chore(release): drop the zlib1g exception the overlay makes stale

Every advisory baseline accepted CVE-2026-85091 against zlib1g
1:1.3.dfsg+really1.3.1-1+b1. The overlay removes that version from the
images, and the release candidate check refuses an exception whose
finding is fixed or absent. Remove it, and test that every exception on
an overlaid package names the overlay version.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

release/scripts/test_check_advisory_baselines.py

@@ -1421,6 +1421,31 @@ def test_v3_baseline_is_rejected(self):
         with self.assertRaises(SystemExit):
             self.load_baseline(baseline)
 
+    def test_live_exceptions_on_overlaid_packages_name_the_overlay_version(self):
+        # A runtime package overlay replaces the Distroless base's copy of the
+        # package, so an exception naming any other version of it can no longer
+        # match a finding, and the candidate check refuses it as fixed or absent.
+        spec = importlib.util.spec_from_file_location(
+            "check_debian13_images",
+            Path(__file__).with_name("check-debian13-images.py"),
+        )
+        images = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(images)
+        for path in LIVE_BASELINES:
+            baseline = self.module.load_baseline(path)
+            for exception in baseline["exceptions"]:
+                overlay = images.RUNTIME_PACKAGES.get(exception["package"])
+                if overlay is None:
+                    continue
+                with self.subTest(
+                    path=path.name,
+                    vulnerability=exception["vulnerability_id"],
+                    package=exception["package"],
+                ):
+                    self.assertEqual(
+                        overlay["version"], exception["installed_version"]
+                    )
+
     def test_all_live_baselines_use_evaluable_whole_image_fingerprints(self):
         for path in LIVE_BASELINES:
             with self.subTest(path=path):

release/security/breg-advisory-baseline.json

@@ -241,64 +241,6 @@
         "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef"
       }
     },
-    {
-      "vulnerability_id": "CVE-2026-85091",
-      "package": "zlib1g",
-      "installed_version": "1:1.3.dfsg+really1.3.1-1+b1",
-      "severity": "High",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Reviewed the v0.45.0 Linux amd64 breg local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a <no-dsa> note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg.json and exposure/breg.bregctl.json record no review-required dynamic lookup in /usr/local/bin/breg and /usr/local/bin/bregctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. The public Token Status List codec uses pure-Rust miniz_oxide, not system libz or its gz* routines, and no shipped entrypoint calls that module. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.",
-      "reviewed_at": "2026-11-03",
-      "expires_at": "2027-01-26",
-      "invalidation_triggers": [
-        "candidate_image_identity_mismatch",
-        "candidate_rootfs_changed",
-        "component_layer_changed",
-        "expired",
-        "exposure_assertion_changed",
-        "exposure_assertion_false",
-        "exposure_assertion_unevaluable",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed",
-        "rootfs_evidence_mismatch",
-        "runtime_config_changed",
-        "runtime_base_changed"
-      ],
-      "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866",
-      "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
-      "exposure_assertion": {
-        "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:21e3d9934b2dd6fe8de0a90d2cbf18e6124f1db84439003de8e07f32ae3b7b74",
-        "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893",
-        "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:718427f904e91891bdd8c830ddaeb1751d9131b34add0c329eebadda456ff866",
-        "files": [
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
-            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
-            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
-            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
-            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
-          },
-          {
-            "path": "/usr/local/bin/breg",
-            "sha256": "sha256:659d41fa92d7cdd46c922175013ddfc80c06c030032495ae3a618a37d4f0f86b"
-          }
-        ],
-        "definition_digest": "sha256:bb79000251c05524874cbd08a23eb1ea37dcb8528f838cdb4a4b7625f2b013ef"
-      }
-    },
     {
       "vulnerability_id": "CVE-2026-102010",
       "package": "gcc-14-base",

release/security/breg-mcp-advisory-baseline.json

@@ -242,64 +242,6 @@
         "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a"
       }
     },
-    {
-      "vulnerability_id": "CVE-2026-85091",
-      "package": "zlib1g",
-      "installed_version": "1:1.3.dfsg+really1.3.1-1+b1",
-      "severity": "High",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Reviewed the v0.45.0 Linux amd64 breg-mcp local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a <no-dsa> note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-mcp.json record no review-required dynamic lookup in /usr/local/bin/breg-mcp; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.",
-      "reviewed_at": "2026-11-03",
-      "expires_at": "2027-01-26",
-      "invalidation_triggers": [
-        "candidate_image_identity_mismatch",
-        "candidate_rootfs_changed",
-        "component_layer_changed",
-        "expired",
-        "exposure_assertion_changed",
-        "exposure_assertion_false",
-        "exposure_assertion_unevaluable",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed",
-        "rootfs_evidence_mismatch",
-        "runtime_base_changed",
-        "runtime_config_changed"
-      ],
-      "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27",
-      "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
-      "exposure_assertion": {
-        "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:13adf62c90b3e8641605a649dfb07d556bc21b663c6dd9d8927cd71763f10ed3",
-        "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893",
-        "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:a9d16bcf7fcc246370f243304a91691c130de3c54ac8b507b601359987b29b27",
-        "files": [
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
-            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
-            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
-            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
-            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
-          },
-          {
-            "path": "/usr/local/bin/breg-mcp",
-            "sha256": "sha256:4125b7085812fff0f6a922060d1b143bd549accf2be2c2bf08060aadd4a35463"
-          }
-        ],
-        "definition_digest": "sha256:3d1a19e8a3d413c64bce17522610cbed80bff37d4abec0bc4d4d520e1581572a"
-      }
-    },
     {
       "vulnerability_id": "CVE-2026-102010",
       "package": "gcc-14-base",

release/security/breg-review-advisory-baseline.json

@@ -242,64 +242,6 @@
         "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe"
       }
     },
-    {
-      "vulnerability_id": "CVE-2026-85091",
-      "package": "zlib1g",
-      "installed_version": "1:1.3.dfsg+really1.3.1-1+b1",
-      "severity": "High",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Reviewed the v0.45.0 Linux amd64 breg-review local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a <no-dsa> note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/breg-review.json record no review-required dynamic lookup in /usr/local/bin/breg-review; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.",
-      "reviewed_at": "2026-11-03",
-      "expires_at": "2027-01-26",
-      "invalidation_triggers": [
-        "candidate_image_identity_mismatch",
-        "candidate_rootfs_changed",
-        "component_layer_changed",
-        "expired",
-        "exposure_assertion_changed",
-        "exposure_assertion_false",
-        "exposure_assertion_unevaluable",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed",
-        "rootfs_evidence_mismatch",
-        "runtime_base_changed",
-        "runtime_config_changed"
-      ],
-      "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b",
-      "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
-      "exposure_assertion": {
-        "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:ca6daff09687282ce8b1615e8b991834c8d50bed8423869a27df31aed259763a",
-        "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893",
-        "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:b8793228923f066d8fd04204f048c41b1a98946660972fc1018ac6e4c341433b",
-        "files": [
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
-            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
-            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
-            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
-            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
-          },
-          {
-            "path": "/usr/local/bin/breg-review",
-            "sha256": "sha256:7932590d0ceb12ca0963908e36c40821486558cd81a47b232422e0ed85740c28"
-          }
-        ],
-        "definition_digest": "sha256:a3ede5143345e0f35bae3b2123a75b2e1ace6e3924dcf1d8693b9d8eadd881fe"
-      }
-    },
     {
       "vulnerability_id": "CVE-2026-102010",
       "package": "gcc-14-base",

release/security/casework-advisory-baseline.json

@@ -242,64 +242,6 @@
         "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096"
       }
     },
-    {
-      "vulnerability_id": "CVE-2026-85091",
-      "package": "zlib1g",
-      "installed_version": "1:1.3.dfsg+really1.3.1-1+b1",
-      "severity": "High",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Reviewed the v0.45.0 Linux amd64 casework local reproduction from review-only rehearsal 41678404398 on 2026-11-04. The pinned distroless cc-debian13 nonroot base, complete ordered DiffIDs, production OCI process contract, native Grype/Syft inventories and assertion file digests were checked against the exact exported rootfs. Grype reports not-fixed with no fixed version for zlib1g 1:1.3.dfsg+really1.3.1-1+b1. Debian's trixie tracker still marks this CVE vulnerable and does not record a <no-dsa> note. The base carries zlib, including gzwrite, gzfwrite, gzprintf and gzvprintf. The reviewed application executables neither need libz nor contain libz.so, gz_vacate, gzwrite, gzfwrite, gzprintf or gzvprintf. No reviewed dynamic lookup opens that closure, and the bounded source paths expose no stalled gzip-write followed by formatted-output operation. The reviewed reports exposure/casework.json and exposure/casework.caseworkctl.json record no review-required dynamic lookup in /usr/local/bin/casework and /usr/local/bin/caseworkctl; their resolved constant lookups select only __pthread_get_minstack, _dl_find_object, getrandom, none of which selects an affected symbol or library. Candidate acceptance still requires the exact ordered rootfs layers, production OCI process contract and Syft-bound executable, loader, libc, libm and libpthread digests. The owner and invalidation triggers remain unchanged; the approved quarterly review expires on 2027-01-26.",
-      "reviewed_at": "2026-11-03",
-      "expires_at": "2027-01-26",
-      "invalidation_triggers": [
-        "candidate_image_identity_mismatch",
-        "candidate_rootfs_changed",
-        "component_layer_changed",
-        "expired",
-        "exposure_assertion_changed",
-        "exposure_assertion_false",
-        "exposure_assertion_unevaluable",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed",
-        "rootfs_evidence_mismatch",
-        "runtime_base_changed",
-        "runtime_config_changed"
-      ],
-      "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132",
-      "component_layer_id": "sha256:e4ba966d7f0527dfe0fcb559e4e18d4da42c4e6beae924719255e0dedb554ed0",
-      "exposure_assertion": {
-        "kind": "whole_image_fingerprint_equals",
-        "reference_image_digest": "sha256:0e28cb112394a865d6eeb94d7ec26da6df46a669e7707807cf63336d8036e74f",
-        "reference_source_revision": "e1f2772def2febbc477854ba2e8a5c447eef9893",
-        "reference_provenance": "local_reproduction",
-        "runtime_definition_digest": "sha256:3b559ccbf493ed3025aa35cb3db74bd7bff3cf5b5f4e9d70ea2beb60ff36f132",
-        "files": [
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
-            "sha256": "sha256:c8438e4fde1934e61c88311633f00949ff645d5c04cdb8671fa3d78164d2f307"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
-            "sha256": "sha256:9792e3cbb541c8f44c7acf5f14f4022ea62998ecc787d326bed4d8b6547dfd92"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libm.so.6",
-            "sha256": "sha256:6d567d53e895273ca14a1f9dc164fc6c8d39aed2f60aa46a733c2784228915f3"
-          },
-          {
-            "path": "/usr/lib/x86_64-linux-gnu/libpthread.so.0",
-            "sha256": "sha256:85e21f7dba0394411d00959176fd18b470e575b0b05f1f4f41e5636802ce0500"
-          },
-          {
-            "path": "/usr/local/bin/casework",
-            "sha256": "sha256:9da02599f5ee83d1b4105f706f944276bbfed91efd19593644b0d9f1c8fc4988"
-          }
-        ],
-        "definition_digest": "sha256:f329ae0e7d1f8f5e3988d0a2551e4c4b4fdd9954d2de431ea1241d336e78e096"
-      }
-    },
     {
       "vulnerability_id": "CVE-2026-102010",
       "package": "gcc-14-base",