[os 패키지 취약점 - v4] Red Hat

# [os 패키지 취약점 - v4] Red Hat

AI Summary

Purpose:

• Preserve the current 2026-08-20 Confluence design for rebuilding RHEL

OS-package vulnerability collection on Red Hat CSAF/VEX.

Key points:

• Confluence 4149674090 (VEX를 이용한 RHEL 취약점 수집 방법) is the design

source. DT/4209377355 implements its collection model and records the remaining decisions instead of silently changing the source scope.

• The physical model is now three tables: a roughly 90-row CPE dictionary,

roughly 4.87M vulnerability facts, and roughly 63K per-document collection states. The document-state table stays in gathering; the other two are also needed for serving.

• The fact key is (CPE, PACKAGE_NAME, MODULE, CVE_ID). The CPE string remains

visible because the same package and CVE can have different fixed EVRs for MAIN, EUS, AUS, and TUS products.

• The expected first-load size is about 1.5 GB, compared with the current

gathering copy at 3.71M rows / 14.7 GB. This is a design estimate and must be confirmed on the trial load.

• A literal host-CPE join would miss the AppStream rows used by the same host;

measurement put that miss at 38.2%. Matching therefore derives OS major and support channel from the host CPE, expands to the target repo streams, and then applies module conditions.

• MAIN and entitled-channel fixed EVRs differ in 96.9% of comparable cases, so

support-channel detection is part of correctness rather than presentation.

• Recomputing a changed document is still document-scoped, but the physical

write is a row diff. On 120 republished documents, 22.7% of fact rows changed and 75% changed no fact row. The design estimates about 7K row events/day for the diff versus 61.6K for delete-and-reinsert; this matters because the serving DB emits binlogs to customer on-premise servers.

• The page remains a design and measurement artifact. Implementation, trial

load, cutover, and the production false-positive reduction are not complete.

Relevant when:

• Verifying portfolio claims about the 2026 RHEL VEX redesign.
• Continuing the collector implementation, API contract, or table review.

Do not read full document unless:

• Exact DDL, sample rows, decision order, or the W34-W39 rollout plan is needed.

Linked documents:

• ai/wiki/projects/rhel-vex-vuln-collection.md
• ai/repo-notes/labrador-scrapers.md
• ai/worklog/2026/2026-W34.md

Open Questions

• RHEL 4-7 server streams, add-on channels, RHEL 7 realtime, and

known_not_affected storage still require team decisions.

• Agent access to entitlement certificates and enabled-module state is not yet

confirmed across the fleet.

• Gathering-to-serving publication and cutover/retention are undecided.

Details

• Captured from the rendered Confluence page on 2026-08-20.
• Sensitive comments, customer identifiers, credentials, and internal network

details were not copied.

• 2026-08-25: The Confluence page was restructured for readability (version

23). Mermaid diagrams now render as the team's Mermaid diagram macro with source code in expands, per-subscription descriptions moved into the subscription table, secondary tables (subscription × stream combinations, document-state examples) moved into expands, and a new section 6-5 adds three subscription-judgment scenarios (MAIN / TUS 8.6 / unreadable certificate) walked through the CPE dictionary and fact table. Design facts and measured numbers are unchanged; see ai/worklog/2026/2026-W35.md for the change record.