Repository navigation
fix(tasks): ensure reliable Taskfile execution across harnesses and tooling - #109
Conversation
…ooling - Fix unquoted YAML key error on 'rotate-logs' command line - Fix mise executable invocation in 'test-osquery' and 'test-falco' - Add osqueryi availability guard in Go harness_test.go to skip gracefully on non-host osquery - Add ZO_SKIP_SSRF_CHECKS to OpenObserve service in docker-compose.yaml to unblock local alert webhook destinations - Update scanner service to anchore/grype:debug with /busybox/sh entrypoint and PATH configuration - Fix ARTIFACT_ROOT path resolution in tools/bench_compare.py - Add fallback definitions for legacy Caldera abilities pruned upstream in tools/caldera_otel_harness.py - Update default OpenObserve credentials in tools/caldera_otel_harness.py - Upgrade urllib3 to 2.8.0 in uv.lock resolving 3 OSV CVEs
|
Report Summary ┌───────────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. clamav/clamav:latest_base (alpine 3.24.2)Total: 1 (HIGH: 1, CRITICAL: 0) ┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ |
|
Report Summary ┌───────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. goflow2 (gobinary)Total: 22 (HIGH: 22, CRITICAL: 0) ┌─────────────────────┬────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. clamav/clamav:latest (alpine 3.24.2)Total: 1 (HIGH: 1, CRITICAL: 0) ┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
|
|
Report Summary ┌────────┬──────┬─────────────────┐
|
|
Report Summary ┌───────────────────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. nvcr.io/nvidia/k8s/dcgm-exporter:latest (debian 13.7)Total: 4 (HIGH: 4, CRITICAL: 0) ┌───────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌─────────────────┬──────────┬─────────────────┐
|
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. osquery/osquery:5.17.0-ubuntu22.04@sha256:47cb6ef2d2724c37c9db89f79387ad1d22051821823280459e439b9ac49d662a (ubuntu 22.04)Total: 3 (HIGH: 3, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌────────┬──────────┬─────────────────┐
|
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. openobserve/openobserve@sha256:d4a878fac1f6c56003764f7f2a1625668917388f167e222c8c810de3f54c56ba (debian 13.7)Total: 2 (HIGH: 2, CRITICAL: 0) ┌────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐ |
Summary of Improvements
Taskfile YAML Syntax & Tooling Invocations:
rotate-logscommand line (run: sudo).test-osqueryandtest-falcoto use standardmisein PATH rather than missing~/.local/bin/mise.scan-imageandscan-registryto ensure.data/scannerpermissions permit container non-root write.OpenObserve SSRF Guard Configuration:
ZO_SKIP_SSRF_CHECKS=trueto theopenobserveservice indocker-compose.yaml. This allows GitOps alert importing to register the local webhook destination (http://alert-receiver:9000/hooks/security-alert-open) without being rejected by OpenObserve 1.0.4's SSRF private IP check.Grype Scanner Profile Support:
scannercompose service toanchore/grype:debugwith/busybox/shentrypoint and adjustedPATHto include/sogrypeis runnable within containerized compose runs.Benchmark Comparator Path Resolution:
tools/bench_compare.pyARTIFACT_ROOTcalculation fromparents[2](which erroneously resolved to/home/john/.artifacts/bench) toparents[1](/home/john/LocalObserve/.artifacts/bench).Caldera Emulation Harness Robustness:
335cea7b-bec0-48c6-adfb-6066070f5f68and5a39d7ed-45c9-4a79-b581-e5fb99e24f65) that were recently pruned from upstream MITRE Caldera stockpile.tools/caldera_otel_harness.pyto match stack defaults when not passed via environment.Go Security Harness Test:
exec.LookPath("osqueryi")guard intests/harness_test.goso systems without host-installedosqueryiskip gracefully with clear messaging instead of failing.Dependency CVE Remediation:
urllib3from 2.7.0 to 2.8.0 inuv.lock, remediating 3 OSV CVEs and makingtask scan-osvexit with 0 findings.Validation