Request for digest-bound OpenSSL provenance and backport evidence

Aperta
  • Qualcosa non va?
#2,585 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker
Ambito
devops, security

Direzione di ricerca

Start with the specified linux/arm64 image digest and establish its source/build revision and provenance. Then inspect the evaluated Nix derivations, lock inputs, overrides, source hashes, patches, and output identities for each OpenSSL copy, and compare them with the three named advisories. Done means an advisory-by-advisory account of verified fixes, non-applicability, unresolved items, and any replacement digest with provenance.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

documentation

Hello Supabase PostgreSQL maintainers,

Please help establish the OpenSSL patch status of this official linux/arm64 image:

docker.io/supabase/postgres@sha256:2638e94e8e712b2926a2763c37ecfaee4b7abde2cd804a01ac55bba031e52a00

Static inspection identified OpenSSL version-labelled copies:

  • 3.6.0, referenced by PostgreSQL and libpq.
  • 3.0.13, referenced through the legacy pg_net/curl dependency.
  • 3.6.1, referenced by a separate Nix/client dependency closure.

We have not authenticated the applied patches for these exact outputs. Version labels and dependency references alone do not establish vulnerability or exploitability.

Could you provide:

  1. The exact source/build revision bound to this image digest, preferably through verifiable build provenance.
  2. The evaluated Nix derivations, resolved lock inputs, overrides, source hashes and complete applied-patch lists for all three OpenSSL copies.
  3. Trusted output identities—such as signed NAR metadata or equivalent provenance—connecting those derivations to the library outputs included in this image.
  4. The disposition of these independently verified upstream advisories:
    • CVE-2025-15467: CMS AEAD parsing; relevant version ranges include 3.0.13 and 3.6.0.
    • CVE-2026-35189: relative-CRLDP memory allocation; relevant ranges include all three labels.
    • CVE-2026-54875: ARM64/RISC-V SM2 timing/cache leakage; relevant ranges include 3.6.0 and 3.6.1, while 3.0 is explicitly unaffected.
  5. Whether an officially maintained linux/arm64 replacement digest resolves these findings, with corresponding build, dependency and patch provenance.

An advisory-by-advisory response distinguishing applied fixes, documented non-applicability and unresolved items would be helpful.

Thank you.

Lingua principale
Nix
Stelle
1.8k
Fork
272
Merge medio
4g 4h
PR unite (30g)
62

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di supabase/postgres

Tutte le issue di supabase/postgres

Issue simili

Altre issue su DevOps

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.