Merge remote-tracking branch 'origin/source-build'

built from commit 645a79846b
 dated 2026-06-01 20:56:45 +0000
 by github-actions[bot] (41898282+github-actions[bot]@users.noreply.github.com)

.github/workflows/autoupdate.yml

@@ -13,7 +13,7 @@ jobs:
   autoupdate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           ref: source
       - name: Install prerequisites

.github/workflows/release.yml

@@ -1,181 +0,0 @@
-name: release
-
-# Manual, path-scoped release helper for master.
-#
-# `master` is BOTH the distribution branch (users download the script here)
-# AND the default branch that hosts the scheduled CI workflows
-# (autoupdate / stale / vuln-watch). `source-build` is a build-OUTPUT branch.
-#
-# We therefore never merge source-build into master: that would drag source-build's
-# whole tree, including the *absence* of the master-only workflows.
-# Instead we copy only the assembled artifact files across, and cut GitHub
-# releases from master directly.
-#
-# Two independent manual actions to run against the `master` branch:
-#
-#   1. sync-from-source-build : open a PR against master carrying the assembled
-#                               files (everything on source-build EXCEPT
-#                               .github/). Nothing lands on master until the PR
-#                               is reviewed and merged.
-#   2. draft-github-release   : create a DRAFT GitHub release from the script
-#                               currently on master, with an auto-drafted
-#                               changelog.
-
-on:
-  workflow_dispatch:
-    inputs:
-      action:
-        description: What to do
-        type: choice
-        required: true
-        default: sync-from-source-build
-        options:
-          - sync-from-source-build
-          - draft-github-release
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: release-master
-  cancel-in-progress: false
-
-jobs:
-  # ---------------------------------------------------------------------------
-  # 1. Copy assembled files from source-build onto master (no .github/),
-  #    as a pull request.
-  # ---------------------------------------------------------------------------
-  sync-from-source-build:
-    if: inputs.action == 'sync-from-source-build'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: master
-          fetch-depth: 0
-          persist-credentials: true
-
-      - name: sync assembled files from source-build
-        id: sync
-        run: |
-          set -eu
-          git fetch --no-tags origin source-build
-
-          # Every top-level entry on source-build EXCEPT .github/ (master keeps
-          # its own CI). Computed dynamically so any new top-level artifact is
-          # picked up automatically.
-          readarray -t paths < <(git ls-tree --name-only origin/source-build | grep -vxF '.github')
-          echo "Syncing: ${paths[*]}"
-
-          # Mirror source-build exactly for those paths, removing first so that
-          # deletions/renames inside doc/ etc. propagate too.
-          for p in "${paths[@]}"; do rm -rf -- "$p"; done
-          git checkout origin/source-build -- "${paths[@]}"
-          git add --all -- "${paths[@]}"
-
-          if git diff --cached --quiet; then
-            echo "master already up to date with source-build; nothing to sync."
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          {
-            echo "changed=true"
-            echo "version=$(grep -m1 "^VERSION=" spectre-meltdown-checker.sh | cut -d"'" -f2)"
-            echo "sb=$(git rev-parse origin/source-build)"
-            echo "sbdate=$(git log -1 --format=%ai origin/source-build)"
-          } >> "$GITHUB_OUTPUT"
-
-      # Note: the repo must have "Allow GitHub Actions to create and approve
-      # pull requests" enabled for this to work.
-      - name: open the sync pull request
-        if: steps.sync.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v7
-        with:
-          base: master
-          branch: release/sync-from-source-build
-          delete-branch: true
-          committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          title: "release: sync v${{ steps.sync.outputs.version }} from source-build"
-          commit-message: |
-            release: sync v${{ steps.sync.outputs.version }} from source-build
-
-             built from source-build commit ${{ steps.sync.outputs.sb }}
-             dated ${{ steps.sync.outputs.sbdate }}
-          body: |
-            Assembled files copied from `source-build` onto `master` (everything
-            except `.github/`, which stays master-only).
-
-            - version: `${{ steps.sync.outputs.version }}`
-            - built from source-build commit: ${{ steps.sync.outputs.sb }}
-            - dated: ${{ steps.sync.outputs.sbdate }}
-
-            Once merged, run this workflow again with the `draft-github-release`
-            action to cut the release, if required.
-
-  # ---------------------------------------------------------------------------
-  # 2. Draft a GitHub release from the script currently on master.
-  # ---------------------------------------------------------------------------
-  draft-github-release:
-    if: inputs.action == 'draft-github-release'
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: master
-          fetch-depth: 0
-          persist-credentials: true
-
-      - name: draft a release from the current master script
-        run: |
-          set -eu
-          ver=$(grep -m1 "^VERSION=" spectre-meltdown-checker.sh | cut -d"'" -f2)
-          tag="v${ver}"
-
-          if gh release view "$tag" >/dev/null 2>&1; then
-            echo "A release for $tag already exists; refusing to recreate." >&2
-            echo "Delete it first if needed." >&2
-            exit 1
-          fi
-
-          # Draft the changelog from the source-build commits assembled since the
-          # previous published release. We locate the source-build commit whose
-          # built VERSION equals the last release tag, then list what came after.
-          git fetch --no-tags origin source-build
-          last_tag=$(gh release list --exclude-drafts --limit 1 --json tagName --jq '.[0].tagName // empty')
-          old_ver="${last_tag#v}"
-
-          base=""
-          if [ -n "$old_ver" ]; then
-            while read -r h; do
-              v=$(git show "$h:spectre-meltdown-checker.sh" 2>/dev/null | grep -m1 "^VERSION=" | cut -d"'" -f2 || true)
-              if [ "$v" = "$old_ver" ]; then base="$h"; break; fi
-            done < <(git rev-list --max-count=500 origin/source-build)
-          fi
-
-          {
-            echo "## ${tag}"
-            echo
-            if [ -n "$base" ]; then
-              git log --no-merges --format='- %s' "${base}..origin/source-build"
-            else
-              echo "_Could not determine the previous release point automatically — please fill in the changelog. Last 30 assembled commits below as a starting point:_"
-              echo
-              git log --no-merges --format='- %s' --max-count=30 origin/source-build
-            fi
-          } > notes.md
-
-          echo "----- draft notes -----"; cat notes.md; echo "-----------------------"
-
-          gh release create "$tag" \
-            --draft \
-            --target "$GITHUB_SHA" \
-            --title "$tag" \
-            --notes-file notes.md \
-            spectre-meltdown-checker.sh
-
-          echo "Draft release $tag created."

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ on:
       action:
         description: "dry-run"
         required: true
-        default: "apply"
+        default: "dryrun"
         type: choice
         options:
           - dryrun
@@ -30,7 +30,4 @@ jobs:
           days-before-close: 7
           stale-issue-label: stale
           remove-stale-when-updated: true
-          close-issue-reason: completed
-          stale-issue-message: "If there are no further comments or activity on this issue, it'll be closed automatically in 7 days."
-          close-issue-message: "Automatically closing this issue due to inactivity, don't hesitate to open a new issue if needed."
           debug-only: ${{ case(inputs.action == 'dryrun', true, false) }}

.github/workflows/vuln-watch.yml

@@ -45,14 +45,14 @@ jobs:
       # workflow file itself MUST stay on the default branch, as GitHub only
       # honors `schedule:` triggers on the default branch.
       - name: Checkout vuln-watch branch (scripts + prompt)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           ref: vuln-watch
           fetch-depth: 1
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: '3.12'
 
@@ -84,7 +84,7 @@ jobs:
 
       - name: Download previous state artifact
         if: steps.prev.outputs.run_id != ''
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v5
         continue-on-error: true   # tolerate retention expiry
         with:
           name: vuln-watch-state
@@ -115,7 +115,7 @@ jobs:
       # implemented?". Only fetched on days with something to classify.
       - name: Checkout checker code (test branch) for coverage grep
         if: steps.diff.outputs.new_count != '0' || steps.diff.outputs.reconsider_count != '0'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           ref: test
           path: checker
@@ -150,7 +150,7 @@ jobs:
 
       - name: Upload Claude execution log
         if: ${{ always() && steps.classify.outputs.execution_file != '' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: claude-execution-log-${{ github.run_id }}
           path: ${{ steps.classify.outputs.execution_file }}
@@ -168,7 +168,7 @@ jobs:
 
       - name: Upload new state artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: vuln-watch-state
           path: state/seen.json
@@ -177,7 +177,7 @@ jobs:
 
       - name: Upload daily report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: vuln-watch-report-${{ github.run_id }}
           path: |

spectre-meltdown-checker.sh

@@ -13,7 +13,7 @@
 #
 # Stephane Lesimple
 #
-VERSION='26.36.0730501'
+VERSION='26.36.0601873'
 
 # --- Common paths and basedirs ---
 readonly VULN_SYSFS_BASE="/sys/devices/system/cpu/vulnerabilities"
@@ -381,7 +381,6 @@ fi
     readonly INTEL_FAM6_ARROWLAKE_U=$((0xB5))
     readonly INTEL_FAM6_LUNARLAKE_M=$((0xBD))   # /* Lion Cove / Skymont */
     readonly INTEL_FAM6_PANTHERLAKE_L=$((0xCC)) # /* Cougar Cove / Darkmont */
-    readonly INTEL_FAM6_PANTHERLAKE_R=$((0xE5)) # /* Cougar Cove / Darkmont */
     readonly INTEL_FAM6_WILDCATLAKE_L=$((0xD5))
     readonly INTEL_FAM18_NOVALAKE=$((0x01))            # /* Coyote Cove / Arctic Wolf */
     readonly INTEL_FAM18_NOVALAKE_L=$((0x03))          # /* Coyote Cove / Arctic Wolf */
@@ -1219,7 +1218,6 @@ is_cpu_affected() {
 06-c5-02/82,0000011b
 06-c6-02/82,0000011b
 06-bd-01/80,00000125
-06-55-07/bf,05003901
 06-55-0b/bf,07002b01
 06-8f-07/87,2b000661
 06-8f-08/87,2b000661
@@ -1382,9 +1380,9 @@ is_cpu_affected() {
             if [ -n "$cpupart" ] && [ -n "$cpuarch" ]; then
                 # Cortex-R7 and Cortex-R8 are real-time and only used in medical devices or such
                 # I can't find their CPU part number, but it's probably not that useful anyway
-                # model R7 R8 A8  A9  A12 A15 A17 A57 A72 A73 A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2 Neoverse-V3 Neoverse-V3AE
-                # part   ?  ? c08 c09 c0d c0f c0e d07 d08 d09 d0a d0b d0d d0c         d40	  d49	      d4f	  d84	      d83
-                # arch  7? 7? 7   7   7   7   7   8   8   8   8   8   8   8           8		  8	      8		  8	      8
+                # model R7 R8 A8  A9  A12 A15 A17 A57 A72 A73 A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2
+                # part   ?  ? c08 c09 c0d c0f c0e d07 d08 d09 d0a d0b d0d d0c         d40	  d49	      d4f
+                # arch  7? 7? 7   7   7   7   7   8   8   8   8   8   8   8           8		  8	      8
                 #
                 # Whitelist identified non-affected processors, use vulnerability information from
                 # https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
@@ -1435,13 +1433,13 @@ is_cpu_affected() {
                     _infer_immune variant3a
                     _set_vuln variant4
                     pr_debug "checking cpu$i: armv8 A76/A77/NeoverseN1 non affected to variant 2, 3 & 3a"
-                elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f -e 0xd84 -e 0xd83; then
+                elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f; then
                     _set_vuln variant1
                     _infer_immune variant2
                     _infer_immune variant3
                     _infer_immune variant3a
                     _infer_immune variant4
-                    pr_debug "checking cpu$i: armv8 NeoverseN2/V1/V2/V3/V3AE non affected to variant 2, 3, 3a & 4"
+                    pr_debug "checking cpu$i: armv8 NeoverseN2/V1/V2 non affected to variant 2, 3, 3a & 4"
                 elif [ "$cpuarch" -le 7 ] || { [ "$cpuarch" = 8 ] && [ $((cpupart)) -lt $((0xd07)) ]; }; then
                     _infer_immune variant1
                     _infer_immune variant2
@@ -1502,14 +1500,14 @@ is_cpu_affected() {
     # - arm64 (CVE-2020-13844): Cortex-A32/A34/A35/A53/A57/A72/A73 confirmed affected,
     #   and broadly all speculative Armv8-A cores. No kernel mitigation merged.
     #   Part numbers: A32=0xd01 A34=0xd02 A53=0xd03 A35=0xd04 A57=0xd07 A72=0xd08 A73=0xd09
-    #   Plus later speculative cores: A75=0xd0a A76=0xd0b A77=0xd0d N1=0xd0c V1=0xd40 N2=0xd49 V2=0xd4f V3=0xd84 V3AE=0xd83
+    #   Plus later speculative cores: A75=0xd0a A76=0xd0b A77=0xd0d N1=0xd0c V1=0xd40 N2=0xd49 V2=0xd4f
     if is_intel || is_amd; then
         _infer_vuln sls
     elif [ "$cpu_vendor" = ARM ]; then
         for cpupart in $cpu_part_list; do
             if echo "$cpupart" | grep -q -w -e 0xd01 -e 0xd02 -e 0xd03 -e 0xd04 \
                 -e 0xd07 -e 0xd08 -e 0xd09 -e 0xd0a -e 0xd0b -e 0xd0c -e 0xd0d \
-                -e 0xd40 -e 0xd49 -e 0xd4f -e 0xd84 -e 0xd83; then
+                -e 0xd40 -e 0xd49 -e 0xd4f; then
                 _set_vuln sls
             fi
         done
@@ -3938,18 +3936,11 @@ parse_cpu_details() {
         # cpu_variant_list and cpu_revision_list are consumed by ARM64 errata affection checks
         # that need to match a specific revision range.
         if grep -q 'CPU implementer' "$g_procfs/cpuinfo"; then
-            # keep these single-line (space-separated) so consumers and outputs (JSON, prometheus)
-            # don't end up with embedded newlines; per-core order is preserved for the errata checks
-            cpu_impl_list=$(awk '/CPU implementer/ {print $4}' "$g_procfs/cpuinfo" | tr '\n' ' ')
-            cpu_impl_list=${cpu_impl_list% }
-            cpu_part_list=$(awk '/CPU part/         {print $4}' "$g_procfs/cpuinfo" | tr '\n' ' ')
-            cpu_part_list=${cpu_part_list% }
-            cpu_arch_list=$(awk '/CPU architecture/ {print $3}' "$g_procfs/cpuinfo" | tr '\n' ' ')
-            cpu_arch_list=${cpu_arch_list% }
-            cpu_variant_list=$(awk '/CPU variant/   {print $4}' "$g_procfs/cpuinfo" | tr '\n' ' ')
-            cpu_variant_list=${cpu_variant_list% }
-            cpu_revision_list=$(awk '/CPU revision/ {print $4}' "$g_procfs/cpuinfo" | tr '\n' ' ')
-            cpu_revision_list=${cpu_revision_list% }
+            cpu_impl_list=$(awk '/CPU implementer/ {print $4}' "$g_procfs/cpuinfo")
+            cpu_part_list=$(awk '/CPU part/         {print $4}' "$g_procfs/cpuinfo")
+            cpu_arch_list=$(awk '/CPU architecture/ {print $3}' "$g_procfs/cpuinfo")
+            cpu_variant_list=$(awk '/CPU variant/   {print $4}' "$g_procfs/cpuinfo")
+            cpu_revision_list=$(awk '/CPU revision/ {print $4}' "$g_procfs/cpuinfo")
         fi
         # Map first-seen implementer to cpu_vendor; note that heterogeneous systems
         # (e.g. DynamIQ with ARM+Kryo cores) would all map to one vendor here, but
@@ -5060,12 +5051,6 @@ check_kernel_info() {
     fi
 }
 
-# Collapse a whitespace-separated list to its unique values, preserving first-seen order.
-# Used to prettify the per-core ARM lists for display (e.g. "0x41 0x41 0x41 0x41" -> "0x41").
-_uniq_list() {
-    echo "$1" | awk '{ for (i = 1; i <= NF; i++) if (!seen[$i]++) printf "%s%s", (n++ ? " " : ""), $i }'
-}
-
 # Display hardware-level CPU mitigation support (microcode features, ARCH_CAPABILITIES, etc.)
 check_cpu() {
     local capabilities ret spec_ctrl_msr codename ucode_str
@@ -5075,13 +5060,13 @@ check_cpu() {
         pr_info "  * Vendor: $cpu_vendor"
         pr_info "  * Model name: $cpu_friendly_name"
         if [ -n "${cpu_impl_list:-}" ]; then
-            pr_info "  * Implementer(s): $(_uniq_list "$cpu_impl_list")"
+            pr_info "  * Implementer(s): $cpu_impl_list"
         fi
         if [ -n "${cpu_part_list:-}" ]; then
-            pr_info "  * Part(s): $(_uniq_list "$cpu_part_list")"
+            pr_info "  * Part(s): $cpu_part_list"
         fi
         if [ -n "${cpu_arch_list:-}" ]; then
-            pr_info "  * Architecture(s): $(_uniq_list "$cpu_arch_list")"
+            pr_info "  * Architecture(s): $cpu_arch_list"
         fi
         if has_runtime; then
             pr_info_nol "  * Running as VM guest: "
@@ -13135,7 +13120,7 @@ exit 0                          # ok
 # with X being either I for Intel, or A for AMD
 # When the date is unknown it defaults to 20000101
 
-# %%% MCEDB v351+i20260512+16e5
+# %%% MCEDB v349+i20260512+1cce
 # I,0x00000611,0xFF,0x00000B27,19961218
 # I,0x00000612,0xFF,0x000000C6,19961210
 # I,0x00000616,0xFF,0x000000C6,19961210
@@ -13554,7 +13539,6 @@ exit 0                          # ok
 # I,0x000A06D0,0xFF,0x10000680,20240818
 # I,0x000A06D1,0x20,0x0A000142,20260129
 # I,0x000A06D1,0x95,0x01000423,20260129
-# I,0x000A06E0,0xFF,0x80000953,20240902
 # I,0x000A06E1,0x97,0x01000307,20260226
 # I,0x000A06F0,0xFF,0x80000360,20240130
 # I,0x000A06F3,0x01,0x030003A3,20260130
@@ -13584,11 +13568,8 @@ exit 0                          # ok
 # I,0x000C06C3,0x90,0x0000011B,20260324
 # I,0x000C06F1,0x87,0x210002E0,20251217
 # I,0x000C06F2,0x87,0x210002E0,20251217
-# I,0x000D0650,0xFF,0x00000009,20260309
-# I,0x000D0651,0xFF,0x00000009,20260309
-# I,0x000D0670,0xFF,0x00000137,20260218
-# I,0x000D06D0,0xFF,0x80000370,20250917
-# I,0x000D06D1,0xFF,0x01000120,20260325
+# I,0x000D0670,0xFF,0x00000003,20250825
+# I,0x000D06D0,0xFF,0x00000340,20250807
 # I,0x00FF0671,0xFF,0x0000010E,20220907
 # I,0x00FF0672,0xFF,0x0000000D,20210816
 # I,0x00FF0675,0xFF,0x0000000D,20210816
@@ -13685,13 +13666,13 @@ exit 0                          # ok
 # A,0x00880F40,0xFF,0x08804005,20210312
 # A,0x00890F00,0xFF,0x08900007,20200921
 # A,0x00890F01,0xFF,0x08900103,20201105
-# A,0x00890F02,0xFF,0x08900208,20241219
+# A,0x00890F02,0xFF,0x08900203,20230915
 # A,0x00890F10,0xFF,0x08901003,20230919
 # A,0x008A0F00,0xFF,0x08A0000B,20241125
 # A,0x00A00F00,0xFF,0x0A000033,20200413
 # A,0x00A00F10,0xFF,0x0A00107A,20240226
-# A,0x00A00F11,0xFF,0x0A0011DF,20260312
-# A,0x00A00F12,0xFF,0x0A00124B,20260305
+# A,0x00A00F11,0xFF,0x0A0011DE,20250418
+# A,0x00A00F12,0xFF,0x0A001247,20250327
 # A,0x00A00F80,0xFF,0x0A008005,20230707
 # A,0x00A00F82,0xFF,0x0A00820F,20241111
 # A,0x00A10F00,0xFF,0x0A10004B,20220309
@@ -13730,15 +13711,15 @@ exit 0                          # ok
 # A,0x00B00F00,0xFF,0x0B00004D,20240318
 # A,0x00B00F10,0xFF,0x0B001016,20240318
 # A,0x00B00F20,0xFF,0x0B002032,20241003
-# A,0x00B00F21,0xFF,0x0B002162,20251105
+# A,0x00B00F21,0xFF,0x0B002161,20251105
 # A,0x00B00F80,0xFF,0x0B008011,20241211
 # A,0x00B00F81,0xFF,0x0B008121,20251020
 # A,0x00B10F00,0xFF,0x0B10000F,20240320
-# A,0x00B10F10,0xFF,0x0B101059,20251105
+# A,0x00B10F10,0xFF,0x0B101058,20251105
 # A,0x00B20F40,0xFF,0x0B204037,20251019
 # A,0x00B40F00,0xFF,0x0B400034,20240318
-# A,0x00B40F40,0xFF,0x0B404038,20260408
-# A,0x00B40F41,0xFF,0x0B40410B,20260408
-# A,0x00B60F00,0xFF,0x0B60003C,20260401
-# A,0x00B60F80,0xFF,0x0B60803C,20260401
+# A,0x00B40F40,0xFF,0x0B404035,20251020
+# A,0x00B40F41,0xFF,0x0B404108,20251020
+# A,0x00B60F00,0xFF,0x0B600037,20251019
+# A,0x00B60F80,0xFF,0x0B608038,20251019
 # A,0x00B70F00,0xFF,0x0B700037,20251019