fix(triage): correct the four verification leftovers in the corrected report #24

Merged

Philipp Baumann merged 1 commit from fm/dse-security-reports-verification-refinements into main

2026-10-28 11:30:12 +00:00

Philipp Baumann commented

2026-10-28 11:28:03 +00:00

Owner

Summary

The independent verification of the corrected triage report (dse-security-reports-verify-2026-10-28) confirmed all four corrections and found four smaller errors, three of them inside the correction's own new text.
This change fixes those four leftovers, each traceable to its source, with no derivation-lane change at all (just py-crosscheck green on an untouched derive).

The four items

Stale figure (Grundlagen) — the Trivy bullet typed "defender-only (17 Zeilen)", missing the correction's own reclassification (16 defender-only + 1 trivy-silent for the QMS pyjwt store finding).
The figures now render from the derivation (scanClasses over both exports): trivy-confirms (24 eindeutige Fundstellen, 40 Zeilen), defender-only (12 eindeutige Fundstellen, 16 Zeilen), trivy-silent (1 Zeile — the QMS-pyjwt-Store-Fundstelle), so no typed number can drift against the payload again.
Overstatement (pyjwt bullet) — "jeder live geprobte Content des Stores trägt pyjwt" overstated the sweep.
Scoped to the truth, first-hand: a read-only store census on 2026-10-28 (same roots and bounds as the collector's probe) shows three of the five QMS contents carry pyjwt (Test-Content, QMS Dashboard, QMS Dashboard - Staging), the other two — including "Quality Monitoring" — do not; the census is recorded in the backfill bridge so the figures stay traceable to committed data.
Stale one-day dates — nine prose dates corrected from the evidence caches, not by hand: SSH evidence 26.10. -> 27.10. (Grundlagen, P4, P6, P10, Reproduzierbarkeit), dnf ranges 24.-26.10. -> 25.–27.10. (all eight), 25./26.10. -> 27.10. (three el9 workbenches — the cache shows all three at 27.10., which the verification report's "25./27.10" got wrong), 25.10. -> 25./27.10. (four Azure VMs, MYRIDE at 27.10.), 26.10. -> 27.10. (PROD-WB).
WireGuard security-check reason — fixed by capturing the per-unit reason, not by softening.
The 2026-10-27 caches predate the per-unit reason capture, so a read-only live probe (the collector's own invocation, batch SSH, stdin /dev/null) captured each unit's verbatim abort message on 2026-10-28: WIREGUARD fails with "repomd.xml GPG signature verification error: Bad GPG signature", the other four error units with "Signing key not found" on the same repo and mechanism.
Each string is recorded through the same labelled bridge discipline as before (verbatim, attributed, dated) in scripts/backfill_verified_evidence.py, the section prose names the per-unit split, and the table renders each unit's own reason.
The collector's reason extraction was also fixed: it previously would have recorded the interactive "Importing GPG key 0x…" banner line as the reason in future rounds; it now strips the prompt and keeps the aborting error line (validated against all five captured live outputs, byte-identical to the bridge strings).

What changed

reports/defender-triage.typ — derived scanner-agreement figures in the Grundlagen Trivy bullet (new scanClasses/scanRowsOf/scanUniqOf/countWord helpers); pyjwt bullet scoped to the five-content census; nine stale evidence/dnf dates corrected from the caches; the security-check section prose states the per-unit abort texts instead of one generalized string.
scripts/backfill_verified_evidence.py — SEC_CHECK_FAILURE becomes per-unit verbatim reasons (live probe 2026-10-28, prompt prefix stripped exactly as the collector does); the QMS live-store content map becomes the full five-content census (the backup store keeps its own three-name map, no census claim); the docstring now labels each block's provenance instead of claiming everything came verbatim from the archived verification report.
scripts/ssh_evidence.sh — the security-check reason extraction keeps the aborting error line per unit instead of the first line matching "GPG" (the key-import banner).
Justfile — the backfill-verified comment names the per-unit reasons and the content census.
AGENTS.md — the restore recipe gains the round's cve-cache-*/nginx-cache-* dirs and the sidecar ordering trap (fixture lanes overwrite triage.csv; just ingest does not restore it).

Behaviour change

The triage PDF's Grundlagen bullet, pyjwt bullet, security-check section and nine prose dates now match the evidence caches and the live estate; WIREGUARD's security-check reason cell prints its own "Bad GPG signature" abort instead of the el10 string.
The findings PDF is byte-identical to the published one (it does not render the reason strings).
Future evidence rounds record each unit's own abort text natively.

Validation

just all, just repro (byte-identical PDFs), just test (39 passed), just lint, just py-crosscheck (stdlib == polars, no derive change) — all green on the fixture lane, which stays offline.
Real round re-rendered from the published caches: the findings PDF reproduces byte-identically, the corrected triage PDF republished to the artifacts dir with the previous one moved to superseded/.

Observed but deliberately not touched: the CVE-Link-Cache prose dates (Grundlagen "vom 26.10.2026" and Reproduzierbarkeit "CVE-Link-Cache 26.10.2026") — the cache snapshot in use is 2026-10-27 (fetched-on.txt, derived cveLinksSnapshot), but the claim was not among the verification's four items and is authored wording; flagged for the captain.
The P15/P4 kernel prose is untouched except for the two dnf dates the spec explicitly listed (lines 1594/1607); every kernel claim is verbatim unchanged.

Instructions-PR: none

## Summary The independent verification of the corrected triage report (`dse-security-reports-verify-2026-10-28`) confirmed all four corrections and found four smaller errors, three of them inside the correction's own new text. This change fixes those four leftovers, each traceable to its source, with no derivation-lane change at all (`just py-crosscheck` green on an untouched derive). ## The four items 1. **Stale figure (Grundlagen)** — the Trivy bullet typed "defender-only (17 Zeilen)", missing the correction's own reclassification (16 defender-only + 1 trivy-silent for the QMS pyjwt store finding). The figures now render from the derivation (`scanClasses` over both exports): trivy-confirms (24 eindeutige Fundstellen, 40 Zeilen), defender-only (12 eindeutige Fundstellen, 16 Zeilen), trivy-silent (1 Zeile — the QMS-pyjwt-Store-Fundstelle), so no typed number can drift against the payload again. 2. **Overstatement (pyjwt bullet)** — "jeder live geprobte Content des Stores trägt pyjwt" overstated the sweep. Scoped to the truth, first-hand: a read-only store census on 2026-10-28 (same roots and bounds as the collector's probe) shows three of the five QMS contents carry pyjwt (Test-Content, QMS Dashboard, QMS Dashboard - Staging), the other two — including "Quality Monitoring" — do not; the census is recorded in the backfill bridge so the figures stay traceable to committed data. 3. **Stale one-day dates** — nine prose dates corrected from the evidence caches, not by hand: SSH evidence 26.10. -> 27.10. (Grundlagen, P4, P6, P10, Reproduzierbarkeit), dnf ranges 24.-26.10. -> 25.–27.10. (all eight), 25./26.10. -> 27.10. (three el9 workbenches — the cache shows all three at 27.10., which the verification report's "25./27.10" got wrong), 25.10. -> 25./27.10. (four Azure VMs, MYRIDE at 27.10.), 26.10. -> 27.10. (PROD-WB). 4. **WireGuard security-check reason** — fixed by **capturing the per-unit reason**, not by softening. The 2026-10-27 caches predate the per-unit reason capture, so a read-only live probe (the collector's own invocation, batch SSH, stdin /dev/null) captured each unit's verbatim abort message on 2026-10-28: WIREGUARD fails with "repomd.xml GPG signature verification error: **Bad GPG signature**", the other four error units with "**Signing key not found**" on the same repo and mechanism. Each string is recorded through the same labelled bridge discipline as before (verbatim, attributed, dated) in `scripts/backfill_verified_evidence.py`, the section prose names the per-unit split, and the table renders each unit's own reason. The collector's reason extraction was also fixed: it previously would have recorded the interactive "Importing GPG key 0x…" banner line as the reason in future rounds; it now strips the prompt and keeps the aborting error line (validated against all five captured live outputs, byte-identical to the bridge strings). ## What changed - `reports/defender-triage.typ` — derived scanner-agreement figures in the Grundlagen Trivy bullet (new `scanClasses`/`scanRowsOf`/`scanUniqOf`/`countWord` helpers); pyjwt bullet scoped to the five-content census; nine stale evidence/dnf dates corrected from the caches; the security-check section prose states the per-unit abort texts instead of one generalized string. - `scripts/backfill_verified_evidence.py` — `SEC_CHECK_FAILURE` becomes per-unit verbatim reasons (live probe 2026-10-28, prompt prefix stripped exactly as the collector does); the QMS live-store content map becomes the full five-content census (the backup store keeps its own three-name map, no census claim); the docstring now labels each block's provenance instead of claiming everything came verbatim from the archived verification report. - `scripts/ssh_evidence.sh` — the security-check reason extraction keeps the aborting error line per unit instead of the first line matching "GPG" (the key-import banner). - `Justfile` — the `backfill-verified` comment names the per-unit reasons and the content census. - `AGENTS.md` — the restore recipe gains the round's `cve-cache-*`/`nginx-cache-*` dirs and the sidecar ordering trap (fixture lanes overwrite `triage.csv`; `just ingest` does not restore it). ## Behaviour change The triage PDF's Grundlagen bullet, pyjwt bullet, security-check section and nine prose dates now match the evidence caches and the live estate; WIREGUARD's security-check reason cell prints its own "Bad GPG signature" abort instead of the el10 string. The findings PDF is byte-identical to the published one (it does not render the reason strings). Future evidence rounds record each unit's own abort text natively. ## Validation `just all`, `just repro` (byte-identical PDFs), `just test` (39 passed), `just lint`, `just py-crosscheck` (stdlib == polars, no derive change) — all green on the fixture lane, which stays offline. Real round re-rendered from the published caches: the findings PDF reproduces byte-identically, the corrected triage PDF republished to the artifacts dir with the previous one moved to `superseded/`. Observed but deliberately not touched: the CVE-Link-Cache prose dates (Grundlagen "vom 26.10.2026" and Reproduzierbarkeit "CVE-Link-Cache 26.10.2026") — the cache snapshot in use is 2026-10-27 (`fetched-on.txt`, derived `cveLinksSnapshot`), but the claim was not among the verification's four items and is authored wording; flagged for the captain. The P15/P4 kernel prose is untouched except for the two dnf dates the spec explicitly listed (lines 1594/1607); every kernel claim is verbatim unchanged. Instructions-PR: none

Philipp Baumann added 1 commit

2026-10-28 11:28:04 +00:00

fix(triage): correct the four verification leftovers in the corrected report 2a7d20d012

- derive the Grundlagen scanner-agreement figures (16 defender-only plus
  1 trivy-silent instead of the stale 17) from the payload, so the
  correction's own intro can no longer miss its own reclassification
- scope the pyjwt store claim to the truth: three of the five QMS
  contents carry pyjwt, the others (incl. Quality Monitoring) do not;
  record the five-content census in the backfill bridge so the figures
  stay traceable to committed data
- correct the stale one-day evidence and dnf dates in prose from the
  evidence caches (SSH evidence 27.10., dnf ranges 25.-27.10.) instead
  of typing them
- capture the dnf --security check-update abort reason per unit instead
  of one generalized el10 string: record each unit's own verbatim abort
  message (WIREGUARD fails with Bad GPG signature, the other four with
  Signing key not found on the same repo) from a read-only live probe
  on 2026-10-28 through the labelled backfill bridge, and make the
  collector's reason extraction keep the aborting error line instead of
  the interactive key-import banner so future rounds capture it natively

Philipp Baumann merged commit 9c81cd1300 into main

2026-10-28 11:30:12 +00:00

Philipp Baumann deleted branch fm/dse-security-reports-verification-refinements

2026-10-28 11:30:12 +00:00

Philipp Baumann referenced this pull request from a commit

2026-10-28 11:30:13 +00:00

fix(triage): correct the four verification leftovers in the corrected report (#24)