Frank
27da5cd9ec
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.
Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.
kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
1.1 KiB
1.1 KiB
Reports
Dated audit artifacts: one file per investigation. HTML files are the rendered reports, markdown
pages are the working data they were built from. The bundle-wide work log stays in
../log.md — a report is an artifact, not a log.
| File | Type | Description |
|---|---|---|
| fleet-security-audit-2026-10-21.html | report | Fleet security audit (blankpad, Dankclaw, Dankserver, LAN edge): findings register, per-host detail, LAN exposure map, container image pinning census, advisory cross-reference, remediation. |
| vuln-dankclaw.md | reference | CVE/GHSA pass for the 33 Dankclaw quadlet images and the Ubuntu 26.04 host — the evidence base the audit's Dankclaw rows rest on. |
| vuln-dankserver.md | reference | CVE/GHSA pass for Dankserver (containers + host), blankpad's Arch package set, and danklivingroom's OpenSSH. |
| sleep-wake-investigation-report.html | report | blankpad suspend/resume investigation, 2026-09-28. |