dlor

I don't even know why we're spending time blaming anyone here. The only reason any of these vulnerabilities matter is because bad people do bad things with them. The night of the disclosure, I saw reports like this one and many others, and it was more than enough for what I thought any reasonable person would deem to meet the bar for early release. It turns out reasonable people can disagree on almost anything.

I'd rather we all collectively spend this time talking about how we go fix all the rest of the vulnerabilities we (and everyone else) are finding as quickly as possible and get the patches and mitigations deployed to everyone that needs them as quickly as possible over the coming months.

(I'm the guy that decided to release these early)

We've been working with the team on the coordinated disclosure, but I made the call to get these out early when exploits hit in the wild.

The vulnerability and patch are both very complex, and the maintainers did an incredible job on this one. We tested the patch extensively and it's holding up well.

We've made these images free and will keep them that way.

Enriching does a few things, but the main ones are adding CVSS information and CPE information.

CVSS (risk) is already well handled by other sources, but CPE (what software is affected) is kind of critical. I don't even know how they're going to focus enrichment on software the government uses without knowing what software the CVEs are in.

We're going to be launching Chainguard Libraries for Rust in a few weeks, this article perfectly calls out the issues.

crates are somewhat better designed than NPM/PyPI (the dist artifacts are source based), but still much worse than Go where there's an intermediate packaging step disconnected from the source of truth.

It's both. They got compromised by another supply chain attack on Trivy initially.

Really cool to see all the hard work on Trusted Publishing and Sigstore pay off here. As a reminder, these tools were never meant to prevent attacks like this, only to make them easier to detect, harder to hide, and easier to recover from.

This is awesome to see, and the result of many years of hard work from awesome people.

There's no defeating of scanners or even static linking. It's all automation, dynamic linking and patching to make the scanners happy. We go to great lengths to make sure that the scanners actually find everything so the results are accurate.

I can confirm our business is roughly 0 percent consulting and that it's 100% selling these hardened images.

The big ones that help are SBOMs, STIGs, FIPS, and CVE reduction. The images and the paperwork we provide make it so they can be dropped in to even the most regulated environments without toil.

Most of our customers use them for FedRAMP or IL 5/6 stuff out of the box.

Yep, that's it - the product is hardened container images!

Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore project.

We produce SBOMs during the build process, and cryptographically sign SLSA-formatted provenance artifacts depicting the entire build process so you can trace a built container all the way back to the sources it was built from.

We also try to make as much of our build system reproducible as possible (but we're not all the way there yet), so you can audit or rebuild the process yourself.

Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`