fix: assess util-linux mount advisory

Dockerfile

@@ -39,7 +39,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOAMD64=v1 \
 
 FROM golang:1.26.6-bookworm@sha256:116d58cbd88c1297624acc6e967a060012422bacf9930927e23fb719189c6f36 AS engine-builder
 
-ARG RATIO1_VERSION=v1.0.0
+ARG RATIO1_VERSION=v1.0.1
 ARG SOURCE_DATE_EPOCH=1727820937
 ARG BUILD_JOBS=4
 
@@ -158,7 +158,7 @@ FROM scratch
 
 ARG BUILD_DATE=""
 ARG RATIO1_REVISION="unknown"
-ARG RATIO1_VERSION="v1.0.0"
+ARG RATIO1_VERSION="v1.0.1"
 
 LABEL org.opencontainers.image.title="R1 MeshDB" \
       org.opencontainers.image.description="Distributed SQL database runtime for Ratio1 edge nodes" \

RATIO1_PATCHES.md

@@ -4,6 +4,13 @@ This file records every deliberate difference between upstream CockroachDB
 v23.1.28 commit `76e598c9b1c100fd9280b979140b5e377c330a20` and this distribution.
 Every released file is covered by `source/manifest.sha256`.
 
+R1 MeshDB v1.0.1 adds a reviewed `not_affected` OpenVEX decision for
+`CVE-2026-53613`. The advisory targets util-linux's setuid `mount` path; the
+minimal scratch runtime retains only non-setuid `setsid` from that package and
+contains no `mount`, `umount`, `libmount`, or `/etc/fstab`. The release changes
+security metadata and versioned build identity without changing database,
+wire-protocol, consensus, or store-format behavior.
+
 ## Source Preparation
 
 ### OSS runtime closure
@@ -107,7 +114,7 @@ upstream commit as `Build Commit ID` and requires all of:
 
 ```text
 Distribution:     OSS
-Build Tag:        v1.0.0
+Build Tag:        v1.0.1
 Build Type:       release
 ```
 

README.md

@@ -1,4 +1,4 @@
-# R1 MeshDB v1.0.0
+# R1 MeshDB v1.0.1
 
 R1 MeshDB is an independently maintained Ratio1 distribution of a
 source-derived OSS runtime closure from CockroachDB v23.1.28. It packages the
@@ -11,7 +11,7 @@ copyright notices are retained under `engine/`.
 
 ## Version
 
-The current R1 MeshDB product version is `1.0.0`. [`VERSION`](VERSION) is the
+The current R1 MeshDB product version is `1.0.1`. [`VERSION`](VERSION) is the
 single source of truth: the build validates it, installs it in the image at
 `/usr/share/r1-meshdb/VERSION`, and records it in generated SPDX and CycloneDX
 SBOM application metadata. A merged `VERSION` change automatically starts the
@@ -94,7 +94,7 @@ Repository and package promotion controls are documented in
 ```bash
 scripts/verify-image.sh \
   ghcr.io/ratio1/r1-meshdb@sha256:<digest> \
-  v1.0.0
+  v1.0.1
 ```
 
 ## Support
@@ -116,7 +116,7 @@ and [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 ## Citation
 
 The R1 MeshDB entry below is the recommended citation for the current source
-snapshot. Publish it with an immutable `v1.0.0` tag before treating it as a
+snapshot. Publish it with an immutable `v1.0.1` tag before treating it as a
 reproducible release citation.
 
 ```bibtex
@@ -129,11 +129,11 @@ reproducible release citation.
   note    = {Tag v23.1.28; commit 76e598c9b1c100fd9280b979140b5e377c330a20}
 }
 
-@software{ratio1_meshdb_1_0_0,
+@software{ratio1_meshdb_1_0_1,
   author  = {{Ratio1}},
   title   = {{R1 MeshDB}},
-  version = {1.0.0},
-  date    = {2026-08-18},
+  version = {1.0.1},
+  date    = {2026-08-24},
   url     = {https://github.com/Ratio1/r1-meshdb},
   note    = {Source-derived Ratio1 distribution based on CockroachDB v23.1.28}
 }

RELEASE.md

@@ -100,7 +100,7 @@ Consumers verify a release with:
 ```bash
 scripts/verify-image.sh \
   ghcr.io/ratio1/r1-meshdb@sha256:<digest> \
-  v1.0.0
+  v1.0.1
 ```
 
 Do not move an existing version tag. Publish a new patch tag and document

SECURITY.md

@@ -79,6 +79,9 @@ component.
 - `CVE-2026-53615` is in util-linux's DOS/EBR parser. Only `setsid` is retained;
   `libblkid`, `blkid`, `findmnt`, and mount utilities are absent, and the
   entrypoint reads `/proc/self/mountinfo` directly.
+- `CVE-2026-53613` is in util-linux's setuid `mount` target-path handling for
+  restricted user mounts. The scratch runtime retains only non-setuid `setsid`;
+  `mount`, `umount`, `libmount`, and `/etc/fstab` are absent.
 - `CVE-2025-69720` is in the `infocmp` command's `analyze_string` function.
   `infocmp`, ncurses commands, and `libncurses` are absent; only `libtinfo` is
   retained for Bash and the database binary.

VERSION

@@ -1 +1 @@
-1.0.0
+1.0.1

scripts/verify-security-vex.py

@@ -29,6 +29,7 @@
   "CVE-2026-42154": (PROMETHEUS_PURL, "not_affected", "vulnerable_code_not_in_execute_path"),
   "CVE-2026-32286": (PGPROTO_PURL, "fixed", None),
   "CVE-2026-53615": (UTIL_LINUX_PURL, "not_affected", "vulnerable_code_not_present"),
+  "CVE-2026-53613": (UTIL_LINUX_PURL, "not_affected", "vulnerable_code_not_present"),
   "CVE-2025-69720": (LIBTINFO_PURL, "not_affected", "vulnerable_code_not_present"),
 }
 
@@ -99,7 +100,13 @@ def verify_minimal_runtime() -> None:
   if not required <= package_names or forbidden & package_names:
     fail("minimal runtime package inventory does not match the VEX evidence")
   assembler = (ROOT / "scripts/assemble-runtime-rootfs.sh").read_text(encoding="utf-8")
-  for forbidden_path in ("/usr/bin/blkid", "/usr/bin/findmnt", "/usr/bin/infocmp", "/usr/bin/mount", "/usr/bin/mv"):
+  if "/usr/bin/setsid" not in assembler:
+    fail("the reviewed util-linux setsid executable is absent from the runtime assembler")
+  for forbidden_path in (
+    "/bin/mount", "/bin/umount", "/usr/bin/blkid", "/usr/bin/findmnt",
+    "/usr/bin/infocmp", "/usr/bin/mount", "/usr/bin/mv", "/usr/bin/umount",
+    "/etc/fstab",
+  ):
     if forbidden_path in assembler:
       fail(f"forbidden executable entered the runtime assembler: {forbidden_path}")
   entrypoint = (ROOT / "entrypoint.sh").read_text(encoding="utf-8")
@@ -116,6 +123,10 @@ def main() -> None:
   document = json.loads(VEX.read_text(encoding="utf-8"))
   if document.get("@context") != "https://openvex.dev/ns/v0.2.0":
     fail("unexpected OpenVEX context")
+  if document.get("@id") != "https://github.com/Ratio1/r1-meshdb/security/vex/3":
+    fail("unexpected OpenVEX document identity")
+  if document.get("version") != 3 or document.get("timestamp") != "2026-08-24T00:00:00Z":
+    fail("unexpected OpenVEX document version or timestamp")
   statements = document.get("statements")
   if not isinstance(statements, list) or len(statements) != len(EXPECTED):
     fail(f"the reviewed VEX allowlist must contain exactly {len(EXPECTED)} statements")

security/openvex.json

@@ -1,10 +1,10 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/Ratio1/r1-meshdb/security/vex/2",
+  "@id": "https://github.com/Ratio1/r1-meshdb/security/vex/3",
   "author": "Ratio1",
   "role": "Project Maintainer",
-  "timestamp": "2026-08-13T00:00:00Z",
-  "version": 2,
+  "timestamp": "2026-08-24T00:00:00Z",
+  "version": 3,
   "statements": [
     {
       "vulnerability": {
@@ -58,6 +58,23 @@
       "justification": "vulnerable_code_not_present",
       "impact_statement": "The minimal runtime retains only the setsid executable from util-linux. The vulnerable DOS/EBR parser, libblkid, blkid, findmnt, mount, and related libraries and utilities are absent; mount checks read /proc/self/mountinfo directly."
     },
+    {
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53613",
+        "aliases": [
+          "CVE-2026-53613",
+          "GHSA-8gj5-72r3-428g"
+        ]
+      },
+      "products": [
+        {
+          "@id": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64&distro=debian-12.15"
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "The advisory affects target-path handling in the setuid mount executable for restricted user mounts. The scratch runtime retains only non-setuid setsid from util-linux; mount, umount, libmount, /etc/fstab, and the vulnerable restricted-mount path are absent."
+    },
     {
       "vulnerability": {
         "@id": "https://nvd.nist.gov/vuln/detail/CVE-2025-69720",

source/manifest.sha256

@@ -5,17 +5,17 @@ f53d3da2d034b1db8cf6c3d4120c43ec798a5b1b452ca77ecb51576fc994b21d  .github/workfl
 80b25ad118eb48ad5e2be32ab3907af79db693cc65b43c594ad7b441f55cc413  .github/workflows/release.yml
 5f2507148965114df76e05ddecb25ea419400fd9f655d71dd7d13eee226a51bd  .github/workflows/security.yml
 696452e46b8506219542eb7135c99419725055c59bd15e00e610d567d3a67ac6  .gitignore
-fe73738d8611a7a6f2c6cfb90c848e2199af7c2bad05e8c40275b8dc8b0efab7  Dockerfile
+c5dab4bd464d9c0863a2ab145bd099c4f6198154794bd666dffdc98123a78b17  Dockerfile
 24f9c32c2d3b165c1f9eb4a8aa2c582412a06b3c0c4630f9c77c4f5a6c3937e5  LICENSE
 3b6f0ea03562d9a53a5dec4368f3fcbf430838864b013b621ccf073bbf9bb491  LICENSE-OVERVIEW.md
 9f5fb5115fa01cca145ce84aff62b18dce1b82aa2669e8baedfbd97aed42eece  NOTICE
-66ed08f41b98e465071d5fd64e33bdd0d5bbeeb1ba565a6550850c39057d43a9  RATIO1_PATCHES.md
-9609cd2fe80166c706d8cfe7d7ff5d028da849aa64df2fe7336e25043d784a2b  README.md
-078ae6302a32334836cf3176d893cf2a897298be1a74ae455ffec3654d49481a  RELEASE.md
-721ec5da580a2c21118a9a97735bf224f5571266c1ad11fbf3924e2067f05309  SECURITY.md
+87386d236812d697c7e4d741e7deab320fd69187501d266342e8a9f03d12bbb8  RATIO1_PATCHES.md
+2d75ebbd0369485a2b02fce6bcc6e39470b7e74a8b8a35877178555a75fd1258  README.md
+c713e9665407ec776e5885aa9fc01143f9e63d31d4705a2637cbf78d01f1ace4  RELEASE.md
+2bf24acbee39171fa61310bd6029b74f129e1e3789b43541e5af6d5c95a6f31c  SECURITY.md
 aeecf7c915eaf76e40f6300914882f549e9197834c9c5adc8dfd1f3ab7f510a6  THIRD_PARTY_NOTICES.md
 39a1ee86d8fbafc075c6d2a9d458357981b77e65635316dce3da7308ecc844e0  UPSTREAM.md
-59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03  VERSION
+44e161e4495cac2cf7858043e9e6418e9579f0ddcfae826f9a372622968ce066  VERSION
 43f782e23df565c0f003c45dae70b25788c6fc0266a87f8624a157b499a8aac8  engine/AUTHORS
 4878f51f258335f9b8e05fbe13f1e493ecc44c1529349138c1f35827ef68d244  engine/c-deps/geos/.astylerc
 1da34ccd7c91feb23926b911c31b62b60e9b7523ed05f2c62a8e82facf1d3f31  engine/c-deps/geos/.azure-pipelines.yml
@@ -12102,11 +12102,11 @@ dff91cbe165fefadab40161cbbc06d1d232a8092d6e31f78cb9e33d26ca6a278  scripts/verify
 41a3d3bc669d6fcd6faed578fabe56b3f0e395447b6c4702842f92beb6eed380  scripts/verify-public-test-fixtures.py
 3c7d65f185259095487e33113e58c509c22988ba4f10b9537d1e0b499e4ad75e  scripts/verify-runtime-closure.py
 205776262119fab936cf1864826d4a83dc3e53d95e375e7c453d2c5e6b32a193  scripts/verify-sbom.py
-3c9aafbbdd41847686cf166eb1807c56cf11be40359c61c96d33a0e32712a8a6  scripts/verify-security-vex.py
+00ad7e50069650b15ffb195b2da459fde6b1dbb01ec7d4a13c5690fa61adfe28  scripts/verify-security-vex.py
 e1e02a95c6cf4f0a28e613d39cc303e2c5ceac9ea83535b7cb20a46e408253bd  scripts/verify-source-boundary.py
 452fe4191ad30a2eb15b9de04cf30b4b91015b7fb169cceaec15492d94c25101  scripts/verify-upstream-provenance.sh
 0add13007694c5ac630a4311e65e797daee726ba82589ea8991564e209faf019  scripts/verify-vendor-provenance.go
-05a9d923e44e8296fd5a5a14cd9f6139b4d9058d5c90cd839cff9820a7b41337  security/openvex.json
+615cf7ad7d143b290a4666b7b9a82535877521fd83959639b61b74bec19d6f9f  security/openvex.json
 ad4e90969340d12b88b835418aff3f1235fd02bec5d745a24ff94959621cc23e  source/cloudflared-buildinfo.txt
 e9bbbf63fd90e29f7c1922ffec04b800ace20b3c3cbd284c2ee9a58f511b49e9  source/cloudflared-compiled-packages.txt
 e9f1ede5da65e8036fe18e487d48e3068f311810d6af156e36943823d54a85c9  source/cloudflared-license-inventory.csv
@@ -12140,5 +12140,5 @@ c7bacb9dffc56a0411b55022538de645e5fa8fb18455e397d782366a9d371114  tests/runtime-
 8e321ca8065577c96f3dfa35c96deb21771a001c76775ac2ecc7295a316ad2a3  tests/runtime-supervision/tail-test-stub.sh
 91b1138b515c45788533118b27f08efd49013e6e9806166580d6e14e2d8c0680  tests/test_cloudflare_cleanup_recovery.py
 7be07ef767a2132c79ae431847edce048b935aae4fc5e71fc938005a16460a23  tests/test_cloudflare_ephemeral_tunnels.py
-e2924e1348f45c38df1a625b9792346fea1145144dda2a6c337a71458f465e06  tests/test_release_contract.py
+932d5f294d3880ff3a6a209466a9c5f74d854a70aa2a0b3b842f87af0eddb9d0  tests/test_release_contract.py
 a52e62e437de00e1504c383419056e96cddf18b15a85e0053f63136184bb7722  tests/test_sbom_contract.py

tests/test_release_contract.py

@@ -474,7 +474,7 @@ def test_repository_identity_is_r1_meshdb_everywhere(self):
       f'baseline_repository != "{source_url}.git"',
       read("scripts/verify-provenance.py"),
     )
-    self.assertEqual(json.loads(read("security/openvex.json"))["@id"], f"{source_url}/security/vex/2")
+    self.assertEqual(json.loads(read("security/openvex.json"))["@id"], f"{source_url}/security/vex/3")
     self.assertEqual(
       json.loads(read("source/ratio1-engine-overrides.json"))["dependencySnapshot"]
       ["sourceBaseline"]["repository"],
@@ -1430,6 +1430,36 @@ def test_security_vex_is_narrow_and_evidenced(self):
       text=True,
     )
 
+  def test_mount_target_toctou_vex_matches_minimal_runtime(self):
+    cve = "CVE-2026-53613"
+    vex = json.loads(read("security/openvex.json"))
+    statements = [
+      statement for statement in vex["statements"]
+      if statement["vulnerability"]["@id"].endswith(cve)
+    ]
+    self.assertEqual(len(statements), 1)
+    self.assertEqual(statements[0]["status"], "not_affected")
+    self.assertEqual(
+      statements[0]["justification"],
+      "vulnerable_code_not_present",
+    )
+
+    verifier = read("scripts/verify-security-vex.py")
+    security_policy = read("SECURITY.md")
+    self.assertIn(cve, verifier)
+    self.assertIn(cve, security_policy)
+
+    assembler = read("scripts/assemble-runtime-rootfs.sh")
+    self.assertIn("/usr/bin/setsid", assembler)
+    for forbidden_path in (
+      "/bin/mount",
+      "/bin/umount",
+      "/usr/bin/mount",
+      "/usr/bin/umount",
+      "/etc/fstab",
+    ):
+      self.assertNotIn(forbidden_path, assembler)
+
   def test_runtime_and_local_testbed_are_present(self):
     required = (
       "entrypoint.sh",