docs(triage): explain how trivy was used methodologically #9

Merged

Philipp Baumann merged 1 commit from fm/dse-security-reports-trivy-bullet into main

2026-10-26 21:30:25 +00:00

Philipp Baumann commented

2026-10-26 21:29:30 +00:00

Owner

Summary

The captain asked for one additional bullet-point sentence in the triage report's "Grundlagen und Methode" section explaining how trivy was used, complementing the existing bullet that already states what trivy found and the counts. This adds exactly one bullet in German, placed directly below the existing trivy bullet, in the same style as the neighboring bullets.

What changed

reports/defender-triage.typ: one new bullet after the existing trivy bullet in "Grundlagen und Methode", describing the methodology: offline scan against the locally cached vulnerability database over a per-unit CycloneDX SBOM built from the SSH-collected RPM inventories, per-detection comparison of the installed against the fixed package version, epoch-aware interpretation (fixed equals installed modulo epoch means the fix was backported and is already present), and the stated limitation that upstream builds (the .ngx nginx packages) are compared only against distribution advisories.

Validation

just triage rendered against the real caches (derived/evidence/scans from the artifact copy, real exports via just ingest); two consecutive renders are byte-identical.
just test: 15 passed.

## Summary The captain asked for one additional bullet-point sentence in the triage report's "Grundlagen und Methode" section explaining *how* trivy was used, complementing the existing bullet that already states what trivy found and the counts. This adds exactly one bullet in German, placed directly below the existing trivy bullet, in the same style as the neighboring bullets. ## What changed - `reports/defender-triage.typ`: one new bullet after the existing trivy bullet in "Grundlagen und Methode", describing the methodology: offline scan against the locally cached vulnerability database over a per-unit CycloneDX SBOM built from the SSH-collected RPM inventories, per-detection comparison of the installed against the fixed package version, epoch-aware interpretation (fixed equals installed modulo epoch means the fix was backported and is already present), and the stated limitation that upstream builds (the `.ngx` nginx packages) are compared only against distribution advisories. ## Validation - `just triage` rendered against the real caches (derived/evidence/scans from the artifact copy, real exports via `just ingest`); two consecutive renders are byte-identical. - `just test`: 15 passed.

Philipp Baumann added 1 commit

2026-10-26 21:29:30 +00:00

docs(triage): explain how trivy was used methodologically 98715e4b7e

Add one bullet to the Grundlagen und Methode section of the triage report
describing the methodological trivy usage next to the existing counts
bullet: offline scan against the locally cached vulnerability database
over a per-unit CycloneDX SBOM built from the SSH-collected RPM
inventory, per-detection comparison of the installed against the fixed
package version with an epoch-aware reading (fixed equals installed
modulo epoch means the fix was backported and is already present), and
the stated limitation that upstream builds such as the .ngx nginx
packages are compared only against distribution advisories.

Philipp Baumann merged commit 7bea994291 into main

2026-10-26 21:30:25 +00:00

Philipp Baumann deleted branch fm/dse-security-reports-trivy-bullet

2026-10-26 21:30:25 +00:00

Philipp Baumann referenced this pull request from a commit

2026-10-26 21:30:26 +00:00

docs(triage): explain how trivy was used methodologically (#9)