feat: add check-advisories to check BRSA fields #604

piyush-jena · 2025-11-26T22:39:48Z

Description of changes:
Add check-advisories task

Validate CVE ID/GHSA ID in the Rust crate. Moves implementation of this (twoliter: add check-advisories task to lint BRSAs #467) into the Rust crate.
Validate BRSA's package-metadata and make sure the included package is at a higher version.

How it works?
We implement a advisory-checker rust crate that takes 2 arguments - The rpmspec file and advisories directory. The binary is called during build by the upper level build.Dockerfile. Since, its already in the sdk context and the rpm macros are loaded, we can use rpmspec and rpm --eval macros to extract package name and versions. We deserialize the advisory files to extract the expected version and then compare using rpm.vercmp to evaluate if we are in a newer version.

Testing done:
Cropping output for brevity.

Testing it on bottlerocket-core-kit. I introduced 2 errors to test different cases. I created a sub-package BRSA with wrong epoch which got flagged. A different package with wrong version also got flagged.

[fedora@ip-172-31-57-102 bottlerocket-core-kit]$ PACKAGE="amazon-ssm-agent" make twoliter build-package
Found Twoliter v0.13.0 installed.
Skipping installation.
[2025-12-11T22:26:32Z INFO  twoliter::project::lock] Resolving project references to check against lock file
[2025-12-11T22:26:32Z INFO  twoliter::project::lock::image] Resolving dependency image dependency 
 **********************************************
[cargo-make] INFO - Running Task: validate-kits
[cargo-make] INFO - Running Task: build-package
   Compiling amazon-ssm-agent v0.1.0 (/home/fedora/Repositories/myrepos/bottlerocket-core-kit/packages/amazon-ssm-agent)
error: failed to run custom build command for `amazon-ssm-agent v0.1.0 (/home/fedora/Repositories/myrepos/bottlerocket-core-kit/packages/amazon-ssm-agent)`
***********************************************
  #11 [rpmbuild 5/7] RUN --mount=source=advisories,target=/home/builder/advisories     --mount=target=/host     /host/build/tools/advisory-checker --spec-file rpmbuild/SPECS/amazon-ssm-agent.spec --advisories-dir /home/builder/advisories/
  #11 0.337 Error: 1 Advisory violations found.
  #11 0.337 
  #11 0.337 Advisory violations found: 
  #11 0.337  BRSA ID: BRSA-hc1ikaaaqfgw
  #11 0.337  package name: amazon-ssm-agent-plugin
  #11 0.337  package version: 0:3.3.3185.0
  #11 0.337  min expected version: 1:3.3.2746.0
  #11 ERROR: process "/bin/sh -c /host/build/tools/advisory-checker --spec-file rpmbuild/SPECS/${PACKAGE}.spec --advisories-dir /home/builder/advisories/" did not complete successfully: exit code: 1
  ------
   > [rpmbuild 5/7] RUN --mount=source=advisories,target=/home/builder/advisories     --mount=target=/host     /host/build/tools/advisory-checker --spec-file rpmbuild/SPECS/amazon-ssm-agent.spec --advisories-dir /home/builder/advisories/:
  0.337 Error: 1 Advisory violations found.
  0.337 
  0.337 Advisory violations found: 
  0.337  BRSA ID: BRSA-hc1ikaaaqfgw
  0.337  package name: amazon-ssm-agent-plugin
  0.337  package version: 0:3.3.3185.0
  0.337  min expected version: 1:3.3.2746.0
 **********************************************
  --- stderr
  Failed to execute command: 'docker build /home/fedora/Repositories/myrepos/bottlerocket-core-kit --target package --tag buildsys-pkg-iputils-x86_64-d06f4eb4ccb3 --network host --file /home/fedora/Repositories/myrepos/bottlerocket-core-kit/build/tools/build.Dockerfile --no-cache-filter rpmbuild,kitbuild,repobuild,imgbuild,migrationbuild,kmodkitbuild,imgrepack --build-arg BYPASS_SOCKET=buildsys-pkg-iputils-x86_64-d06f4eb4ccb3-bypass --build-arg BUILDER_UID=1000 --build-arg KIT_DEPENDENCIES= --build-arg EXTERNAL_KIT_DEPENDENCIES= --build-arg PACKAGE=iputils --build-arg PACKAGE_DEPENDENCIES=glibc libattr libcap --build-arg BUILD_ID=9b3a8b3a-dirty --build-arg BUILD_ID_TIMESTAMP=1764962845 --build-arg ARCH=x86_64 --build-arg GOARCH=amd64 --build-arg SDK=public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.65.1 --build-arg NOCACHE=257869799141623177217469531688013417160 --build-arg TOKEN=d06f4eb4ccb3 --build-arg OUTPUT_SOCKET=buildsys-output-d06f4eb4ccb3-257869799141623177217469531688013417160 --build-arg BUILDKIT_DOCKERFILE_CHECK=skip=InvalidDefaultArgInFrom,SecretsUsedInArgOrEnv'
Error while executing command, exit code: 101
Error: Command was unsuccessful, exit code 105
make: *** [Makefile:65: twoliter] Error 1

Testing it on bottlerocket-kernel-kit.

[fedora@ip-172-31-57-102 bottlerocket-kernel-kit]$ make ARCH=x86_64
 **********************************************
[cargo-make] INFO - Running Task: validate-kits
[cargo-make] INFO - Running Task: build-kit
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.04s
[cargo-make] INFO - Build Done in 0.83 seconds.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

jmt-lab

LGTM

twoliter/embedded/rpm2kit

tools/advisory-parser/src/models.rs

twoliter/embedded/rpm2kit

tools/advisory-parser/src/main.rs

piyush-jena · 2025-12-04T00:26:18Z

Fixed some of the comments above.

piyush-jena · 2025-12-04T03:24:03Z

Resolved all comments.

cbgbt

I had to fix the advisories in the earlier versions because they didn't have patched-epoch field. We can plan on either defaulting to 0 here or add those fields in the advisories.

Zero as a default should be OK. RPM treats unspecified as 0.

I noticed that bottlerocket-core-kit/advisories/2.1.0/BRSA-1j0o73qa.toml has an odd patched version:

patched-version = "kernel-5.15.160-104.158.amzn2"

I suppose this just shows up as a warning? What should happen here?

twoliter/embedded/rpm2kit

twoliter/embedded/Makefile.toml

tools/advisory-parser/src/models.rs

tools/advisory-parser/src/main.rs

tools/advisory-parser/src/models.rs

tools/advisory-parser/src/main.rs

piyush-jena · 2025-12-05T01:45:32Z

I had to fix the advisories in the earlier versions because they didn't have patched-epoch field. We can plan on either defaulting to 0 here or add those fields in the advisories.

Zero as a default should be OK. RPM treats unspecified as 0.

I noticed that bottlerocket-core-kit/advisories/2.1.0/BRSA-1j0o73qa.toml has an odd patched version:
patched-version = "kernel-5.15.160-104.158.amzn2"
I suppose this just shows up as a warning? What should happen here?

@cbgbt

Yeah I used default so that I don't have to fix the old advisories.
Because the corresponding package is not present, we just emit a warning like this

Checking advisory: advisories/2.1.0/BRSA-1j0o73qa.toml
  WARNING: Package kernel-5.15 could not be found.

piyush-jena · 2025-12-05T09:45:44Z

Fixed all comments.

twoliter/embedded/Makefile.toml

cbgbt

Do we still need changes to Makefile.toml to ensure that these get run during a kit build? Maybe I missed it, but I'm not seeing how this gets invoked.

cbgbt · 2025-12-13T00:39:28Z

tools/advisory-checker/src/main.rs

+fn validate_advisories(spec_path: &Path, advisories_dir: &Path) -> Result<()> {
+    let pkg_metadata = get_rpm_metadata(spec_path)?;
+
+    if !pkg_metadata.is_empty() {


Should it be an error if we can't extract RPM metadata?

There are 2 sources of error.

rpmspec command fails - this means its a malformed spec file and build would fail later.

output doesn't have 3 parts: name, epoch, version - I couldn't get it to fail on a valid spec file. If epoch is not present then the value is (none). Name and version are mandatory fields and would just cause command failure above.

tools/advisory-checker/src/main.rs

cbgbt · 2025-12-13T00:42:39Z

tools/advisory-checker/src/main.rs

+    Ok(())
+}
+
+fn check_advisory(


Can we get an integration test with edge cases for this? We have other integration tests in twoliter that build kits. This logic seems correct, but it's pretty hard to know without tests.

tools/advisory-checker/src/main.rs

tools/advisory-checker/Cargo.toml

piyush-jena · 2025-12-13T00:49:08Z

@cbgbt

Do we still need changes to Makefile.toml to ensure that these get run during a kit build? Maybe I missed it, but I'm not seeing how this gets invoked.

This runs as part of the make twoliter build-package so we don't need to make any changes. A bad advisory would show up as build failure with error messages like shown above in the Description.

bcressey · 2025-12-16T18:08:21Z

twoliter/embedded/build.Dockerfile

+RUN --mount=source=advisories,target=/home/builder/advisories \
+    --mount=target=/host \
+    /host/build/tools/advisory-checker rpmbuild/SPECS/${PACKAGE}.spec /home/builder/advisories/


Better to run this before the package build.

I placed it before the rpmbuild but after we put the sources and macros in the right place. Should I move this before that and add the line for copying macros into this?

tools/advisory-checker/src/error.rs

tools/advisory-checker/src/models.rs

tools/advisory-checker/src/main.rs

tools/advisory-checker/src/models.rs

Signed-off-by: Piyush Jena <jepiyush@amazon.com>

tools/advisory-checker/src/models.rs

ginglis13 · 2025-12-17T19:08:36Z

twoliter/embedded/build.Dockerfile

+RUN --mount=source=advisories,target=/home/builder/advisories \
+    --mount=target=/host \
+    /host/build/tools/advisory-checker --spec-file rpmbuild/SPECS/${PACKAGE}.spec --advisories-dir /home/builder/advisories/
+


I don't think this will this work for custom kits that may not include an advisories directory. Probably safer to mark as not required in the mount args and check for existence of the advisories dir:

Suggested change

RUN --mount=source=advisories,target=/home/builder/advisories \

--mount=target=/host \

/host/build/tools/advisory-checker --spec-file rpmbuild/SPECS/${PACKAGE}.spec --advisories-dir /home/builder/advisories/

RUN --mount=source=advisories,target=/home/builder/advisories,required=false \

--mount=target=/host \

if [ -d /home/builder/advisories ]; then \

/host/build/tools/advisory-checker --spec-file rpmbuild/SPECS/${PACKAGE}.spec --advisories-dir /home/builder/advisories/ \

fi

Alternatively, could just set required=false in the mount args and in your advisory-checker binary, throw a warning if the dir doesn't exist and move on.

I'd also advocate for unit/integration testing for this case.

piyush-jena force-pushed the check-advisories branch 5 times, most recently from ba9f677 to 1eb07a3 Compare December 1, 2025 20:46

jmt-lab approved these changes Dec 3, 2025

View reviewed changes

vigh-m reviewed Dec 3, 2025

View reviewed changes

twoliter/embedded/rpm2kit Outdated Show resolved Hide resolved

vigh-m reviewed Dec 3, 2025

View reviewed changes

twoliter/embedded/rpm2kit Outdated Show resolved Hide resolved

ytsssun reviewed Dec 3, 2025

View reviewed changes

tools/advisory-parser/src/models.rs Outdated Show resolved Hide resolved

tools/advisory-parser/src/models.rs Outdated Show resolved Hide resolved

ginglis13 reviewed Dec 3, 2025

View reviewed changes

ytsssun reviewed Dec 3, 2025

View reviewed changes

tools/advisory-parser/src/main.rs Outdated Show resolved Hide resolved

piyush-jena force-pushed the check-advisories branch 5 times, most recently from ed9e89a to 9b86a6b Compare December 4, 2025 00:25

piyush-jena force-pushed the check-advisories branch 3 times, most recently from 34db683 to a78f0ec Compare December 4, 2025 03:18

piyush-jena force-pushed the check-advisories branch 3 times, most recently from 6179367 to 8a85572 Compare December 4, 2025 19:28

cbgbt reviewed Dec 4, 2025

View reviewed changes

piyush-jena force-pushed the check-advisories branch 3 times, most recently from 8d45429 to f064191 Compare December 5, 2025 09:25

piyush-jena force-pushed the check-advisories branch 2 times, most recently from e24be77 to d3f188d Compare December 5, 2025 10:02

bcressey reviewed Dec 5, 2025

View reviewed changes

twoliter/embedded/Makefile.toml Outdated Show resolved Hide resolved

piyush-jena force-pushed the check-advisories branch 4 times, most recently from 0d1536d to 5ef22a5 Compare December 11, 2025 22:28

cbgbt reviewed Dec 13, 2025

View reviewed changes

bcressey reviewed Dec 16, 2025

View reviewed changes

piyush-jena force-pushed the check-advisories branch 2 times, most recently from 8dbc4e4 to dc3a561 Compare December 17, 2025 01:24

feat: add check-advisories to check BRSA fields

8802745

Signed-off-by: Piyush Jena <jepiyush@amazon.com>

piyush-jena force-pushed the check-advisories branch from dc3a561 to 8802745 Compare December 17, 2025 02:02

ginglis13 reviewed Dec 17, 2025

View reviewed changes

feat: add check-advisories to check BRSA fields #604

Are you sure you want to change the base?

feat: add check-advisories to check BRSA fields #604

Uh oh!

Conversation

piyush-jena commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmt-lab left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

piyush-jena commented Dec 4, 2025

Uh oh!

piyush-jena commented Dec 4, 2025

Uh oh!

cbgbt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

piyush-jena commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

piyush-jena commented Dec 5, 2025

Uh oh!

Uh oh!

cbgbt left a comment

Choose a reason for hiding this comment

Uh oh!

cbgbt Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

piyush-jena Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cbgbt Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

piyush-jena commented Dec 13, 2025

Uh oh!

bcressey Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

piyush-jena Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ginglis13 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

piyush-jena commented Nov 26, 2025 •

edited

Loading

piyush-jena commented Dec 5, 2025 •

edited

Loading