From 7bf37f407dd46f9341616d375d62d6450901bae3 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Tue, 20 Oct 2026 08:51:06 +0100 Subject: [PATCH 1/2] sec(deps): record dated Trivy ignores for the unfixable docker and openpgp advisories The Trivy fs scan reports five Go advisories on main. None has a version that clears it for the module path this repo resolves: - CVE-2026-41567, CVE-2026-42306 (HIGH), CVE-2026-41568, CVE-2026-33997 (MEDIUM) in github.com/docker/docker v28.5.1+incompatible. OSV has no fixed event for that module path; the fixes ship only in github.com/moby/moby/v2. The newest docker/docker Go version is v28.5.2+incompatible (still last_affected), and golang-migrate v4.20.1 still requires it. - GO-2026-5932 in golang.org/x/crypto/openpgp: frozen, no fixed event. None is reachable: no github.com/docker/docker or x/crypto/openpgp package appears in go list -deps or go list -test -deps (with and without -tags integration) for either module. docker/docker is in the graph only via golang-migrate's own pgx/v5 test (dhui/dktest). Each entry is an exact ID with its reason and an exp: review date, so the finding reappears on 2027-04-20 unless re-reviewed. The otel/sdk alert from the issue is already cleared on main (go.mod has v1.45.0). Co-Authored-By: Claude Opus 5.5 --- .trivyignore | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/.trivyignore b/.trivyignore index 48f88492f..a812ee55c 100644 --- a/.trivyignore +++ b/.trivyignore @@ -109,3 +109,54 @@ GCP-0015 # build artifacts -- including source maps (*.map, produced by hidden-source-map # in webpack.config.js) -- are uploaded to any GCS bucket. GCP-0001 + +# --------------------------------------------------------------------------- +# Go dependency vulnerabilities (trivy fs, gomod analyzer) -- issue #3 +# --------------------------------------------------------------------------- +# Each entry is one exact advisory ID with no published fix for the module +# path this repo resolves. The `exp:` date is the review date: once it +# passes, Trivy stops honoring the entry and the finding reappears, forcing +# a re-check of whether a fixed version now exists. Last reviewed 2026-10-20 +# against the trivy DB of that day and OSV. +# +# Reachability is not only asserted here: CI's govulncheck step (source mode, +# both modules, via scripts/govulncheck-retry.sh) exits 3 and fails the +# Security Scanning job if any of these advisories' vulnerable symbols +# becomes called. So these ignores silence the go.mod-level Trivy report +# only, never a reachable call. + +# github.com/docker/docker v28.5.1+incompatible (go.mod, indirect). +# Why unreachable: no package of this module is compiled into anything in +# this repo, not even a test. `go list -deps ./...` and +# `go list -test -deps ./...` (with and without -tags integration) return +# no github.com/docker/docker/... package. The requirement exists only in +# the module graph: golang-migrate's own pgx/v5 test imports +# github.com/dhui/dktest, which imports docker/docker. Our testcontainers +# use goes through github.com/moby/moby/client instead. All four advisories +# are in the Docker daemon (github.com/docker/docker/daemon or the plugin +# privilege check), which a client-side Go module cannot run. +# Why no fix: OSV publishes no `fixed` event for the github.com/docker/docker +# module path (CVE-2026-41567, -41568, -42306 have last_affected=28.5.2; the +# fixes ship only as github.com/moby/moby/v2 >= 2.0.0-beta.8/-beta.14). +# Trivy's "fixed in 29.3.1" for CVE-2026-33997 is the Docker Engine release, +# which has no github.com/docker/docker Go module version (the newest is +# v28.5.2+incompatible). golang-migrate v4.20.1 still requires +# docker/docker v28.5.2+incompatible, so a bump cannot remove it either. +# Review: drop these when golang-migrate/dktest move to github.com/moby/moby. +CVE-2026-41567 exp:2027-04-20 +CVE-2026-42306 exp:2027-04-20 +CVE-2026-41568 exp:2027-04-20 +CVE-2026-33997 exp:2027-04-20 + +# golang.org/x/crypto (openpgp subpackages), GO-2026-5932. +# Why unreachable: the advisory covers only golang.org/x/crypto/openpgp and +# its subpackages (armor, clearsign, elgamal, errors, packet, s2k). Nothing +# in this repo imports any of them: `go list -deps` and `go list -test -deps` +# (with and without -tags integration, both modules) return no +# golang.org/x/crypto/openpgp package; the x/crypto packages actually built +# are bcrypt, ssh, pkcs12, hkdf and their internal dependencies. +# Why no fix: the package is frozen and unmaintained; OSV lists +# introduced=0 with no fixed event, so no x/crypto version clears it. +# scripts/scan-shipped-image.sh already tolerates it in /app/cudly for the +# same reason. +GO-2026-5932 exp:2027-04-20 From 77deed6271645417504e470c07dea4baa378395d Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Wed, 21 Oct 2026 08:24:24 +0100 Subject: [PATCH 2/2] sec(deps): scope the Go advisory ignores by purl in .trivyignore.yaml Move the five docker/docker and x/crypto openpgp advisory ignores from the plain .trivyignore, where they matched on ID for every package, to a new .trivyignore.yaml that scopes each one by purl. The CI Trivy fs step now reads that file through trivy-action's trivyignores input. So the same IDs are still reported for github.com/moby/moby/v2, which has fixed versions. Also correct the expiry wording: an expired entry brings the finding back in the Security tab but does not fail CI, because the fs step uses exit code 0. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 6 +++ .trivyignore | 53 ++--------------------- .trivyignore.yaml | 90 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+), 50 deletions(-) create mode 100644 .trivyignore.yaml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9b1e8106e..f362c757b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -826,6 +826,12 @@ jobs: # save working files in the repository root). output: '${{ runner.temp }}/trivy-results.sarif' severity: 'CRITICAL,HIGH' + # Purl-scoped ignores for unreachable, unfixed Go dependency + # advisories (issue #3). With a single YAML file the action sets + # TRIVY_IGNOREFILE to it, so this step does not read .trivyignore; + # that file holds only config-scan IDs, which the default fs + # scanners (vuln, secret) never report. + trivyignores: '.trivyignore.yaml' # Pin the Trivy binary independently of the action SHA. v0.36.0 is # the latest trivy-action release but bundles Trivy v0.70.0, which # panics in adaptDefaultTags on terraform/environments/aws/main.tf diff --git a/.trivyignore b/.trivyignore index a812ee55c..437d8ee2d 100644 --- a/.trivyignore +++ b/.trivyignore @@ -110,53 +110,6 @@ GCP-0015 # in webpack.config.js) -- are uploaded to any GCS bucket. GCP-0001 -# --------------------------------------------------------------------------- -# Go dependency vulnerabilities (trivy fs, gomod analyzer) -- issue #3 -# --------------------------------------------------------------------------- -# Each entry is one exact advisory ID with no published fix for the module -# path this repo resolves. The `exp:` date is the review date: once it -# passes, Trivy stops honoring the entry and the finding reappears, forcing -# a re-check of whether a fixed version now exists. Last reviewed 2026-10-20 -# against the trivy DB of that day and OSV. -# -# Reachability is not only asserted here: CI's govulncheck step (source mode, -# both modules, via scripts/govulncheck-retry.sh) exits 3 and fails the -# Security Scanning job if any of these advisories' vulnerable symbols -# becomes called. So these ignores silence the go.mod-level Trivy report -# only, never a reachable call. - -# github.com/docker/docker v28.5.1+incompatible (go.mod, indirect). -# Why unreachable: no package of this module is compiled into anything in -# this repo, not even a test. `go list -deps ./...` and -# `go list -test -deps ./...` (with and without -tags integration) return -# no github.com/docker/docker/... package. The requirement exists only in -# the module graph: golang-migrate's own pgx/v5 test imports -# github.com/dhui/dktest, which imports docker/docker. Our testcontainers -# use goes through github.com/moby/moby/client instead. All four advisories -# are in the Docker daemon (github.com/docker/docker/daemon or the plugin -# privilege check), which a client-side Go module cannot run. -# Why no fix: OSV publishes no `fixed` event for the github.com/docker/docker -# module path (CVE-2026-41567, -41568, -42306 have last_affected=28.5.2; the -# fixes ship only as github.com/moby/moby/v2 >= 2.0.0-beta.8/-beta.14). -# Trivy's "fixed in 29.3.1" for CVE-2026-33997 is the Docker Engine release, -# which has no github.com/docker/docker Go module version (the newest is -# v28.5.2+incompatible). golang-migrate v4.20.1 still requires -# docker/docker v28.5.2+incompatible, so a bump cannot remove it either. -# Review: drop these when golang-migrate/dktest move to github.com/moby/moby. -CVE-2026-41567 exp:2027-04-20 -CVE-2026-42306 exp:2027-04-20 -CVE-2026-41568 exp:2027-04-20 -CVE-2026-33997 exp:2027-04-20 - -# golang.org/x/crypto (openpgp subpackages), GO-2026-5932. -# Why unreachable: the advisory covers only golang.org/x/crypto/openpgp and -# its subpackages (armor, clearsign, elgamal, errors, packet, s2k). Nothing -# in this repo imports any of them: `go list -deps` and `go list -test -deps` -# (with and without -tags integration, both modules) return no -# golang.org/x/crypto/openpgp package; the x/crypto packages actually built -# are bcrypt, ssh, pkcs12, hkdf and their internal dependencies. -# Why no fix: the package is frozen and unmaintained; OSV lists -# introduced=0 with no fixed event, so no x/crypto version clears it. -# scripts/scan-shipped-image.sh already tolerates it in /app/cudly for the -# same reason. -GO-2026-5932 exp:2027-04-20 +# Go dependency vulnerability (trivy fs) suppressions live in +# .trivyignore.yaml, where each entry is scoped to one module by purl. +# Keep this file for config-scan IDs only. diff --git a/.trivyignore.yaml b/.trivyignore.yaml new file mode 100644 index 000000000..1b3a99233 --- /dev/null +++ b/.trivyignore.yaml @@ -0,0 +1,90 @@ +# Trivy ignore file for Go dependency vulnerabilities (trivy fs, gomod +# analyzer) -- issue #3. +# +# Config-scan (misconfiguration) suppressions stay in the plain .trivyignore, +# which `trivy config` (CI's IaC step and the pre-commit hook) reads by +# default. This file is YAML so every entry can be scoped by purl: an entry +# suppresses its advisory ID only for the named Go module, not for every +# package Trivy finds it in. For example, CVE-2026-41567 also covers +# github.com/moby/moby/v2 below 2.0.0-beta.14, which has a fix, so it must +# still be reported there. +# +# Who reads this file: only CI's "Run Trivy vulnerability scanner +# (filesystem)" step in .github/workflows/ci.yml, via its `trivyignores:` +# input. That step runs Trivy's default fs scanners (vuln, secret), so it +# does not need the misconfiguration entries in .trivyignore. Its SARIF +# carries every severity (trivy-action drops `severity:` for SARIF unless +# `limit-severities-for-sarif` is set), so all five entries below affect the +# Security tab. Local `make security-scan` / scripts/security-scan.sh runs +# read the default .trivyignore and still list these advisories; add +# `--ignorefile .trivyignore.yaml` for a vuln-only local scan that matches CI. +# +# `expired_at` is the review date. After it passes, Trivy stops honoring the +# entry and the finding reappears in the Security tab. It does not fail CI: +# the fs step uses the default exit-code 0. Last reviewed 2026-10-20 against +# the trivy DB of that day and OSV. +# +# Reachability is not only asserted here: CI's govulncheck step (source mode, +# both modules, via scripts/govulncheck-retry.sh) exits 3 and fails the +# Security Scanning job if any of these advisories' vulnerable symbols +# becomes called. So these ignores silence the go.mod-level Trivy report +# only, never a reachable call. + +vulnerabilities: + # github.com/docker/docker v28.5.1+incompatible (go.mod, indirect). + # Why unreachable: no package of this module is compiled into anything in + # this repo, not even a test. `go list -deps ./...` and + # `go list -test -deps ./...` (with and without -tags integration) return + # no github.com/docker/docker/... package. The requirement exists only in + # the module graph: golang-migrate's own pgx/v5 test imports + # github.com/dhui/dktest, which imports docker/docker. Our testcontainers + # use goes through github.com/moby/moby/client instead. All four + # advisories are in the Docker daemon (github.com/docker/docker/daemon or + # the plugin privilege check), which a client-side Go module cannot run. + # Why no fix: OSV publishes no `fixed` event for the github.com/docker/docker + # module path (CVE-2026-41567, -41568, -42306 have last_affected=28.5.2; + # the fixes ship only as github.com/moby/moby/v2 >= 2.0.0-beta.8/-beta.14). + # Trivy's "fixed in 29.3.1" for CVE-2026-33997 is the Docker Engine + # release, which has no github.com/docker/docker Go module version (the + # newest is v28.5.2+incompatible). golang-migrate v4.20.1 still requires + # docker/docker v28.5.2+incompatible, so a bump cannot remove it either. + # Review: drop these when golang-migrate/dktest move to github.com/moby/moby. + # The purl has no version, so it matches any github.com/docker/docker + # version; none has a fix for these IDs. + - id: CVE-2026-41567 + purls: + - pkg:golang/github.com/docker/docker + statement: Unreachable daemon-side advisory; no fixed github.com/docker/docker module version. See the comment above. + expired_at: 2027-04-20 + - id: CVE-2026-42306 + purls: + - pkg:golang/github.com/docker/docker + statement: Unreachable daemon-side advisory; no fixed github.com/docker/docker module version. See the comment above. + expired_at: 2027-04-20 + - id: CVE-2026-41568 + purls: + - pkg:golang/github.com/docker/docker + statement: Unreachable daemon-side advisory; no fixed github.com/docker/docker module version. See the comment above. + expired_at: 2027-04-20 + - id: CVE-2026-33997 + purls: + - pkg:golang/github.com/docker/docker + statement: Unreachable daemon-side advisory; no fixed github.com/docker/docker module version. See the comment above. + expired_at: 2027-04-20 + + # golang.org/x/crypto (openpgp subpackages), GO-2026-5932. + # Why unreachable: the advisory covers only golang.org/x/crypto/openpgp and + # its subpackages (armor, clearsign, elgamal, errors, packet, s2k). Nothing + # in this repo imports any of them: `go list -deps` and `go list -test -deps` + # (with and without -tags integration, both modules) return no + # golang.org/x/crypto/openpgp package; the x/crypto packages actually built + # are bcrypt, ssh, pkcs12, hkdf and their internal dependencies. + # Why no fix: the package is frozen and unmaintained; OSV lists + # introduced=0 with no fixed event, so no x/crypto version clears it. + # scripts/scan-shipped-image.sh already tolerates it in /app/cudly for the + # same reason. + - id: GO-2026-5932 + purls: + - pkg:golang/golang.org/x/crypto + statement: Frozen openpgp subpackages, not imported anywhere; no fixed x/crypto version. See the comment above. + expired_at: 2027-04-20