source_url="https://getcomics.org/marvel/pack/") + assert len(artifacts) == 1 + assert artifacts[0].coverage.issue_numbers == [] + + +@pytest.mark.parametrize( + "heading", + [ + "House of M Free Download", + "House of M #1-8 and other comics Free Download", + ], +) +def test_download_group_without_size_still_requires_its_own_issue_evidence(heading: str) -> None: + html = f"""

House of M #1-8 (2005)

+

{heading}

+ DOWNLOAD NOW +
""" + artifacts = parse_release_html(html, source_url="https://getcomics.org/marvel/pack/") + assert artifacts[0].coverage.issue_numbers == [] + + def test_search_parser_normalizes_issue_and_collection_candidates() -> None: candidates = parse_search_html( (FIXTURES / "search-results.html").read_text(encoding="utf-8"), diff --git a/tests/unit/test_getcomics_service.py b/tests/unit/test_getcomics_service.py index 458459b..9842b54 100644 --- a/tests/unit/test_getcomics_service.py +++ b/tests/unit/test_getcomics_service.py @@ -12,6 +12,47 @@ FIXTURES = Path(__file__).parents[1] / "fixtures" / "getcomics" +@pytest.mark.parametrize( + ("series", "year", "count", "target"), + [("House of M", 2005, 8, n) for n in (3, 7)] + + [("House of M \u2013 Masters of Evil", 2009, 4, n) for n in range(1, 5)], +) +async def test_house_of_m_search_and_resolve_preserve_pack_coverage( + series: str, year: int, count: int, target: int +) -> None: + async def pages(url: str, **_kwargs: object) -> str: + if urlsplit(url).query: + return f"""

Search Result

+
+ {series} #1 \u2013 {count} ({year})
""" + return f"""
+

{series} #1-{count} Free Download
+ Language : English | Year : {year} | Size : 400 MB

+ DOWNLOAD NOW + MEGA
""" + + service = GetComicsProviderService(page_fetcher=pages) + candidates = await service.search( + SearchIntent( + series_title=series, + normalized_title=series.casefold(), + issue_number=str(target), + year=year, + ), + limit=1, + ) + expected = [str(n) for n in range(1, count + 1)] + assert candidates[0].parsed.issue_numbers == expected + artifacts = await service.resolve(candidates[0].provider_candidate_id) + assert len(artifacts) == 1 + assert artifacts[0].coverage.issue_numbers == expected + assert artifacts[0].coverage.description == series + assert str(target) in artifacts[0].coverage.issue_numbers + assert [m.host_kind for m in artifacts[0].mirrors] == ["generic_https", "mega"] + + class _Pages: def __init__(self) -> None: self.urls: list[str] = [] From 322176bc7c9ae45c4ed71d768a35843b41e3e71b Mon Sep 17 00:00:00 2001 From: Adam Hernandez <31273212+DeusExTaco@users.noreply.github.com> Date: Sat, 17 Oct 2026 15:07:00 -0700 Subject: [PATCH 2/2] chore(release): prepare GetComics 1.0.4 with patched runtime --- .../container-vulnerability-baseline.json | 312 ++++++++++++------ README.md | 2 +- docker/Dockerfile.annas-archive | 9 +- docker/Dockerfile.getcomics | 9 +- docker/Dockerfile.libgen | 9 +- docker/Dockerfile.provider-smoke | 9 +- docker/Dockerfile.synthetic | 9 +- docker/compose.providers-test.yml | 8 +- docker/compose.synthetic-test.yml | 4 +- providers/getcomics/pyproject.toml | 2 +- tests/unit/test_container_contract.py | 15 +- tests/unit/test_provider_release_metadata.py | 8 +- tests/unit/test_vulnerability_baseline.py | 31 +- 13 files changed, 284 insertions(+), 143 deletions(-) diff --git a/.github/security/container-vulnerability-baseline.json b/.github/security/container-vulnerability-baseline.json index ff9ce0b..334b443 100644 --- a/.github/security/container-vulnerability-baseline.json +++ b/.github/security/container-vulnerability-baseline.json @@ -1,8 +1,8 @@ { "schema_version": 2, - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", - "base_image": "python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "base_image": "python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170", "images": { "synthetic": "python-3.14-slim", "getcomics": "python-3.14-slim", @@ -24,8 +24,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2025-69720", "rationale": "Requires the infocmp command processing crafted terminal data. Provider entrypoints use Python, with no infocmp subprocess or user-supplied terminal database. No supported Debian fix; retain private/nonroot/no-new-privileges deployment." }, @@ -42,8 +42,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2025-69720", "rationale": "Requires the infocmp command processing crafted terminal data. Provider entrypoints use Python, with no infocmp subprocess or user-supplied terminal database. No supported Debian fix; retain private/nonroot/no-new-privileges deployment." }, @@ -60,8 +60,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2025-69720", "rationale": "Requires the infocmp command processing crafted terminal data. Provider entrypoints use Python, with no infocmp subprocess or user-supplied terminal database. No supported Debian fix; retain private/nonroot/no-new-privileges deployment." }, @@ -78,8 +78,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2025-69720", "rationale": "Requires the infocmp command processing crafted terminal data. Provider entrypoints use Python, with no infocmp subprocess or user-supplied terminal database. No supported Debian fix; retain private/nonroot/no-new-privileges deployment." }, @@ -96,8 +96,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-19499", "rationale": "Requires strfmon/strfmon_l with susceptible monetary formatting and output-buffer sizing. Providers do not implement monetary formatting or native FFI calls. Residual native-dependency risk accepted temporarily; no supported Debian fix." }, @@ -114,8 +114,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-19499", "rationale": "Requires strfmon/strfmon_l with susceptible monetary formatting and output-buffer sizing. Providers do not implement monetary formatting or native FFI calls. Residual native-dependency risk accepted temporarily; no supported Debian fix." }, @@ -132,8 +132,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-5435", "rationale": "Requires deprecated glibc DNS record-printing APIs ns_printrrf/ns_printrr/fp_nquery handling TSIG. Provider code uses HTTPX and does not call these APIs. Presence of libc is not proof of reachability; residual risk accepted temporarily pending Debian fix." }, @@ -150,8 +150,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-5435", "rationale": "Requires deprecated glibc DNS record-printing APIs ns_printrrf/ns_printrr/fp_nquery handling TSIG. Provider code uses HTTPX and does not call these APIs. Presence of libc is not proof of reachability; residual risk accepted temporarily pending Debian fix." }, @@ -168,8 +168,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "rationale": "Requires a privileged pathname-based libacl caller over attacker-writable paths. Providers do not manage filesystem ACLs or mount user libraries; they run nonroot with dropped capabilities/no-new-privileges. Residual inherited-package risk; no supported Debian fix." }, @@ -186,8 +186,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-54370", "rationale": "Requires privileged getfacl/setfacl/chacl operations over attacker-controlled paths. Provider runtime does not execute ACL tools or mount user libraries. Retain nonroot/capability/no-new-privileges constraints; residual risk accepted pending Debian fix." }, @@ -204,8 +204,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -222,8 +222,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -240,8 +240,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -258,8 +258,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -276,8 +276,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -294,8 +294,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -312,8 +312,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -330,8 +330,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -348,8 +348,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-76642", "rationale": "Requires privileged mount helpers and X-mount post-mount hooks. Supported providers have no mount subprocess/fstab configuration, run nonroot, drop capabilities, and require no-new-privileges. Residual package risk, not a general false-positive dismissal; no supported Debian fix." }, @@ -366,8 +366,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -384,8 +384,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -402,8 +402,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -420,8 +420,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -438,8 +438,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -456,8 +456,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -474,8 +474,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -492,8 +492,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -510,8 +510,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78408", "rationale": "Requires a privileged nsenter --join-cgroup invocation into an attacker-controlled target. Provider entrypoints do not run nsenter and supported deployments prohibit privileged mode/added capabilities. Host administration tools are outside this image exception; no supported Debian fix." }, @@ -528,8 +528,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -546,8 +546,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -564,8 +564,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -582,8 +582,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -600,8 +600,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -618,8 +618,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -636,8 +636,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -654,8 +654,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -672,8 +672,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78409", "rationale": "Requires Linux 6.15+ with fstab-authorized X-mount.subdir and local symlink control. Providers configure no fstab mounts and require nonroot, dropped capabilities and no-new-privileges. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -690,8 +690,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -708,8 +708,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -726,8 +726,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -744,8 +744,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -762,8 +762,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -780,8 +780,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -798,8 +798,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -816,8 +816,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -834,8 +834,8 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-78410", "rationale": "Requires a privileged fstab bind mount over attacker-writable source ancestry. Providers perform no mount operations and supported deployments prohibit library mounts and privileged/added-capability execution. Residual package risk accepted temporarily; no supported Debian fix." }, @@ -850,10 +850,10 @@ "linux/amd64", "linux/arm64" ], - "fix_state": "not-fixed", + "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-82560", "rationale": "Requires Perl Pod::Text formatting attacker-supplied POD. Providers run Python metadata services and do not execute Perl or accept POD documents. Residual inherited-package risk accepted only for isolated, nonroot discovery containers; no supported Debian fix." }, @@ -870,8 +870,8 @@ ], "fix_state": "not-fixed", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "rationale": "Requires formatted nonblocking gzwrite/gzprintf activity after a write stall, not HTTP decompression. Providers do not write gzip files or call those APIs. Residual inherited-library risk accepted temporarily; no supported Debian fix." }, @@ -888,10 +888,118 @@ ], "fix_state": "wont-fix", "owner": "pullboxapp", - "reviewed_on": "2026-09-27", - "expires_on": "2026-10-11", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-9538", "rationale": "Requires Perl Archive::Tar reading an attacker-controlled archive. Providers return discovery metadata; archive downloading/extraction belongs to Pullbox and no runtime Perl subprocess exists. Residual inherited-package risk; no supported Debian fix." + }, + { + "id": "CVE-2026-102010", + "package": "gcc-14-base", + "severity": "High", + "version": "14.2.0-19", + "type": "deb", + "namespace": "debian:distro:debian:13", + "platforms": [ + "linux/amd64", + "linux/arm64" + ], + "fix_state": "wont-fix", + "owner": "pullboxapp", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-102010", + "rationale": "Affects the C++ binary-heap priority queue erase_if implementation. Provider code uses Python and does not directly call this API through native FFI or subprocesses. Transitive native dependency reachability is not fully proven. No supported Debian stable fix; residual risk is accepted temporarily for private-network, nonroot, no-new-privileges deployment." + }, + { + "id": "CVE-2026-102010", + "package": "libgcc-s1", + "severity": "High", + "version": "14.2.0-19", + "type": "deb", + "namespace": "debian:distro:debian:13", + "platforms": [ + "linux/amd64", + "linux/arm64" + ], + "fix_state": "wont-fix", + "owner": "pullboxapp", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-102010", + "rationale": "Affects the C++ binary-heap priority queue erase_if implementation. Provider code uses Python and does not directly call this API through native FFI or subprocesses. Transitive native dependency reachability is not fully proven. No supported Debian stable fix; residual risk is accepted temporarily for private-network, nonroot, no-new-privileges deployment." + }, + { + "id": "CVE-2026-102010", + "package": "libstdc++6", + "severity": "High", + "version": "14.2.0-19", + "type": "deb", + "namespace": "debian:distro:debian:13", + "platforms": [ + "linux/amd64", + "linux/arm64" + ], + "fix_state": "wont-fix", + "owner": "pullboxapp", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-102010", + "rationale": "Affects the C++ binary-heap priority queue erase_if implementation. Provider code uses Python and does not directly call this API through native FFI or subprocesses. Transitive native dependency reachability is not fully proven. No supported Debian stable fix; residual risk is accepted temporarily for private-network, nonroot, no-new-privileges deployment." + }, + { + "id": "CVE-2026-95619", + "package": "gcc-14-base", + "severity": "High", + "version": "14.2.0-19", + "type": "deb", + "namespace": "debian:distro:debian:13", + "platforms": [ + "linux/amd64", + "linux/arm64" + ], + "fix_state": "wont-fix", + "owner": "pullboxapp", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-95619", + "rationale": "Affects C++ aligned operator new with oversized allocation inputs. Provider code has no explicit native allocation or FFI calls, but native dependency reachability is not fully disproven. No supported Debian stable fix; residual risk is accepted temporarily for private-network, nonroot, no-new-privileges deployment." + }, + { + "id": "CVE-2026-95619", + "package": "libgcc-s1", + "severity": "High", + "version": "14.2.0-19", + "type": "deb", + "namespace": "debian:distro:debian:13", + "platforms": [ + "linux/amd64", + "linux/arm64" + ], + "fix_state": "wont-fix", + "owner": "pullboxapp", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-95619", + "rationale": "Affects C++ aligned operator new with oversized allocation inputs. Provider code has no explicit native allocation or FFI calls, but native dependency reachability is not fully disproven. No supported Debian stable fix; residual risk is accepted temporarily for private-network, nonroot, no-new-privileges deployment." + }, + { + "id": "CVE-2026-95619", + "package": "libstdc++6", + "severity": "High", + "version": "14.2.0-19", + "type": "deb", + "namespace": "debian:distro:debian:13", + "platforms": [ + "linux/amd64", + "linux/arm64" + ], + "fix_state": "wont-fix", + "owner": "pullboxapp", + "reviewed_on": "2026-10-17", + "expires_on": "2026-10-31", + "evidence": "https://security-tracker.debian.org/tracker/CVE-2026-95619", + "rationale": "Affects C++ aligned operator new with oversized allocation inputs. Provider code has no explicit native allocation or FFI calls, but native dependency reachability is not fully disproven. No supported Debian stable fix; residual risk is accepted temporarily for private-network, nonroot, no-new-privileges deployment." } ] } diff --git a/README.md b/README.md index c92bf84..e09b5b9 100644 --- a/README.md +++ b/README.md @@ -254,7 +254,7 @@ either registry; both names resolve to the same signed digest. | Provider | GHCR | Docker Hub | | --- | --- | --- | -| GetComics | `ghcr.io/pullboxapp/pullbox-provider-getcomics:1.0.3` | `docker.io/pullbox/pullbox-provider-getcomics:1.0.3` | +| GetComics | `ghcr.io/pullboxapp/pullbox-provider-getcomics:1.0.4` | `docker.io/pullbox/pullbox-provider-getcomics:1.0.4` | | Anna's Archive | `ghcr.io/pullboxapp/pullbox-provider-annas-archive:1.0.4` | `docker.io/pullbox/pullbox-provider-annas-archive:1.0.4` | | LibGen | `ghcr.io/pullboxapp/pullbox-provider-libgen:1.0.2` | `docker.io/pullbox/pullbox-provider-libgen:1.0.2` | diff --git a/docker/Dockerfile.annas-archive b/docker/Dockerfile.annas-archive index 22826e8..9d64347 100644 --- a/docker/Dockerfile.annas-archive +++ b/docker/Dockerfile.annas-archive @@ -1,12 +1,13 @@ -ARG PYTHON_BASE=python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d +ARG PYTHON_BASE=python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 FROM ${PYTHON_BASE} AS security-patched RUN apt-get update && \ apt-get install --yes --no-install-recommends \ - libssl3t64=3.5.7-1~deb13u2 \ - openssl=3.5.7-1~deb13u2 \ - openssl-provider-legacy=3.5.7-1~deb13u2 && \ + libssl3t64=3.5.7-1~deb13u3 \ + openssl=3.5.7-1~deb13u3 \ + openssl-provider-legacy=3.5.7-1~deb13u3 \ + libpcre2-8-0=10.46-1~deb13u3 && \ rm -rf /var/lib/apt/lists/* FROM security-patched AS build diff --git a/docker/Dockerfile.getcomics b/docker/Dockerfile.getcomics index aa8b338..737a90f 100644 --- a/docker/Dockerfile.getcomics +++ b/docker/Dockerfile.getcomics @@ -1,12 +1,13 @@ -ARG PYTHON_BASE=python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d +ARG PYTHON_BASE=python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 FROM ${PYTHON_BASE} AS security-patched RUN apt-get update && \ apt-get install --yes --no-install-recommends \ - libssl3t64=3.5.7-1~deb13u2 \ - openssl=3.5.7-1~deb13u2 \ - openssl-provider-legacy=3.5.7-1~deb13u2 && \ + libssl3t64=3.5.7-1~deb13u3 \ + openssl=3.5.7-1~deb13u3 \ + openssl-provider-legacy=3.5.7-1~deb13u3 \ + libpcre2-8-0=10.46-1~deb13u3 && \ rm -rf /var/lib/apt/lists/* FROM security-patched AS build diff --git a/docker/Dockerfile.libgen b/docker/Dockerfile.libgen index cd6edf8..051afac 100644 --- a/docker/Dockerfile.libgen +++ b/docker/Dockerfile.libgen @@ -1,12 +1,13 @@ -ARG PYTHON_BASE=python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d +ARG PYTHON_BASE=python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 FROM ${PYTHON_BASE} AS security-patched RUN apt-get update && \ apt-get install --yes --no-install-recommends \ - libssl3t64=3.5.7-1~deb13u2 \ - openssl=3.5.7-1~deb13u2 \ - openssl-provider-legacy=3.5.7-1~deb13u2 && \ + libssl3t64=3.5.7-1~deb13u3 \ + openssl=3.5.7-1~deb13u3 \ + openssl-provider-legacy=3.5.7-1~deb13u3 \ + libpcre2-8-0=10.46-1~deb13u3 && \ rm -rf /var/lib/apt/lists/* FROM security-patched AS build diff --git a/docker/Dockerfile.provider-smoke b/docker/Dockerfile.provider-smoke index 62e6ed3..7dfed38 100644 --- a/docker/Dockerfile.provider-smoke +++ b/docker/Dockerfile.provider-smoke @@ -1,11 +1,12 @@ -ARG PYTHON_BASE=python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d +ARG PYTHON_BASE=python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 FROM ${PYTHON_BASE} AS runtime RUN apt-get update && \ apt-get install --yes --no-install-recommends \ - libssl3t64=3.5.7-1~deb13u2 \ - openssl=3.5.7-1~deb13u2 \ - openssl-provider-legacy=3.5.7-1~deb13u2 && \ + libssl3t64=3.5.7-1~deb13u3 \ + openssl=3.5.7-1~deb13u3 \ + openssl-provider-legacy=3.5.7-1~deb13u3 \ + libpcre2-8-0=10.46-1~deb13u3 && \ rm -rf /var/lib/apt/lists/* ENV PYTHONDONTWRITEBYTECODE=1 \ diff --git a/docker/Dockerfile.synthetic b/docker/Dockerfile.synthetic index 265f49a..c8185a4 100644 --- a/docker/Dockerfile.synthetic +++ b/docker/Dockerfile.synthetic @@ -1,12 +1,13 @@ -ARG PYTHON_BASE=python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d +ARG PYTHON_BASE=python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 FROM ${PYTHON_BASE} AS security-patched RUN apt-get update && \ apt-get install --yes --no-install-recommends \ - libssl3t64=3.5.7-1~deb13u2 \ - openssl=3.5.7-1~deb13u2 \ - openssl-provider-legacy=3.5.7-1~deb13u2 && \ + libssl3t64=3.5.7-1~deb13u3 \ + openssl=3.5.7-1~deb13u3 \ + openssl-provider-legacy=3.5.7-1~deb13u3 \ + libpcre2-8-0=10.46-1~deb13u3 && \ rm -rf /var/lib/apt/lists/* FROM security-patched AS build diff --git a/docker/compose.providers-test.yml b/docker/compose.providers-test.yml index 07058f7..4594f47 100644 --- a/docker/compose.providers-test.yml +++ b/docker/compose.providers-test.yml @@ -4,7 +4,7 @@ services: context: .. dockerfile: docker/Dockerfile.getcomics args: - PYTHON_BASE: public.ecr.aws/docker/library/python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d + PYTHON_BASE: public.ecr.aws/docker/library/python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 environment: PULLBOX_PROVIDER_TOKEN: ${PULLBOX_PROVIDER_TOKEN:-test-provider-token-with-sufficient-entropy} read_only: true @@ -23,7 +23,7 @@ services: context: .. dockerfile: docker/Dockerfile.annas-archive args: - PYTHON_BASE: public.ecr.aws/docker/library/python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d + PYTHON_BASE: public.ecr.aws/docker/library/python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 environment: PULLBOX_PROVIDER_TOKEN: ${PULLBOX_PROVIDER_TOKEN:-test-provider-token-with-sufficient-entropy} read_only: true @@ -42,7 +42,7 @@ services: context: .. dockerfile: docker/Dockerfile.libgen args: - PYTHON_BASE: public.ecr.aws/docker/library/python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d + PYTHON_BASE: public.ecr.aws/docker/library/python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 environment: PULLBOX_PROVIDER_TOKEN: ${PULLBOX_PROVIDER_TOKEN:-test-provider-token-with-sufficient-entropy} read_only: true @@ -61,7 +61,7 @@ services: context: .. dockerfile: docker/Dockerfile.provider-smoke args: - PYTHON_BASE: public.ecr.aws/docker/library/python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d + PYTHON_BASE: public.ecr.aws/docker/library/python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 depends_on: getcomics: condition: service_healthy diff --git a/docker/compose.synthetic-test.yml b/docker/compose.synthetic-test.yml index abdc1d9..1c18a91 100644 --- a/docker/compose.synthetic-test.yml +++ b/docker/compose.synthetic-test.yml @@ -5,7 +5,7 @@ services: dockerfile: docker/Dockerfile.synthetic target: runtime args: - PYTHON_BASE: ${PYTHON_BASE:-mirror.gcr.io/library/python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d} + PYTHON_BASE: ${PYTHON_BASE:-mirror.gcr.io/library/python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170} image: pullbox-provider-synthetic:dd0-test environment: PULLBOX_PROVIDER_TOKEN: ${PULLBOX_PROVIDER_TOKEN:-synthetic-conformance-token-00000000} @@ -26,7 +26,7 @@ services: dockerfile: docker/Dockerfile.synthetic target: conformance args: - PYTHON_BASE: ${PYTHON_BASE:-mirror.gcr.io/library/python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d} + PYTHON_BASE: ${PYTHON_BASE:-mirror.gcr.io/library/python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170} environment: PULLBOX_PROVIDER_BASE_URL: http://synthetic:8780 PULLBOX_PROVIDER_TOKEN: ${PULLBOX_PROVIDER_TOKEN:-synthetic-conformance-token-00000000} diff --git a/providers/getcomics/pyproject.toml b/providers/getcomics/pyproject.toml index 592cc0d..2185f49 100644 --- a/providers/getcomics/pyproject.toml +++ b/providers/getcomics/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "pullbox-provider-getcomics" -version = "1.0.3" +version = "1.0.4" description = "Optional GetComics discovery provider for Pullbox" requires-python = ">=3.12" license = "GPL-3.0-or-later" diff --git a/tests/unit/test_container_contract.py b/tests/unit/test_container_contract.py index 7d1ad4e..acc11ae 100644 --- a/tests/unit/test_container_contract.py +++ b/tests/unit/test_container_contract.py @@ -40,7 +40,7 @@ def test_runtime_uses_pinned_python_314_and_non_root_identity() -> None: dockerfile = DOCKERFILE.read_text(encoding="utf-8") assert ( - "python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d" + "python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170" in dockerfile ) assert "AS build" in dockerfile @@ -79,8 +79,8 @@ def test_source_provider_images_are_self_contained_hardened_python_314_services( dockerfile = path.read_text(encoding="utf-8") assert ( - "python:3.14-slim-trixie@sha256:" - "51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d" in dockerfile + "python:3.14.8-slim-trixie@sha256:" + "a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170" in dockerfile ) assert "USER 65532:65532" in dockerfile assert "EXPOSE 8780" in dockerfile @@ -95,13 +95,14 @@ def test_source_provider_images_are_self_contained_hardened_python_314_services( assert all(source not in dockerfile for source in other_source_paths) -def test_runtime_images_install_pinned_openssl_security_update() -> None: +def test_runtime_images_install_pinned_openssl_and_pcre_security_updates() -> None: for path in ALL_RUNTIME_DOCKERFILES: dockerfile = path.read_text(encoding="utf-8") - assert "libssl3t64=3.5.7-1~deb13u2" in dockerfile - assert "openssl=3.5.7-1~deb13u2" in dockerfile - assert "openssl-provider-legacy=3.5.7-1~deb13u2" in dockerfile + assert "libssl3t64=3.5.7-1~deb13u3" in dockerfile + assert "openssl=3.5.7-1~deb13u3" in dockerfile + assert "openssl-provider-legacy=3.5.7-1~deb13u3" in dockerfile + assert "libpcre2-8-0=10.46-1~deb13u3" in dockerfile assert "rm -rf /var/lib/apt/lists/*" in dockerfile diff --git a/tests/unit/test_provider_release_metadata.py b/tests/unit/test_provider_release_metadata.py index 33aa798..b90d850 100644 --- a/tests/unit/test_provider_release_metadata.py +++ b/tests/unit/test_provider_release_metadata.py @@ -16,7 +16,7 @@ def test_security_release_versions_and_bundled_libgen_dependency_agree() -> None name: tomllib.loads((ROOT / "providers" / name / "pyproject.toml").read_text())["project"] for name in ("getcomics", "annas_archive", "libgen") } - assert projects["getcomics"]["version"] == "1.0.3" + assert projects["getcomics"]["version"] == "1.0.4" assert projects["annas_archive"]["version"] == "1.0.4" assert projects["libgen"]["version"] == "1.0.2" assert "pullbox-provider-libgen==1.0.2" in projects["annas_archive"]["dependencies"] @@ -43,12 +43,12 @@ def _load_latest_module(): def test_tag_release_maps_getcomics_to_both_registry_names() -> None: release = _load_module().resolve_release( repository_owner="pullboxapp", - tag="getcomics-v1.0.3", + tag="getcomics-v1.0.4", ) assert release.provider == "getcomics" - assert release.version == "1.0.3" - assert release.release_tag == "getcomics-v1.0.3" + assert release.version == "1.0.4" + assert release.release_tag == "getcomics-v1.0.4" assert release.is_release is True assert release.is_prerelease is False assert release.dockerfile == "docker/Dockerfile.getcomics" diff --git a/tests/unit/test_vulnerability_baseline.py b/tests/unit/test_vulnerability_baseline.py index 3703d68..b6deb86 100644 --- a/tests/unit/test_vulnerability_baseline.py +++ b/tests/unit/test_vulnerability_baseline.py @@ -377,9 +377,10 @@ def test_repository_baseline_is_current_and_documents_every_exception() -> None: baseline = json.loads(REPOSITORY_BASELINE.read_text(encoding="utf-8")) assert baseline["schema_version"] == 2 - assert baseline["reviewed_on"] == "2026-09-27" + assert baseline["reviewed_on"] == "2026-10-17" + assert baseline["expires_on"] == "2026-10-31" assert baseline["base_image"] == ( - "python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d" + "python:3.14.8-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170" ) assert date.fromisoformat(baseline["expires_on"]) >= date.today() assert set(baseline["images"]) == { @@ -395,6 +396,32 @@ def test_repository_baseline_is_current_and_documents_every_exception() -> None: assert all(finding["severity"] in {"High", "Critical"} for finding in findings) +def test_repository_baseline_limits_october_approval_to_exact_gcc_versions() -> None: + baseline = json.loads(REPOSITORY_BASELINE.read_text(encoding="utf-8")) + findings = baseline["profiles"]["python-3.14-slim"] + + assert len(findings) == 55 + assert all(finding["reviewed_on"] == "2026-10-17" for finding in findings) + assert all(finding["expires_on"] == "2026-10-31" for finding in findings) + gcc_findings = [ + finding for finding in findings if finding["id"] in {"CVE-2026-102010", "CVE-2026-95619"} + ] + assert { + (finding["id"], finding["package"], finding["version"]) for finding in gcc_findings + } == { + (cve, package, "14.2.0-19") + for cve in ("CVE-2026-102010", "CVE-2026-95619") + for package in ("gcc-14-base", "libgcc-s1", "libstdc++6") + } + assert len(gcc_findings) == 6 + for finding in gcc_findings: + assert finding["severity"] == "High" + assert finding["type"] == "deb" + assert finding["namespace"] == "debian:distro:debian:13" + assert finding["platforms"] == ["linux/amd64", "linux/arm64"] + assert finding["fix_state"] == "wont-fix" + + def test_repository_baseline_does_not_retain_fixed_python_or_openssl_findings() -> None: baseline = json.loads(REPOSITORY_BASELINE.read_text(encoding="utf-8")) findings = {