Part D: Vulnerability reporting¶

How to report¶

Contact: [email protected] PGP: F759D6D49B0A395AB922414A5CC3B4C50D37E793

Provide steps to reproduce, the affected version (trustsight --version), and what an attacker gains. A PKGBUILD or diff that demonstrates the issue is always better than a description.

There will be an acknowledgement within 72 hours.
Triage follows within 7 days.
In-scope issues get fixed on the timeline below.
Do not open a public issue before a patch exists.

Supported versions¶

Only the latest release is supported. Fixes ship in a new version; there are no backports.

What counts as a vulnerability in this kind of tool¶

TrustSight is an evidence tool with published limits, so "it missed something" is usually a rule request, not a vulnerability. The taxonomy above is what separates the two: a defect is a case where the tool moved between taxonomy rows silently, or failed to protect the machine while doing it.

In scope. Violations of Part A:

Code execution, file write, or file read outside the data/cache/config dirs, triggered by analysing a package.
Any outbound connection to a host other than the declared AUR endpoint and GitHub release channel (aur.archlinux.org, api.github.com, and github.com), or any fetch of a URL a PKGBUILD declares.
Terminal escape sequences or markup reaching a terminal from package-controlled text, including a crash of the renderer.
Unbounded memory or CPU from a crafted package: a decompression bomb, a pathological regex input, a response with no cap.
SQL injection or any write to the database driven by package-controlled text outside the columns it belongs in.
A seed or baseline that changes state it is not permitted to change: a rule, a pattern, a severity, a weight, a metadata key it does not own, or a row learned from a real analysis. A validly signed baseline whose contents are simply hostile is not this: that is the documented shape of importing someone else's corpus, and A13 bounds what it can do.

In scope. Violations of Part B:

A construction that causes an analysis to skip content without a coverage gap being recorded. Every bound that drops input has a gap; any other way to get content past the analyser silently is a vulnerability.
A construction that produces an UNFLAGGED or Low result despite an incomplete analysis, or that gets an incomplete analysis rendered to a human with an unqualified band.
Suppressing, removing or downgrading a FATAL rule or finding through any supported input.
Making a finding disappear from the report without it appearing as suppressed.
Any nondeterminism in the score: the same input, under the same config_fingerprint and against the same stored observation history, producing different numbers. A score that differs because the two databases hold different history is B1 working as described, not a finding.

Out of scope: rule evasion; score tuning; false positives; compromised upstream packages (that is the point); anything requiring a local attacker with write access to your config or your database; absence of runtime/sandbox analysis; anything after makepkg.

Timeline¶

Severity	Definition	Fix released in
Critical	Code execution or file write on the reviewer's machine, from analysing a package.	7 days
High	Any other Part A breach, or a verdict-integrity breach under Part B.	30 days
Moderate	A Part A or Part B breach that needs an unlikely precondition.	90 days
Low	Hardening, no demonstrated attack.	Next release

Reporters are credited in the changelog unless they ask not to be.