Files
ukmesh/docs/security-waivers.md
T

34 lines
1.2 KiB
Markdown

# Security waiver policy
Production images may not be released with an unwaived critical vulnerability.
The release workflow scans the exact pushed digest and reads
`.trivyignore.yaml`; a tag or a locally rebuilt image is never substituted for
that digest.
An exception is allowed only when all of the following are true:
- the vulnerability ID and affected path or package are specific;
- the statement records the applicability analysis, compensating control,
`owner=<team-or-person>`, and `reviewed=YYYY-MM-DD`;
- `expired_at` is no more than 30 days after the review date;
- a security reviewer approved the change through normal code review; and
- a follow-up issue is linked in the statement.
Example:
```yaml
vulnerabilities:
- id: CVE-2099-0001
paths:
- usr/lib/example.so
statement: >-
Not reachable in this image; issue=SEC-123; owner=platform;
reviewed=2099-01-02
expired_at: 2099-02-01
```
`node scripts/check-trivy-waivers.mjs` validates uniqueness, ownership, review
date, expiry, and the maximum lifetime. Remove the entry as soon as a fixed
base image or dependency is available. Waivers must never suppress an entire
scanner, severity, or image.