chore: Enhance documentation for E2E testing:
- Added clarity and structure to README files, including recent updates and getting started sections. - Improved manual verification documentation for CrowdSec authentication, emphasizing expected outputs and success criteria. - Updated debugging guide with detailed output examples and automatic trace capture information. - Refined best practices for E2E tests, focusing on efficient polling, locator strategies, and state management. - Documented triage report for DNS Provider feature tests, highlighting issues fixed and test results before and after improvements. - Revised E2E test writing guide to include when to use specific helper functions and patterns for better test reliability. - Enhanced troubleshooting documentation with clear resolutions for common issues, including timeout and token configuration problems. - Updated tests README to provide quick links and best practices for writing robust tests.
This commit is contained in:
@@ -21,6 +21,7 @@ This document provides formal acceptance and risk assessment for vulnerabilities
|
||||
**Decision**: Temporary acceptance pending Alpine Linux migration (already planned).
|
||||
|
||||
**Rationale**:
|
||||
|
||||
- CrowdSec LAPI authentication fix is CRITICAL for production users
|
||||
- CVEs are in Debian base packages, NOT application code
|
||||
- CVEs exist in `main` branch (blocking fix provides zero security improvement)
|
||||
@@ -30,6 +31,7 @@ This document provides formal acceptance and risk assessment for vulnerabilities
|
||||
**Mitigation Plan**: Full Alpine migration (see `docs/plans/alpine_migration_spec.md`)
|
||||
|
||||
**Expected Timeline**:
|
||||
|
||||
- Week 1 (Feb 5-8): Verify Alpine CVE-2025-60876 is patched
|
||||
- Weeks 2-3 (Feb 11-22): Dockerfile migration + testing
|
||||
- Week 4 (Feb 26-28): Staging validation
|
||||
@@ -40,6 +42,7 @@ This document provides formal acceptance and risk assessment for vulnerabilities
|
||||
**Detailed Security Advisory**: [`advisory_2026-02-04_debian_cves_temporary.md`](./advisory_2026-02-04_debian_cves_temporary.md)
|
||||
|
||||
**Affected CVEs**:
|
||||
|
||||
| CVE | CVSS | Package | Status |
|
||||
|-----|------|---------|--------|
|
||||
| CVE-2026-0861 | 8.4 | libc6 | No fix available → Alpine migration |
|
||||
@@ -48,6 +51,7 @@ This document provides formal acceptance and risk assessment for vulnerabilities
|
||||
| CVE-2026-0915 | 7.5 | libc6 | No fix available → Alpine migration |
|
||||
|
||||
**Approval Record**:
|
||||
|
||||
- **Security Team**: APPROVED (temporary acceptance with mitigation) ✅
|
||||
- **QA Team**: APPROVED (conditions met) ✅
|
||||
- **DevOps Team**: APPROVED (Alpine migration feasible) ✅
|
||||
@@ -77,6 +81,7 @@ PR #461 supply chain scan identified **9 vulnerabilities** in Alpine Linux 3.23.
|
||||
**Decision**: All vulnerabilities are **ACCEPTED** pending upstream Alpine Security Team patches. No application-level vulnerabilities were found.
|
||||
|
||||
**Rationale**:
|
||||
|
||||
- All CVEs are Alpine OS package issues, not Charon application code
|
||||
- No patches available from Alpine upstream as of 2026-01-13
|
||||
- Low exploitability in containerized deployment environment
|
||||
|
||||
Reference in New Issue
Block a user