Skip to content

Commit 27b08b4

Browse files
crozzycrozzy
committed
test: add rh vex beta testing
Signed-off-by: crozzy <joseph.crosland@gmail.com>
1 parent aa68c87 commit 27b08b4

2 files changed

Lines changed: 184 additions & 1 deletion

File tree

‎.github/workflows/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ jobs:
126126
cd "$dir"
127127
go list -m
128128
go mod download
129-
GOMAXPROCS=2 go test -race ${RUNNER_DEBUG:+-v} "-coverprofile=${{ runner.temp }}/$(go list -m | tr / _).codecov.out" -covermode=atomic ./...
129+
GOMAXPROCS=2 go test -race -timeout 20m ${RUNNER_DEBUG:+-v} "-coverprofile=${{ runner.temp }}/$(go list -m | tr / _).codecov.out" -covermode=atomic ./...
130130
); done
131131
- name: Codecov
132132
if: >-

‎test/acceptance/red_hat_vex_feed_test.go‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
package acceptance
2+
3+
import (
4+
"net/http"
5+
"testing"
6+
"time"
7+
8+
"github.com/quay/claircore/test"
9+
"github.com/quay/claircore/test/integration"
10+
testpostgres "github.com/quay/claircore/test/postgres"
11+
"github.com/quay/claircore/toolkit/fixtures"
12+
)
13+
14+
type vexFeedTest struct {
15+
Name string
16+
Image string
17+
VEXURLs []string
18+
Expect []fixtures.ManifestRecord
19+
}
20+
21+
// internalVEXTests contains claircore's internal VEX feed test cases.
22+
// These test both the current and beta Red Hat VEX feeds against known images.
23+
//
24+
// CVEs tested:
25+
// - CVE-2023-4911: glibc (Looney Tunables)
26+
// - CVE-2023-2650: openssl
27+
// - CVE-2023-38545: curl (beta feed only - current feed CPEs don't match UBI9)
28+
// - CVE-2026-6846, CVE-2026-3441, CVE-2026-4647, CVE-2026-6844, CVE-2026-3442,
29+
// CVE-2026-25679, CVE-2026-31790, CVE-2025-69644
30+
var internalVEXTests = []vexFeedTest{
31+
// Current feed tests - vulnerable image (ubi9:9.0.0)
32+
{
33+
Name: "UBI9_90_Vulnerable_CurrentFeed",
34+
Image: "registry.access.redhat.com/ubi9:9.0.0",
35+
VEXURLs: []string{
36+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-4911.json",
37+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2650.json",
38+
},
39+
Expect: []fixtures.ManifestRecord{
40+
{ID: "CVE-2023-4911", Product: "BaseOS-9.2.0.Z.MAIN.EUS:glibc-0:2.34-60.el9_2.7.aarch64", Status: fixtures.StatusAffected},
41+
{ID: "CVE-2023-2650", Product: "BaseOS-9.2.0.Z.MAIN.EUS:openssl-libs-1:3.0.7-16.el9_2.aarch64", Status: fixtures.StatusAffected},
42+
},
43+
},
44+
// Current feed tests - patched image (ubi9:9.3)
45+
{
46+
Name: "UBI9_93_Patched_CurrentFeed",
47+
Image: "registry.access.redhat.com/ubi9:9.3",
48+
VEXURLs: []string{
49+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-4911.json",
50+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2650.json",
51+
},
52+
Expect: []fixtures.ManifestRecord{
53+
{ID: "CVE-2023-4911", Product: "BaseOS-9.2.0.Z.MAIN.EUS:glibc-0:2.34-60.el9_2.7.aarch64", Status: fixtures.StatusAbsent},
54+
{ID: "CVE-2023-2650", Product: "BaseOS-9.2.0.Z.MAIN.EUS:openssl-libs-1:3.0.7-16.el9_2.aarch64", Status: fixtures.StatusAbsent},
55+
},
56+
},
57+
// Beta feed tests - vulnerable image (ubi9:9.0.0)
58+
{
59+
Name: "UBI9_90_Vulnerable_BetaFeed",
60+
Image: "registry.access.redhat.com/ubi9:9.0.0",
61+
VEXURLs: []string{
62+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-4911.json",
63+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-2650.json",
64+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-38545.json",
65+
},
66+
Expect: []fixtures.ManifestRecord{
67+
{ID: "CVE-2023-4911", Product: "rhel-9.3.0:glibc.src", Status: fixtures.StatusAffected},
68+
{ID: "CVE-2023-2650", Product: "rhel-9.3.0:openssl.src", Status: fixtures.StatusAffected},
69+
// CVE-2023-38545 (curl) is patched in 9.0.0, so it should be absent.
70+
// The beta feed incorrectly reports it as affected (false positive).
71+
{ID: "CVE-2023-38545", Product: "rhel-9.3.0:curl.src", Status: fixtures.StatusAbsent},
72+
},
73+
},
74+
// Beta feed tests - patched (non-vulnerable) image (ubi9:9.3)
75+
// NOTE: All CVEs below are expected to FAIL because the beta feed incorrectly
76+
// marks patched packages as known_affected. This documents the data quality issue.
77+
{
78+
Name: "UBI9_93_Patched_BetaFeed",
79+
Image: "registry.access.redhat.com/ubi9:9.3",
80+
VEXURLs: []string{
81+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-4911.json",
82+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-2650.json",
83+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-38545.json",
84+
},
85+
Expect: []fixtures.ManifestRecord{
86+
{ID: "CVE-2023-4911", Product: "rhel-9.3.0:glibc.src", Status: fixtures.StatusAbsent},
87+
{ID: "CVE-2023-2650", Product: "rhel-9.3.0:openssl.src", Status: fixtures.StatusAbsent},
88+
{ID: "CVE-2023-38545", Product: "rhel-9.3.0:curl.src", Status: fixtures.StatusAbsent},
89+
},
90+
},
91+
// Beta feed tests - hummingbird go image.
92+
// The beta feed includes hummingbird products; the current feed uses "red_hat_hardened_images".
93+
// NOTE: CVE-2026-25679 (golang) diverges between feeds: the beta feed marks golang1.25 as
94+
// "fixed" (hummingbird-1:golang1.25-0:1.25.9-1.hum1), while the current feed marks it as
95+
// "known_affected". The installed version equals the fixedIn version, so the package is not
96+
// reported as vulnerable - correctly absent from results.
97+
{
98+
Name: "Hummingbird_BetaFeed",
99+
Image: "quay.io/hummingbird/go@sha256:4bb8023430f26cfb4e779319a83d5d9577ce54fbf6433e9340e0035ab33b5ccc",
100+
VEXURLs: []string{
101+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-6846.json",
102+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-3441.json",
103+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-25679.json",
104+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-4647.json",
105+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-6844.json",
106+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-3442.json",
107+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-31790.json",
108+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2025/cve-2025-69644.json",
109+
},
110+
Expect: []fixtures.ManifestRecord{
111+
{ID: "CVE-2026-6846", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
112+
{ID: "CVE-2026-3441", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
113+
{ID: "CVE-2026-25679", Product: "hummingbird-1:golang1.25-0:1.25.9-1.hum1", Status: fixtures.StatusAbsent},
114+
{ID: "CVE-2026-4647", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
115+
{ID: "CVE-2026-6844", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
116+
{ID: "CVE-2026-3442", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
117+
{ID: "CVE-2026-31790", Product: "hummingbird-1:openssl-fips-provider.src", Status: fixtures.StatusAffected},
118+
// {ID: "CVE-2025-69644", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
119+
},
120+
},
121+
// Current feed tests - hummingbird go image.
122+
// In the current feed hummingbird products appear under the "red_hat_hardened_images" namespace.
123+
// NOTE: CVE-2026-25679 (golang) is expected to FAIL because the current feed incorrectly
124+
// marks golang1.25/1.26 as known_affected when they are fixed in hummingbird per the beta feed.
125+
{
126+
Name: "Hummingbird_CurrentFeed",
127+
Image: "quay.io/hummingbird/go@sha256:4bb8023430f26cfb4e779319a83d5d9577ce54fbf6433e9340e0035ab33b5ccc",
128+
VEXURLs: []string{
129+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6846.json",
130+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3441.json",
131+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json",
132+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4647.json",
133+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6844.json",
134+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3442.json",
135+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31790.json",
136+
"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69644.json",
137+
},
138+
Expect: []fixtures.ManifestRecord{
139+
{ID: "CVE-2026-6846", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
140+
{ID: "CVE-2026-3441", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
141+
{ID: "CVE-2026-25679", Product: "red_hat_hardened_images:golang1.25", Status: fixtures.StatusAbsent},
142+
{ID: "CVE-2026-4647", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
143+
{ID: "CVE-2026-6844", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
144+
{ID: "CVE-2026-3442", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
145+
{ID: "CVE-2026-31790", Product: "red_hat_hardened_images:openssl-fips-provider.src", Status: fixtures.StatusAffected},
146+
// {ID: "CVE-2025-69644", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
147+
},
148+
},
149+
}
150+
151+
func TestVEXFeeds(t *testing.T) {
152+
integration.Skip(t)
153+
integration.NeedDB(t)
154+
ctx := test.Logging(t)
155+
156+
indexerPool := testpostgres.TestIndexerDB(ctx, t)
157+
matcherPool := testpostgres.TestMatcherDB(ctx, t)
158+
client := &http.Client{Timeout: 2 * time.Minute}
159+
160+
auditor, err := NewClaircoreAuditor(ctx, t, &ClaircoreConfig{
161+
IndexerPool: indexerPool,
162+
MatcherPool: matcherPool,
163+
}, client)
164+
if err != nil {
165+
t.Fatalf("NewClaircoreAuditor: %v", err)
166+
}
167+
t.Cleanup(func() { auditor.Close(ctx) })
168+
169+
for _, tc := range internalVEXTests {
170+
t.Run(tc.Name, func(t *testing.T) {
171+
docs, err := FetchVEXDocs(ctx, client, tc.VEXURLs)
172+
if err != nil {
173+
t.Fatalf("fetch VEX: %v", err)
174+
}
175+
fix := &Fixture{
176+
Reference: tc.Image,
177+
VEXDocuments: docs,
178+
Expected: tc.Expect,
179+
}
180+
Run(ctx, t, auditor, []string{tc.Image}, WithFixture(fix))
181+
})
182+
}
183+
}

0 commit comments

Comments
 (0)