philipp.baumann/dse-security-reports
Watch
0
0
Fork
You've already forked dse-security-reports
 0
Code Issues 1 Pull requests Releases Activity

feat(triage): pipeline-generate the triage report tables #8

Merged
Philipp Baumann merged 1 commit from fm/dse-security-reports-triage-template into main 2026-10-26 21:21:20 +00:00
Conversation 0 Commits 1 Files changed 6 +918 -5
Philipp Baumann commented 2026-10-26 20:56:50 +00:00
Owner
Copy link

Summary

The captain asked for the triage report's table entries to be produced reproducibly by the pipeline instead of hand-copied into the scratch document. This ports the triage report into the repo as reports/defender-triage.typ in the merged cli-cloud-bi theme and generates all four tables from the derived JSONs with Typst code, while the authored analysis prose stays verbatim.

How the tables are generated

  • Systemlandkarte: both exports merged per machine (Zeilen = raw rows of both exports, CVEs/Exploit = distinct), domain-grouped (DSE / ASP-Windows), ordered by Zeilen descending.
  • CVE-Ranking: the 17 problems of the triage pass. The problem partition (selectors: CVE-IDs or software family with CVSS threshold) and problem names are the curated analysis and live in the template's problems layer; every cell value is computed from the data -- CVE count, CVSS range, Exploit, Trivy agreement, affected systems, and the new column Linux-Evidenz unzuverlässig is purely derived: Windows platform -> — (Windows), defender-only without rpm/pip counter-evidence -> ja (Index), rpm/pip/Trivy-backed -> nein (Evidenz).
  • FP-Kandidaten: rows are the problems whose findings carry a falsePositive annotation (triage.csv -> derive).
  • Evidenzabdeckung: per machine from the evidence aggregate plus findings, ordered like config/systems.csv.
  • New derive field upstreamPackages (RPM release tag .ngx, the upstream nginx repo) in both lanes (stdlib + polars, byte-identical, tests extended) so the nginx Upstream row renders from data.

Three hand values the generated table corrects

The scratch tables were hand-copied; three cells contradict the caches this render uses, and the pipeline now shows the derived value:

  1. Windows-OS-Cluster: 44 CVEs (scratch said 35). There are 44 CVEs at CVSS 9.8 against the windows_server_* tokens (41 on all three servers); P5's own prose cites 47 (cop01) / 43 (dor01, ent01) "insgesamt am OS-Cluster".
  2. Kernel-Cluster CVSS 9.1–9.8 (scratch said 9.8): the six kernel CVEs include CVE-2026-99999 (9.3) and CVE-2026-89631 (9.1). Same for pillow: 9.2–9.8, not 9.8. The Clusterbildung sentence in the prose still says "35 Stueck, alle 9.8" (kept verbatim per instructions) and may want a one-word touch-up by the captain.
  3. Coverage gap notes refreshed: the current evidence caches collect uname -r and config/systems.csv carries aliases/addresses for all 7 units, so those stale gap notes are gone; sec-check error now shows uniformly (it applies to all 7 units), and the VS ssh.cfg note is kept.

Validation

  • Real caches under .local/ (never committed): generated tables reproduce the scratch content row-for-row and value-for-value except the three corrections above; the derived Linux-Evidenz column matches the hand-set one on all 15 CVE rows.
  • just repro: both reports render byte-identical twice (defender-findings + new defender-triage).
  • just test (15 passed), just lint, just fmt, just py-crosscheck, just py-repro green; fixture lane renders the template with empty fallbacks and a synthetic-fixture warning box.
  • No raw CSVs, caches, or evidence/scan JSON are committed; template and prose only (counts, CVE ids, machine names are the captain's private-forge deliverable).
## Summary The captain asked for the triage report's table entries to be produced reproducibly by the pipeline instead of hand-copied into the scratch document. This ports the triage report into the repo as `reports/defender-triage.typ` in the merged cli-cloud-bi theme and generates all four tables from the derived JSONs with Typst code, while the authored analysis prose stays verbatim. ## How the tables are generated - **Systemlandkarte**: both exports merged per machine (Zeilen = raw rows of both exports, CVEs/Exploit = distinct), domain-grouped (DSE / ASP-Windows), ordered by Zeilen descending. - **CVE-Ranking**: the 17 problems of the triage pass. The problem partition (selectors: CVE-IDs or software family with CVSS threshold) and problem names are the curated analysis and live in the template's `problems` layer; every cell value is computed from the data -- CVE count, CVSS range, Exploit, Trivy agreement, affected systems, and the new column **Linux-Evidenz unzuverlässig** is purely derived: Windows platform -> `— (Windows)`, defender-only without rpm/pip counter-evidence -> `ja (Index)`, rpm/pip/Trivy-backed -> `nein (Evidenz)`. - **FP-Kandidaten**: rows are the problems whose findings carry a falsePositive annotation (triage.csv -> derive). - **Evidenzabdeckung**: per machine from the evidence aggregate plus findings, ordered like `config/systems.csv`. - New derive field `upstreamPackages` (RPM release tag `.ngx`, the upstream nginx repo) in **both lanes** (stdlib + polars, byte-identical, tests extended) so the nginx Upstream row renders from data. ## Three hand values the generated table corrects The scratch tables were hand-copied; three cells contradict the caches this render uses, and the pipeline now shows the derived value: 1. **Windows-OS-Cluster: 44 CVEs** (scratch said 35). There are 44 CVEs at CVSS 9.8 against the `windows_server_*` tokens (41 on all three servers); P5's own prose cites 47 (cop01) / 43 (dor01, ent01) "insgesamt am OS-Cluster". 2. **Kernel-Cluster CVSS 9.1–9.8** (scratch said 9.8): the six kernel CVEs include CVE-2026-99999 (9.3) and CVE-2026-89631 (9.1). Same for pillow: 9.2–9.8, not 9.8. The Clusterbildung sentence in the prose still says "35 Stueck, alle 9.8" (kept verbatim per instructions) and may want a one-word touch-up by the captain. 3. **Coverage gap notes refreshed**: the current evidence caches collect `uname -r` and `config/systems.csv` carries aliases/addresses for all 7 units, so those stale gap notes are gone; `sec-check error` now shows uniformly (it applies to all 7 units), and the VS ssh.cfg note is kept. ## Validation - Real caches under `.local/` (never committed): generated tables reproduce the scratch content row-for-row and value-for-value except the three corrections above; the derived Linux-Evidenz column matches the hand-set one on all 15 CVE rows. - `just repro`: both reports render byte-identical twice (`defender-findings` + new `defender-triage`). - `just test` (15 passed), `just lint`, `just fmt`, `just py-crosscheck`, `just py-repro` green; fixture lane renders the template with empty fallbacks and a synthetic-fixture warning box. - No raw CSVs, caches, or evidence/scan JSON are committed; template and prose only (counts, CVE ids, machine names are the captain's private-forge deliverable).
Port the captain's triage report into the repo as reports/defender-triage.typ
so its table entries are produced reproducibly by the pipeline instead of
being hand-copied into a scratch document.

This change will:
- generate the Systemlandkarte, CVE-Ranking, FP-Kandidaten and
  Evidenzabdeckung tables from the derived JSONs with Typst loops over both
  exports merged per machine and per CVE (rows, counts, CVSS ranges, Exploit,
  Trivy, Systeme and the Linux-Evidenz column are all derived; no
  hand-written table rows).
- derive the Linux-Evidenz column per row from the data: Windows platform
  renders '- (Windows)', defender-only without rpm/pip counter-evidence
  renders 'ja (Index)', rpm/pip/Trivy-backed rows render 'nein (Evidenz)'.
- keep the curated problem partition (17 problems, P1-P17) as authored
  selectors and labels in the template, since the clustering is the triage
  analysis itself, while every cell value stays computed from the data.
- derive per-evidence-unit upstreamPackages (RPM release tag .ngx, the
  upstream nginx repository) in both lanes so the nginx Upstream row
  renders from data instead of a hand-set version.
- keep the authored prose sections (Grundlagen, reliability analysis, the
  per-problem analyses, fan-out recommendation, reproducibility notes) in
  the captain's wording.
- add 'just triage' and wire it into the 'just all' fixture pipeline and
  the 'just repro' byte-identical proof set for both reports.
- correct three stale hand values that the generated table exposes: the
  Windows-OS cluster counts 44 CVEs at CVSS 9.8 (the scratch said 35; 41 of
  them sit on all three servers and P5 itself cites 47/43 overall), and the
  kernel/pillow clusters show their true CVSS ranges (9.1-9.8, 9.2-9.8)
  instead of the max score; the coverage table drops gap notes the current
  caches have closed (uname -r is collected, systems.csv carries all
  aliases) and shows the sec-check error uniformly.
Philipp Baumann deleted branch fm/dse-security-reports-triage-template 2026-10-26 21:21:20 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
philipp.baumann/dse-security-reports!8
No description provided.