mirror of
https://github.com/gadgethd/ukmesh.git
synced 2026-09-09 16:45:33 +00:00
34 lines
1.2 KiB
Markdown
34 lines
1.2 KiB
Markdown
# Security waiver policy
|
|
|
|
Production images may not be released with an unwaived critical vulnerability.
|
|
The release workflow scans the exact pushed digest and reads
|
|
`.trivyignore.yaml`; a tag or a locally rebuilt image is never substituted for
|
|
that digest.
|
|
|
|
An exception is allowed only when all of the following are true:
|
|
|
|
- the vulnerability ID and affected path or package are specific;
|
|
- the statement records the applicability analysis, compensating control,
|
|
`owner=<team-or-person>`, and `reviewed=YYYY-MM-DD`;
|
|
- `expired_at` is no more than 30 days after the review date;
|
|
- a security reviewer approved the change through normal code review; and
|
|
- a follow-up issue is linked in the statement.
|
|
|
|
Example:
|
|
|
|
```yaml
|
|
vulnerabilities:
|
|
- id: CVE-2099-0001
|
|
paths:
|
|
- usr/lib/example.so
|
|
statement: >-
|
|
Not reachable in this image; issue=SEC-123; owner=platform;
|
|
reviewed=2099-01-02
|
|
expired_at: 2099-02-01
|
|
```
|
|
|
|
`node scripts/check-trivy-waivers.mjs` validates uniqueness, ownership, review
|
|
date, expiry, and the maximum lifetime. Remove the entry as soon as a fixed
|
|
base image or dependency is available. Waivers must never suppress an entire
|
|
scanner, severity, or image.
|