Tracking: annotate homebrew-core patches with resolves (CVE suppression)

[p-linnane]

Backfilling patch resolves annotations in homebrew-core so brew vulns can suppress CVEs already fixed by a shipped patch. Follows discussion #6869 and the demo in Homebrew/homebrew-core#285534.

Each annotation removes one real false positive from scan output, so we drive from the scanner rather than a heuristic sweep: a sample of 59 upstream-commit patches found zero CVE references (core patches are mostly build fixes), and grepping for CVE strings would mislabel outstanding CVEs as patched.

Process

1. Run brew vulns over core on the suppression branch (Suppress vulnerabilities resolved by formula patches #92).
2. For each reported CVE: real and unpatched → leave it; fixed by a shipped patch → add resolves "CVE-..." to the patch in homebrew-core in a syntax-only PR.
3. Re-run and confirm it suppresses; link before/after in the PR.

resolves "CVE-X" means this shipped patch fixes CVE-X in the bottle — not an outstanding/unfixed CVE, a version-bump fix, or an ENV mitigation.

Dependencies

• Suppress vulnerabilities resolved by formula patches #92 (PR) — suppression; the whole loop needs this merged.
• Query OSV for formulae without GitHub/GitLab/Codeberg source URLs #93 (issue) — forge coverage. All six current annotations sit on unsupported forges (SourceForge/GNU/etc.), so none can be validated until this lands. Formulae on GitHub/GitLab/Codeberg with a tagged release are queryable without it.

Already annotated

libquicktime, innoextract (explicit resolves); glibc, unzip, zip, lrzsz (filename-inferred).

Checked, not candidates

avahi, openslp, sylpheed, opentsdb, dpkg mention a CVE in source, but it's version rationale or an ENV mitigation, not a patch fix. Listed so we don't re-check them.

Working set

Per-patch inventory (798 formulae, 1,183 patches: formula, source kind, current resolves status) attached for reference. The scanner output is what drives which patches get annotated.

patch-inventory.csv

[andrew]

First scanner-driven pass, run from the #97 branch so non-forge head URLs are included.

Of the 798 patched formulae, 484 are queryable; 314 are still skipped (no forge URL, no tag: stable, no head). OSV returned hits for 9 of the 484. Triage:

formula	OSV hits	shipped patch	verdict
augeas 1.14.1	CVE-2025-2588, OSV-2020-1540	26d2978 compiler-warning cleanup	not patched
boost 1.90.0	OSV-2024-112, OSV-2024-914	9ac89e9 (boostorg/range; vulns are in graph/regex)	not patched
flex 2.6.4	CVE-2019-6293	shared libtool/configure-big_sur.diff	not patched
jerryscript 3.0.0	46 CVEs (CVE-2021-44988 … CVE-2024-33260)	e8948ac macOS rpath build fix	not patched
mp4v2 2.1.3	CVE-2023-33716/7/8/9	shared libtool/configure-big_sur.diff	not patched
mpv 0.41.0	OSV-2026-728	75b2ccf VapourSynth R74 compat	not patched
mupen64plus 2.6.0	CVE-2025-9688 (in -core)	1cab2e6 (-ui-console)	not patched
pcl 1.15.1	OSV-2022-795	three commits, all Eigen/Boost/VTK build compat	not patched
yajl 2.1.0	CVE-2023-33460	6fe59ca CMake 4 compat	not patched

No resolves annotations to add from this set; every shipped patch is a build/portability fix, which matches the earlier 0/59 sample. The 60 findings above are real (unpatched in the bottle).

On the dependency side: even with #97, five of the six already-annotated formulae (glibc, libquicktime, lrzsz, unzip, zip) remain unqueryable because they have no head block, so their suppressions still can't be observed end-to-end. Only innoextract becomes queryable, and OSV returns nothing for it. The 314 skipped patched formulae are the next thing to chase, via head additions in homebrew-core; full list below.

314 patched formulae still not queryable (need `head` or `tag:` stable)

aalib aamath activemq-cpp aften ahcpd aircrack-ng aldo argtable aspell aubio autoconf-archive autogen autossh avanor aview bacula-fd bash-completion beecrypt berkeley-db berkeley-db@4 berkeley-db@5 bochs bonnie++ bsdiff bsdsfv btrfs-progs c-kermit cgit chmlib chrony cityhash classads cloudiscovery cmockery cmuclmtk conan@1 cpptest csvtomd cubelib cvs daemontools damask-grid dante darcs dbxml deark dirac dmg2img dnstracer doublecpp dovecot dpkg dvd+rw-tools dvdbackup dvdrtools easy-tag efl exiftran expect ext2fuse fdclone ffmpeg@5 ffmpeg@6 flickcurl flow-tools fortune fox fpc fragroute freealut freedink freeipmi ftgl gcc@11 gcc@12 gcc@13 gcc@14 gcc@15 gcl gdl geomview ghc@9.12 ghc@9.2 ghc@9.4 ghc@9.6 ghc@9.8 gibbslda gimmecert gitless glib glibc glibc@2.13 glibc@2.17 gloox glpk gnome-recipes gnu-barcode gnu-complexity gnu-getopt gnu-typist gnutls go@1.24 gobject-introspection gocr goocanvas graph-tool gtk+ gtkglext gts gwenhywfar gxml hspell ht htmlcxx httrack id3lib idutils ifstat imap-uw instalooter ircd-irc2 john john-jumbo jxrlib kyoto-cabinet kyoto-tycoon lbzip2 lemon libagg libart libcmph libcroco libcsv libdaemon libdc1394 libdsk libdv libestr libetonyek libev libftdi libgda libgetdata libicns libiconv libmatio libmemcached libmng libmodplug libmpd libnatpmp libnice-gstreamer libnids liboauth liboping libosinfo libotr libpano libpcl libprelude libquicktime librasterlite2 libshout libsoxr libsvg libsvg-cairo libu2f-server libwpd libxaw libxaw3d libxspf lightning log4shib lrzsz lua lua@5.4 lzlib madplay makeicns malbolge mcpp mjpegtools mmix mp3check mp3info mpack mpg321 msdl musepack mysql mysql@8.0 mysql@8.4 nacl ncmpc netcat netris nload node@18 nvi nyx ocaml@4 oggz ogmtools one-ml open-sp openldap openmotif openslp oscats ossp-uuid otf2 owamp p0f pbc-sig pbzip2 pcre percona-server percona-server@8.0 percona-xtrabackup percona-xtrabackup@8.0 php@8.1 php@8.2 php@8.3 png2ico pngcrush ppl principalmapper proctools pypy3.11 python-freethreading python-tk@3.12 python-tk@3.13 python@3.10 python@3.11 python@3.12 python@3.13 python@3.14 python@3.9 qrupdate qt@5 qwt qwt-qt5 raptor rasqal readline recutils redland renameutils rig rlog rxvt-unicode samba sblim-sfcc scheme48 sendemail sgr shivavg slashem sloccount source-highlight sox spandsp spice-gtk spidermonkey@115 sqliteodbc srecord style-check swftools sword sylpheed takt tarsnapper tgif tinc tinysvm tractorgen truecrack ttyrec twtxt ucommon ucspi-tcp udis86 uggconv unac uni2ascii uniutils unzip urlview usbutils util-linux uudeview vcdimager vera++ vip vncsnapshot vsftpd vstr webfs wmctrl wordplay wput wv2 xaric xml-security-c xmlstarlet xplanet xvid yamcha yconalyzer ykpers zig zig@0.14 zig@0.15 zip

[andrew]

Looked at adding head blocks to make the 314 skipped formulae queryable. It doesn't get us where we want for the five already-annotated ones:

• unzip, zip, lrzsz, libquicktime are dead upstreams with no git repo to point a head at, and their CVEs in OSV are bare NVD imports with no affected[].package data, so no repo URL would return them anyway.
• glibc has a real repo but is deliberately pinned at 2.39; a head block would imply --HEAD builds are supported, which they aren't here. And nine of its ten resolved CVEs are also bare NVD imports.

So the gate on validating those annotations is OSV-side, not Homebrew-side. The annotations are still correct and feed CycloneDX; they just can't be round-tripped through a repo query.

For the wider 314, a head block is a functional change (brew install --HEAD must work), not syntax-only, so it's per-formula work. Given the 484 already-queryable patched formulae produced zero resolves matches, more queryable formulae would most likely produce more of the same.

Added a homepage fallback to #97 instead, which picks up another 277 formulae across core (19 of the patched 314, including util-linux and mysql) with no homebrew-core changes.

I think that closes out the scanner-driven pass. Any further resolves annotations will come from manual inspection (CVE in a patch comment or distro patch header) rather than from scanner output, and the dead-upstream cases point at the Homebrew OSV ecosystem feed idea from discussion #6869.

[andrew]

Dug further for annotations the scanner can't find:

angle	checked	result
OSV query by commit SHA	486 GitHub-commit patches	10 hits, all "commit on affected branch" — none are the recorded fix-commit
Debian-tarball apply lists	9 formulae	nvi → CVE-2015-2305 via 31regex_heap_overflow.patch (DEP-3 header → Debian bug 778412)
security keywords in patch refs	1183 patches	id3lib vbr-overflow (no CVE assigned), xml-security-c (package name only)
CVE- grep over all formula sources	Formula/**/*.rb	nothing beyond the known set
CVE- grep over local Patches/	171 files	nothing
docbook-xsl stack_fix	DEP-3 + Debian bug 750593	no CVE assigned

One new annotation: nvi → Homebrew/homebrew-core#290337.

The OSV-by-commit result is worth noting: a {"commit": sha} query returns vulns whose affected range contains the commit, not vulns the commit fixes, so it surfaces patches applied on still-vulnerable branches (e.g. ffmpeg@5's SVT-AV1 compat patch returns 28 ffmpeg CVEs). To use it for fix-commit detection you'd have to pull each returned record and check whether the SHA appears in affected[].ranges[].events[].fixed, which it didn't for any of the 10.

[andrew]

Re-ran on main now that #92, #97 (with the homepage fallback) and the nvi annotation (Homebrew/homebrew-core#290337) have all merged.

Of the 314 previously-skipped patched formulae, 20 are now queryable via a forge URL in homepage; 294 remain skipped. OSV returned nothing for any of the 20, so no triage and no new annotations.

20 newly queryable via homepage

formula	repo
cityhash	https://github.com/google/cityhash
cloudiscovery	https://github.com/Cloud-Architects/cloudiscovery
cmockery	https://github.com/google/cmockery
cpptest	https://github.com/cpptest/cpptest
csvtomd	https://github.com/mplewis/csvtomd
freealut	https://github.com/vancegroup/freealut
gnu-getopt	https://github.com/util-linux/util-linux
instalooter	https://github.com/althonos/instalooter
lbzip2	https://github.com/kjn/lbzip2
libart	https://github.com/armon/libart
mysql	https://github.com/mysql/mysql-server
mysql@8.0	https://github.com/mysql/mysql-server
mysql@8.4	https://github.com/mysql/mysql-server
principalmapper	https://github.com/nccgroup/PMapper
rlog	https://github.com/vgough/rlog
swftools	https://github.com/swftools/swftools
tarsnapper	https://github.com/miracle2k/tarsnapper
truecrack	https://github.com/lvaccaro/truecrack
twtxt	https://github.com/buckket/twtxt
util-linux	https://github.com/util-linux/util-linux

The zero-hit result for swftools, mysql and util-linux is the same NVD-import shape noted earlier: their CVEs in OSV carry no affected[].package git URL, so a GIT-ecosystem query can't match them.

libart is a data error in core: its homepage points at armon/libart (an adaptive radix tree) but the formula builds GNOME's libart_lgpl. No findings resulted, but the derived repo URL is wrong.

That exhausts the scanner-driven pass. Net result across all of it: one annotation (nvi). Further resolves entries will come from manual inspection or distro-patch cross-referencing; the dead-upstream cases are covered by the --osv-export feed (#99).