From 94f00b233ae3ec1f8b847bec3cce52ffc1d0c4bb Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Thu, 1 Oct 2026 11:38:39 -0300
Subject: [PATCH] test(xcat-dep): check every target ships Net::DNS 1.56 or
 newer

openeuler-24.03-ppc64le ships the openEuler GA rpm perl-Net-DNS-1.40.
That release has CVE-2026-64193 (EDNS EXTENDED-ERROR code injection) and
CVE-2026-64194 (unbounded compression-pointer chains). Net::DNS 1.56
fixes both.

The test now reads the release each target ships: the version of the
pinned publisher rpm, or else the version the spec builds. It fails
when that release is below 1.56. It fails on openeuler-24.03-ppc64le
until that target builds Net::DNS from the xcat-dep spec.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 t/net_dns_rr_types.t | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/t/net_dns_rr_types.t b/t/net_dns_rr_types.t
index 9b537e7..10470f9 100644
--- a/t/net_dns_rr_types.t
+++ b/t/net_dns_rr_types.t
@@ -73,7 +73,15 @@ if (($owner->{type} // '') eq 'publisher') {
 # when the built rpm does not match it. A pin below $KEY_FLOOR puts a Net::DNS without KEY back
 # into the repositories a service node reads, which have no EPEL copy to outrank it. An operator
 # pin (">= 0.80") accepts such a build too, so only an exact version is allowed here.
+# Net::DNS 1.56 fixes CVE-2026-64193 (EDNS EXTENDED-ERROR code injection) and CVE-2026-64194
+# (unbounded compression-pointer chains). A target ships either the published rpm its catalog pins
+# or the release this spec builds; that release, not the pin, is what reaches the repository.
+my $CVE_FLOOR = '1.56';
+
 for my $target (@targets) {
+    my $ships = $shipped{$target} // $version;
+    ok(version->parse($ships) >= version->parse($CVE_FLOOR),
+        "[$target] ships Net::DNS $CVE_FLOOR or newer ($ships), with CVE-2026-64193 and CVE-2026-64194 fixed");
     my $pin = $manifest{$target}{'perl-Net-DNS'};
     my $exact = $pin =~ /\A\d+(?:\.\d+)+\z/ ? 1 : 0;
     ok($exact, "[$target] the perl-Net-DNS pin ($pin) names one exact version");