omp-docs/reports/fleet-security-audit-2026-10-21.html — the audit: verdict, scope/method,
findings register (10 rows), per-host detail for blankpad / Dankclaw / Dankserver, LAN
exposure map, container image census, advisory cross-reference (previously a stub marked
"in progress"), remediation plan and the caveats-and-refutations list. The header now links
the two working files below.
omp-docs/reports/vuln-dankclaw.md, omp-docs/reports/vuln-dankserver.md — the
per-host CVE/GHSA working pages the report's evidence cells rest on; now carry OKF
frontmatter so the bundle linter accepts them.
omp-docs/reports/index.md, the ## Reports entry in omp-docs/index.md, and the
matching omp-docs/log.md entry.
Numbers this commit corrects
Claim
Was
Now
Cause
Mutable container tags
17 on Dankclaw
19 of 33 manifests / 17 unique references; +4 of 12 on Dankserver
Recounted from Image= lines; the vuln page's 24 also counts rolling release tags
Dankserver OpenSSH advisories
0
5 unpatched CVEs at 1:10.2p1-2ubuntu3.8
The first OSV query dropped the version epoch — OSV answers 0 vulns, not "unknown", for a malformed purl
Plex version
12.1.0
1.43.5.11029-6bf8af3f0-ls329
12.1.0 is Jellyfin's version
Also repairs a malformed <code*-security*</code> tag in the same evidence cell.
Verification
./scripts/kb-lint.sh omp-docs → 0 violation(s); python3 scripts/kb-coverage.py omp-docs
→ 0 issue(s) — run against the shipped tree directly, because the bats suite alone lints
fixtures, not these pages.
Every corrected figure re-probed against the boxes; commands recorded in the vuln pages.
Read-only pass: no service restarts, no package installs, no /etc edits.
## What lands
- **`omp-docs/reports/fleet-security-audit-2026-10-21.html`** — the audit: verdict, scope/method,
findings register (10 rows), per-host detail for blankpad / Dankclaw / Dankserver, LAN
exposure map, container image census, advisory cross-reference (previously a stub marked
"in progress"), remediation plan and the caveats-and-refutations list. The header now links
the two working files below.
- **`omp-docs/reports/vuln-dankclaw.md`**, **`omp-docs/reports/vuln-dankserver.md`** — the
per-host CVE/GHSA working pages the report's evidence cells rest on; now carry OKF
frontmatter so the bundle linter accepts them.
- **`omp-docs/reports/index.md`**, the `## Reports` entry in `omp-docs/index.md`, and the
matching `omp-docs/log.md` entry.
## Numbers this commit corrects
| Claim | Was | Now | Cause |
|---|---|---|---|
| Mutable container tags | 17 on Dankclaw | 19 of 33 manifests / 17 unique references; +4 of 12 on Dankserver | Recounted from `Image=` lines; the vuln page's 24 also counts rolling release tags |
| Dankserver OpenSSH advisories | 0 | 5 unpatched CVEs at `1:10.2p1-2ubuntu3.8` | The first OSV query dropped the version epoch — OSV answers `0 vulns`, not "unknown", for a malformed purl |
| Plex version | 12.1.0 | `1.43.5.11029-6bf8af3f0-ls329` | 12.1.0 is Jellyfin's version |
Also repairs a malformed `<code*-security*</code>` tag in the same evidence cell.
## Verification
- `./scripts/kb-lint.sh omp-docs` → `0 violation(s)`; `python3 scripts/kb-coverage.py omp-docs`
→ `0 issue(s)` — run against the shipped tree directly, because the bats suite alone lints
fixtures, not these pages.
- Every corrected figure re-probed against the boxes; commands recorded in the vuln pages.
- Read-only pass: no service restarts, no package installs, no `/etc` edits.
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.
Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.
kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
dank
merged commit 8c3dc6bfc9 into main2026-10-21 14:56:07 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What lands
omp-docs/reports/fleet-security-audit-2026-10-21.html— the audit: verdict, scope/method,findings register (10 rows), per-host detail for blankpad / Dankclaw / Dankserver, LAN
exposure map, container image census, advisory cross-reference (previously a stub marked
"in progress"), remediation plan and the caveats-and-refutations list. The header now links
the two working files below.
omp-docs/reports/vuln-dankclaw.md,omp-docs/reports/vuln-dankserver.md— theper-host CVE/GHSA working pages the report's evidence cells rest on; now carry OKF
frontmatter so the bundle linter accepts them.
omp-docs/reports/index.md, the## Reportsentry inomp-docs/index.md, and thematching
omp-docs/log.mdentry.Numbers this commit corrects
Image=lines; the vuln page's 24 also counts rolling release tags1:10.2p1-2ubuntu3.80 vulns, not "unknown", for a malformed purl1.43.5.11029-6bf8af3f0-ls329Also repairs a malformed
<code*-security*</code>tag in the same evidence cell.Verification
./scripts/kb-lint.sh omp-docs→0 violation(s);python3 scripts/kb-coverage.py omp-docs→
0 issue(s)— run against the shipped tree directly, because the bats suite alone lintsfixtures, not these pages.
/etcedits.cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Fold the Dankclaw and Dankserver vulnerability passes into fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in progress)" section becomes the full matrix (host advisories, GHSA coverage, image-vulnerability matrix, no-advisory census, observed-without-credentials rows for the two livingroom hosts) and the header links the two working files, which move into omp-docs/reports/ with an index of their own. Correct three figures the audit had wrong, all found by re-probing: the mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the first OSV query omitted the version epoch, and OSV answers "0 vulns" rather than "unknown" for a malformed purl), and the Plex version ("12.1.0" is Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also repair a malformed <code> tag in F1's evidence cell. kb-lint and kb-coverage both report 0 issues; index.md gains the Reports section and log.md the matching entry.