Skip to content

Renew the GO-2026-5932 scan exception #264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ai-collaboration-app wants to merge 2 commits into
base: master
Choose a base branch
from
+19 −11
Open

Renew the GO-2026-5932 scan exception #264

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d4f8305
Drop the GO-2026-5932 scan exception
stackstate-ci Aug 27, 2026
7afaaf4
Renew the GO-2026-5932 exception instead of dropping it
stackstate-ci Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 19 additions & 11 deletions exceptions/GO-2026-5932.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,24 +11,32 @@ component:
- opt/stackstate-agent/bin/agent/process-agent
status: accepted_with_compensating_control
reason: unpublished_image_vex_identity_bridge
expires: 2026-08-26
expires: 2026-09-10
owner: "@StackVista/observability-team"
upstream_owner: golang
upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
statement: |
The affected openpgp and openpgp/clearsign packages are absent from the
process-agent command dependency graph. StackVista/vexhub contains the
reviewed image-scoped not_affected statement, but Grype and Trivy require an
exact image digest or tag to match an image product. This pre-publication
scan uses a newly built commit image whose identity cannot be present in the
VEX hub in advance. Keep this bridge only until the scan pipeline can apply
the reviewed statement to unpublished images without broadening it to every
consumer of golang.org/x/crypto.
reviewed image-scoped not_affected statement, but it does not apply to the
pre-publication commit image this pipeline scans. Keep this bridge only until
the scan pipeline can apply the reviewed statement to unpublished images
without broadening it to every consumer of golang.org/x/crypto.

Renewed 2026-08-12. No compatible patch exists: the advisory covers all
Renewed 2026-08-27. No compatible patch exists: the advisory covers all
versions (introduced 0, no fixed release) because the openpgp packages are
permanently unmaintained, so upgrading golang.org/x/crypto cannot clear it.

@LouisLotter LouisLotter Aug 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 — Enforce the non-reachability claim before suppressing this advisory.

This exception is keyed by image and vulnerability ID only; the evaluator does not match component.purl or paths. As a result, any change that introduces golang.org/x/crypto/openpgp before 2026-09-10 would still be suppressed by this file even though the code would then be affected. The current graph is safe—I independently reproduced the Linux/CGO result of 1,335 packages, no OpenPGP packages, and only pbkdf2, scrypt, and ocsp from x/crypto—but that fact can drift. Please add a fail-closed CI check rejecting ^golang.org/x/crypto/openpgp(/|$) while this exception exists.

Absence re-verified against this commit with `go list -deps ./cmd/...`, which
resolves 1329 packages and no openpgp package; the only linked x/crypto
packages are cryptobyte, chacha20, chacha20poly1305, pbkdf2, scrypt and ocsp,
which are also why the indirect module cannot simply be dropped.
resolves 1335 packages and no openpgp package; the only linked x/crypto
packages are pbkdf2, scrypt and ocsp, which are also why the indirect module
cannot simply be dropped.

Deleting this file was tried on this branch and reverted: run 33075037844
reported the advisory as unmanaged on both architectures, while the containerd
statements in the same vexhub document kept matching. A local rebuild using the
same vexhub repository and the same pinned scanner versions did suppress it, so
the divergence is environmental rather than a change in the statement. One lead
worth checking first: the locally loaded image carries a RepoDigest and Trivy
derives its OCI product purl from that digest, whereas the CI image is built
with load: true and never pushed. Reproduce against a digest-less image before
attempting deletion again.
Loading