Skip to content

Commit e05dc91

Browse files
crozzycrozzy
committed
test: add red hat vex beta testing
The new Red Hat VEX feed is generally available and these tests help verify some specific regressions are fixed. Signed-off-by: crozzy <joseph.crosland@gmail.com>
1 parent 7a273bf commit e05dc91

3 files changed

Lines changed: 185 additions & 2 deletions

File tree

‎.github/workflows/updater-check.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
check-latest: true
2323
go-version-file: ./go.mod
2424
- name: Check
25-
run: go test -timeout=20m ./test/periodic -enable
25+
run: go test -timeout=30m ./test/periodic -enable
2626
- name: Create URL
2727
id: url
2828
if: failure()

‎test/periodic/periodic_test.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"testing"
88

99
"github.com/quay/claircore/libvuln/driver"
10+
"github.com/quay/claircore/test/integration"
1011
)
1112

1213
var (
@@ -23,5 +24,8 @@ func TestMain(m *testing.M) {
2324
if !*enable {
2425
os.Exit(0)
2526
}
26-
os.Exit(m.Run())
27+
var c int
28+
defer func() { os.Exit(c) }()
29+
defer integration.DBSetup()()
30+
c = m.Run()
2731
}

‎test/periodic/vex_feed_test.go‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
package periodic
2+
3+
import (
4+
"net/http"
5+
"testing"
6+
"time"
7+
8+
"github.com/quay/claircore/test"
9+
"github.com/quay/claircore/test/acceptance"
10+
"github.com/quay/claircore/test/integration"
11+
testpostgres "github.com/quay/claircore/test/postgres"
12+
"github.com/quay/claircore/toolkit/fixtures"
13+
)
14+
15+
type vexFeedTest struct {
16+
Name string
17+
Image string
18+
VEXURLs []string
19+
Expect []fixtures.ManifestRecord
20+
}
21+
22+
// vexFeedTests compares the current and beta Red Hat VEX feeds against known images.
23+
//
24+
// CVEs tested:
25+
// - CVE-2023-4911: glibc (Looney Tunables)
26+
// - CVE-2023-2650: openssl
27+
// - CVE-2023-38545: curl (beta feed only - current feed CPEs don't match UBI9)
28+
// - CVE-2026-6846, CVE-2026-3441, CVE-2026-4647, CVE-2026-6844, CVE-2026-3442,
29+
// CVE-2026-25679, CVE-2026-31790, CVE-2025-69644
30+
var vexFeedTests = []vexFeedTest{
31+
// Current feed tests - vulnerable image (ubi9:9.0.0)
32+
{
33+
Name: "UBI9_90_Vulnerable_CurrentFeed",
34+
Image: "registry.access.redhat.com/ubi9:9.0.0",
35+
VEXURLs: []string{
36+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-4911.json",
37+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2650.json",
38+
},
39+
Expect: []fixtures.ManifestRecord{
40+
{ID: "CVE-2023-4911", Product: "BaseOS-9.2.0.Z.MAIN.EUS:glibc-0:2.34-60.el9_2.7.aarch64", Status: fixtures.StatusAffected},
41+
{ID: "CVE-2023-2650", Product: "BaseOS-9.2.0.Z.MAIN.EUS:openssl-libs-1:3.0.7-16.el9_2.aarch64", Status: fixtures.StatusAffected},
42+
},
43+
},
44+
// Current feed tests - patched image (ubi9:9.3)
45+
{
46+
Name: "UBI9_93_Patched_CurrentFeed",
47+
Image: "registry.access.redhat.com/ubi9:9.3",
48+
VEXURLs: []string{
49+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-4911.json",
50+
"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2650.json",
51+
},
52+
Expect: []fixtures.ManifestRecord{
53+
{ID: "CVE-2023-4911", Product: "BaseOS-9.2.0.Z.MAIN.EUS:glibc-0:2.34-60.el9_2.7.aarch64", Status: fixtures.StatusAbsent},
54+
{ID: "CVE-2023-2650", Product: "BaseOS-9.2.0.Z.MAIN.EUS:openssl-libs-1:3.0.7-16.el9_2.aarch64", Status: fixtures.StatusAbsent},
55+
},
56+
},
57+
// Beta feed tests - vulnerable image (ubi9:9.0.0)
58+
{
59+
Name: "UBI9_90_Vulnerable_BetaFeed",
60+
Image: "registry.access.redhat.com/ubi9:9.0.0",
61+
VEXURLs: []string{
62+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-4911.json",
63+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-2650.json",
64+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-38545.json",
65+
},
66+
Expect: []fixtures.ManifestRecord{
67+
{ID: "CVE-2023-4911", Product: "rhel-br-9.2.0.z::baseos:glibc-common-0:2.34-60.el9_2.7", Status: fixtures.StatusAffected},
68+
{ID: "CVE-2023-2650", Product: "rhel-br-9.2.0.z::baseos:openssl-libs-1:3.0.7-16.el9_2", Status: fixtures.StatusAffected},
69+
// CVE-2023-38545 (curl): ubi9:9.0.0 ships curl-minimal 7.76.1-14.el9_0.5, which is
70+
// below the beta-feed fixed version, so the package is affected.
71+
{ID: "CVE-2023-38545", Product: "rhel-br-9.2.0.z::baseos:curl-minimal-0:7.76.1-23.el9_2.4", Status: fixtures.StatusAffected},
72+
},
73+
},
74+
// Beta feed tests - patched (non-vulnerable) image (ubi9:9.3)
75+
{
76+
Name: "UBI9_93_Patched_BetaFeed",
77+
Image: "registry.access.redhat.com/ubi9:9.3",
78+
VEXURLs: []string{
79+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-4911.json",
80+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-2650.json",
81+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2023/cve-2023-38545.json",
82+
},
83+
Expect: []fixtures.ManifestRecord{
84+
{ID: "CVE-2023-4911", Product: "rhel-br-9.2.0.z::baseos:glibc-common-0:2.34-60.el9_2.7", Status: fixtures.StatusAbsent},
85+
{ID: "CVE-2023-2650", Product: "rhel-br-9.2.0.z::baseos:openssl-libs-1:3.0.7-16.el9_2", Status: fixtures.StatusAbsent},
86+
{ID: "CVE-2023-38545", Product: "rhel-br-9.2.0.z::baseos:curl-minimal-0:7.76.1-23.el9_2.4", Status: fixtures.StatusAbsent},
87+
},
88+
},
89+
// Current feed tests - hummingbird go image.
90+
// Hummingbird products appear under the "Red Hat Hardened Images" namespace in the current feed.
91+
{
92+
Name: "Hummingbird_CurrentFeed",
93+
Image: "quay.io/hummingbird/go@sha256:4bb8023430f26cfb4e779319a83d5d9577ce54fbf6433e9340e0035ab33b5ccc",
94+
VEXURLs: []string{
95+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6846.json",
96+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3441.json",
97+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json",
98+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4647.json",
99+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6844.json",
100+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3442.json",
101+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31790.json",
102+
"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69644.json",
103+
},
104+
Expect: []fixtures.ManifestRecord{
105+
{ID: "CVE-2026-6846", Product: "Red Hat Hardened Images:binutils-main@x86_64", Status: fixtures.StatusAffected},
106+
{ID: "CVE-2026-3441", Product: "Red Hat Hardened Images:binutils-main@x86_64", Status: fixtures.StatusAffected},
107+
{ID: "CVE-2026-4647", Product: "Red Hat Hardened Images:binutils-main@x86_64", Status: fixtures.StatusAffected},
108+
{ID: "CVE-2026-6844", Product: "red_hat_hardened_images:binutils.src", Status: fixtures.StatusAffected},
109+
{ID: "CVE-2026-3442", Product: "Red Hat Hardened Images:binutils-main@x86_64", Status: fixtures.StatusAffected},
110+
{ID: "CVE-2026-31790", Product: "Red Hat Hardened Images:openssl-fips-provider-main@x86_64", Status: fixtures.StatusAffected},
111+
{ID: "CVE-2026-25679", Product: "Red Hat Hardened Images:golang1-25-main@x86_64", Status: fixtures.StatusAbsent},
112+
{ID: "CVE-2025-69644", Product: "Red Hat Hardened Images:binutils-main@x86_64", Status: fixtures.StatusAbsent},
113+
},
114+
},
115+
// Beta feed tests - hummingbird go image.
116+
// CVE-2026-6844 remains known_affected on binutils.src. Other binutils CVEs are "fixed" at
117+
// 2.45.1-5.1.hum1; the image ships 2.45.1-5.hum1 and should be reported Affected.
118+
// CVE-2025-69644 is fixed at the installed binutils NVR and correctly absent.
119+
// CVE-2026-25679 is fixed at the installed golang version and correctly absent.
120+
{
121+
Name: "Hummingbird_BetaFeed",
122+
Image: "quay.io/hummingbird/go@sha256:4bb8023430f26cfb4e779319a83d5d9577ce54fbf6433e9340e0035ab33b5ccc",
123+
VEXURLs: []string{
124+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-6846.json",
125+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-3441.json",
126+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-25679.json",
127+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-4647.json",
128+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-6844.json",
129+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-3442.json",
130+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2026/cve-2026-31790.json",
131+
"https://security.access.redhat.com/data/csaf/v2/vex-feed/2025/cve-2025-69644.json",
132+
},
133+
Expect: []fixtures.ManifestRecord{
134+
{ID: "CVE-2026-6846", Product: "hummingbird-1:binutils-0:2.45.1-5.1.hum1", Status: fixtures.StatusAffected},
135+
{ID: "CVE-2026-3441", Product: "hummingbird-1:binutils-0:2.45.1-5.1.hum1", Status: fixtures.StatusAffected},
136+
{ID: "CVE-2026-4647", Product: "hummingbird-1:binutils-0:2.45.1-5.1.hum1", Status: fixtures.StatusAffected},
137+
{ID: "CVE-2026-6844", Product: "hummingbird-1:binutils.src", Status: fixtures.StatusAffected},
138+
{ID: "CVE-2026-3442", Product: "hummingbird-1:binutils-0:2.45.1-5.1.hum1", Status: fixtures.StatusAffected},
139+
{ID: "CVE-2026-31790", Product: "hummingbird-1:openssl-fips-provider-so-0:3.0.7-1.2.hum1", Status: fixtures.StatusAffected},
140+
{ID: "CVE-2026-25679", Product: "hummingbird-1:golang1.25-0:1.25.9-1.hum1", Status: fixtures.StatusAbsent},
141+
{ID: "CVE-2025-69644", Product: "hummingbird-1:binutils-0:2.45.1-5.hum1", Status: fixtures.StatusAbsent},
142+
},
143+
},
144+
}
145+
146+
// TestVEXFeeds exercises current and beta Red Hat VEX feeds against known images.
147+
// Run with: go test ./test/periodic -enable -run TestVEXFeeds -timeout 30m
148+
func TestVEXFeeds(t *testing.T) {
149+
integration.NeedDB(t)
150+
ctx := test.Logging(t)
151+
152+
indexerPool := testpostgres.TestIndexerDB(ctx, t)
153+
matcherPool := testpostgres.TestMatcherDB(ctx, t)
154+
client := &http.Client{Timeout: 2 * time.Minute}
155+
156+
auditor, err := acceptance.NewClaircoreAuditor(ctx, t, &acceptance.ClaircoreConfig{
157+
IndexerPool: indexerPool,
158+
MatcherPool: matcherPool,
159+
}, client)
160+
if err != nil {
161+
t.Fatalf("NewClaircoreAuditor: %v", err)
162+
}
163+
t.Cleanup(func() { auditor.Close(ctx) })
164+
165+
for _, tc := range vexFeedTests {
166+
t.Run(tc.Name, func(t *testing.T) {
167+
docs, err := acceptance.FetchVEXDocs(ctx, client, tc.VEXURLs)
168+
if err != nil {
169+
t.Fatalf("fetch VEX: %v", err)
170+
}
171+
fix := &acceptance.Fixture{
172+
Reference: tc.Image,
173+
VEXDocuments: docs,
174+
Expected: tc.Expect,
175+
}
176+
acceptance.Run(ctx, t, auditor, []string{tc.Image}, acceptance.WithFixture(fix))
177+
})
178+
}
179+
}

0 commit comments

Comments
 (0)