feat(triage): state the kernel posture explicitly in the CVE-ranking table #10

Merged

Philipp Baumann merged 1 commit from fm/dse-security-reports-kernel-note into main

2026-10-26 21:56:59 +00:00

Philipp Baumann commented

2026-10-26 21:55:29 +00:00

Owner

Summary

The captain asked for the CVE-ranking table to state explicitly that the latest installed kernel is not vulnerable. Both kernel-cluster ranking rows (the Alma 10 cluster on the four Azure VMs and the el9 workbench coverage gap) now carry a short, fully data-derived note under the problem title: the newest installed and running kernel is fixed, only a non-running retained kernel is vulnerable (dnf installonly_limit), and Defender's claimed version matches only that retained stock.

What changed

scripts/derive_findings.py: trivy kernel-package detections join onto the per-unit kernel posture (fixedVersions, vulnerableInstalled, runningFixed, runningVulnerable), and kernel-token findings gain a claim verdict (kernelClaimInstalled, kernelClaimRunning) that compares Defender's claimed version against the running and installed kernels with rpm ordering.
src/dse_security_reports/derive.py: same computation in the polars lane, so the cross-check stays byte-identical.
reports/defender-triage.typ: kernel-only ranking rows and the kernel-gap special row render the statement from those verdicts; negative findings and evidence gaps are stated instead of guessed, never hand-set text.
tests/test_derive.py: updated kernel-posture and record-shape assertions, plus unit tests for the claim verdict, the scan join, its gap cases and corrupt-input fail-fast.
AGENTS.md: records the new data-driven kernel statement in the triage-report bullet.

Behaviour change

The two kernel rows of the CVE-ranking table (rank 4 and rank 16) now state, derived from uname evidence, the kernel inventory and the trivy fixed versions, that the newest installed and running kernel is fixed and only the non-running retained kernels are vulnerable; all other rows and prose are unchanged.

Instructions-PR: none

## Summary The captain asked for the CVE-ranking table to state explicitly that the latest installed kernel is not vulnerable. Both kernel-cluster ranking rows (the Alma 10 cluster on the four Azure VMs and the el9 workbench coverage gap) now carry a short, fully data-derived note under the problem title: the newest installed and running kernel is fixed, only a non-running retained kernel is vulnerable (dnf installonly_limit), and Defender's claimed version matches only that retained stock. ## What changed - `scripts/derive_findings.py`: trivy kernel-package detections join onto the per-unit kernel posture (`fixedVersions`, `vulnerableInstalled`, `runningFixed`, `runningVulnerable`), and kernel-token findings gain a claim verdict (`kernelClaimInstalled`, `kernelClaimRunning`) that compares Defender's claimed version against the running and installed kernels with rpm ordering. - `src/dse_security_reports/derive.py`: same computation in the polars lane, so the cross-check stays byte-identical. - `reports/defender-triage.typ`: kernel-only ranking rows and the kernel-gap special row render the statement from those verdicts; negative findings and evidence gaps are stated instead of guessed, never hand-set text. - `tests/test_derive.py`: updated kernel-posture and record-shape assertions, plus unit tests for the claim verdict, the scan join, its gap cases and corrupt-input fail-fast. - `AGENTS.md`: records the new data-driven kernel statement in the triage-report bullet. ## Behaviour change The two kernel rows of the CVE-ranking table (rank 4 and rank 16) now state, derived from uname evidence, the kernel inventory and the trivy fixed versions, that the newest installed and running kernel is fixed and only the non-running retained kernels are vulnerable; all other rows and prose are unchanged. Instructions-PR: none

Philipp Baumann added 1 commit

2026-10-26 21:55:30 +00:00

feat(triage): state the kernel posture explicitly in the CVE-ranking table 53f4fc15e9

The kernel-cluster ranking rows (the Alma-10 cluster on the four Azure
VMs and the el9 workbench coverage gap) now carry an explicit,
data-derived statement that the newest installed and running kernel is
fixed and only a non-running retained kernel is vulnerable.

- Extend both derivation lanes with a trivy-joined kernel posture per
  evidence unit (fixedVersions, vulnerableInstalled, runningFixed,
  runningVulnerable), compared with rpm's version ordering.
- Add a per-finding claim verdict for kernel tokens
  (kernelClaimInstalled, kernelClaimRunning) so the ranking can state
  that Defender's claimed version matches only a retained kernel.
- Render the statement under the problem title of kernel-only ranking
  rows from those verdicts; state the negative findings and evidence
  gaps instead of guessing.
- Keep the polars lane byte-identical with the stdlib pipeline and
  cover the new verdicts with unit tests.

Philipp Baumann merged commit 04614edf6f into main

2026-10-26 21:56:59 +00:00

Philipp Baumann deleted branch fm/dse-security-reports-kernel-note

2026-10-26 21:56:59 +00:00

Philipp Baumann referenced this pull request from a commit

2026-10-26 21:57:01 +00:00

feat(triage): state the kernel posture explicitly in the CVE-ranking table (#10)