Build matrix
Provenance for every image this project’s pipeline built — its SBOM, signature/attestation status, vulnerability findings, and applied dependency overrides. Generated from the pipeline’s build-matrix results; see How it fits together and Signing & provenance.
GitLab release: 19.2.1
Image spec: linux/amd64 · OCI
Images (0)
No image build results were available when this site was generated.
VEX & vulnerability governance (0)
No VEX statements or allowlist entries for this release.
Dependency overrides (1)
| Package | Version | Reason |
|---|---|---|
openssl | — | The pinned nixpkgs ships OpenSSL 3.6.2, which is Critical-vulnerable to CVE-2026-34182 (CMS AuthEnvelopedData input-validation bypass). The fix is released upstream in 3.6.3, so per AGENTS.md RULE 1 this is fixed (bumped to the 3.6.3 release tarball from source in overlays/overrides.nix), not allowlisted. FIPS artifacts use BoringSSL, not OpenSSL, and CVE-2026-34182 does not affect FIPS modules; the only OpenSSL in the FIPS closure is build-time tooling. |
This page is generated at site-build time from the pipeline’s data.json; it is present only when build-matrix results were available.